GoModel MCP Gateway
The GoModel gateway puts MCP servers behind one protected address and keeps their tokens out of the agent's reach.
- 1,318 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Holds tokens of connected services and passes them to upstream servers on behalf of clients.
- Without a configured key the gateway accepts requests with no authentication.
Install
- Works in
Manual install
docker run --rm -p 8080:8080 -v gomodel_data:/app/data enterpilot/gomodelThe first method from the README, then open `/admin/dashboard` and add a provider.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Holds tokens of connected services and passes them to upstream servers on behalf of clients.
- Without a configured key the gateway accepts requests with no authentication.
This is third-party code. Review the repository files before installing.
What it does
GoModel is a model gateway in Go with OpenAI- and Anthropic-compatible APIs, and its MCP gateway section sits between agents and MCP servers. Clients such as Claude Code, Claude Desktop, Cursor and VS Code connect to one `/mcp` endpoint with a GoModel key. The gateway injects the headers and tokens of upstream servers itself, so clients never see them. Tools and prompts from all servers are gathered into one catalog with names such as `github_create_issue`. Visibility is narrowed by user paths (`user_paths`), allow and deny tool lists, a single-server address `/mcp/{slug}` or a virtual server. Every tool call is recorded in usage tracking and the audit log. The `tool_discovery: search` mode replaces the list with two tools, `search_tools` and `call_tool`, which saves model context.
Who it is for. Platform and security teams that hand different agents different sets of MCP tools and want to keep connected service tokens in one place.
Good fit when
- Several agents work with GitHub, Linear and Sentry while tokens stay in the gateway.
- Contractors lose part of the tools, such as repository deletion.
- An agent gets a virtual server with only the code review tools it needs.
- A log is needed of who called which tool, with duration and errors.
Not a fit when
- A single agent works with a single server, and a gateway adds an extra hop.
- There is no capacity to deploy and update your own gateway.
- A client needs a stdio server from the image, while the official image has no Node or Python.
Example request
Show which tools my key sees through the gateway and create a Linear task through `linear_create_issue`.MCP
- Transport
- http
- Authentication
- key is optional
Environment variables
GOMODEL_MASTER_KEYsecret- Gateway key; without it the gateway runs with no authentication.
MCP_SERVERS- JSON object with upstream MCP servers to aggregate in the gateway.
Limitations
The image contains only the GoModel binary, so `npx` and `uvx` commands cannot start inside it. Stdio servers need a bridge such as supergateway in a separate container, and its port must not be published. If `GOMODEL_MASTER_KEY` is unset the gateway runs with no authentication. Changes from the dashboard reach other instances on a schedule (`CACHE_REFRESH_INTERVAL`, one hour by default). macOS, Linux and Windows have install scripts, and Docker works everywhere.
How to disable. Remove the gomodel entry from client MCP configurations and stop the gateway container. Upstream server tokens were kept in GoModel, so revoke them in the services themselves.
FAQ
How do I connect Claude Code to the gateway?
Run `claude mcp add --transport http --scope user gomodel https://gomodel.example.com/mcp --header "Authorization: Bearer ${GOMODEL_API_KEY}"` with your gateway address. Then verify with `claude mcp list`.
How do I add an MCP server to the gateway?
On the MCP Servers page of the dashboard click Add MCP Server and enter a name, transport, URL and headers. Or declare servers in `config.yaml` or in the `MCP_SERVERS` variable as JSON.
When should I enable tool search mode?
For clients that send every tool to the model, such as custom agents. Claude Code has its own deferred tool search, so the mode is not needed there.
How do I hide dangerous tools?
Set `disallowed_tools`, for example `["delete_repo"]`, or `allowed_tools` for an allowlist. Hidden tools never appear in `tools/list`.
How does GoModel differ from a plain MCP proxy?
It serves as a gateway to both LLM providers and MCP, so limits, budgets and audit apply to model requests and tool calls together.
Discussion
No questions or reviews yet.
Related
MCP serversA self-hosted gateway routes internal MCP tools, authenticates users and records requests for later review.
The CLI runs a model gateway that routes requests across backends and executes MCP tools under configured policies.
A CLI runs a model and MCP-tool gateway with owned API keys, format translation, routing and request logs.
AIHelms is an organizational MCP gateway that attributes calls to employee keys and tracks configured per-tool costs.
A self-hosted gateway between AI apps and models, MCP tools and A2A agents: policy, budgets, routing and an audit trail
A self-hosted gateway that merges several MCP servers into one endpoint with auth and tool selection
README in short
GoModel accepts OpenAI and Anthropic requests and routes them to many providers. The MCP gateway section has its own documentation page, as does connecting Claude Code and Codex.