Lasso MCP Gateway
A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging
- 399 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The gateway launches configured servers and exposes tools with the child processes’ permissions
- The lasso plugin sends request and response content to an external cloud API
- The --scan mode rewrites the client's mcp.json configuration file
Install
- Works in
Manual install
pip install mcp-gatewayRequires Python 3.10 or later. Extras: pip install "mcp-gateway[presidio]" and pip install "mcp-gateway[xetrack]". The main example uses basic only.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The gateway launches configured servers and exposes tools with the child processes’ permissions
- The lasso plugin sends request and response content to an external cloud API
- The --scan mode rewrites the client's mcp.json configuration file
This is third-party code. Review the repository files before installing.
What it does
Lasso Security’s MCP Gateway reads server definitions from `mcp.json`, launches child processes and exposes their tools to the agent. Tool names receive a server prefix, such as `<server_name>_<tool.name>`. `get_metadata` provides connection information, and child-server prompts are also available through the gateway. Calls pass through enabled plugins. `basic` detects known token and secret patterns in text responses. `presidio` targets personal data, `lasso` calls Lasso Security’s cloud API, and `xetrack` records parameters and results in SQLite and log files. Additional plugins install separately. `--scan` checks reputation using Smithery, npm and GitHub before child processes start. Tool descriptions are inspected later, after server startup and initialization. Scan status is stored in configuration; a server marked `blocked` is not connected on the next load.
Who it is for. For developers and security teams who connect many MCP servers to Cursor or Claude Desktop and want secrets and personal data hidden before they reach the model context.
Good fit when
- An agent reads files with GitHub, AWS or Slack tokens through an MCP server and the keys must be masked in the response
- Card numbers, phone numbers and email addresses flow from MCP servers into the model and should be hidden with the presidio plugin
- Before connecting a third-party server from npm or Smithery you want to rate its reputation and check its tool descriptions
- Debugging or auditing needs a log of every tool call in SQLite
- Your company already has a Lasso Security account and wants natural-language policies against prompt injection
Not a fit when
- You need one server for one task: the gateway adds a layer you have to configure and update
- Masking would be the only safeguard for data: the basic plugin knows a fixed set of secret types and lets everything else through
- Your client is neither Cursor nor Claude Desktop: setup examples exist only for them, so you port the format yourself
- You require blocking on every check failure: some basic and lasso errors pass the original data through
Example request
Create a separate test file with a fabricated HF_TOKEN and no real secrets. Read it through mcp-gateway and show whether basic masked the test valueMCP
- Transport
- stdio
- Authentication
- not required
Environment variables
LASSO_API_KEYsecret- A Lasso Security key, needed only by the lasso plugin.
XETRACK_DB_PATH- Path to the SQLite database where the xetrack plugin stores events.
XETRACK_LOGS_PATH- Folder for the xetrack plugin log files.
Limitations
Python 3.10 or later is required. Version 1.2.1 is marked beta and uses MIT. Child servers run with the user’s permissions; the gateway does not provide OS isolation. Their installation and network actions must be considered separately from tool-description checks.
`basic` does not sanitize request arguments or non-text responses. On a cleaning error, it may return the original text. Known-secret patterns cannot cover every sensitive value. The cloud `lasso` plugin sends content to an external API; without a key or after an unexpected error, checks may be skipped.
`--scan` modifies configuration, and `xetrack` stores parameters and results that can include sensitive text. Back up the configuration and choose a log location before setup.
How to disable. Remove the mcp-gateway entry from mcp.json and restore the servers from its servers key as separate entries. Then uninstall the package with pip uninstall mcp-gateway. If you used xetrack, the database and logs stay where XETRACK_DB_PATH and XETRACK_LOGS_PATH point, and you can delete them by hand.
FAQ
How do I connect MCP Gateway in Cursor?
Install `pip install mcp-gateway`. Add a gateway entry to Cursor’s configuration with `--mcp-json-path`, the absolute path to that file and `--plugin basic`. Move selected servers into the gateway entry’s `servers` key, preserving commands, arguments and environment variables. Back up the original configuration first.
Which secrets does the basic plugin mask?
Azure client secrets, GitHub tokens and OAuth tokens, GCP API keys, AWS access tokens, JWT, GitLab session cookies, Hugging Face tokens, Microsoft Teams webhooks and Slack app tokens. Card numbers, IP addresses, emails, phone numbers and SSN are the job of the presidio plugin.
Do I need a Lasso Security key to use the gateway?
Only for the lasso plugin: you get a key by signing up on the Lasso Security site and pass it in the LASSO_API_KEY variable. The basic, presidio and xetrack plugins need no key.
How do I vet MCP servers before they run?
`--scan` enables reputation checks and tool-description analysis. They occur at different stages: the gateway must already start a server to obtain its tool descriptions. Review recorded statuses and reasons, but do not treat the scan as permission to run any discovered package.
Where do I see the log of tool calls?
Run the gateway with the xetrack plugin: call parameters go to logs/<date>.log files and every event lands in the events table of a SQLite database whose path is set by XETRACK_DB_PATH. You can read the database with the xt tail command, the xetrack Python library or DuckDB.
Discussion
No questions or reviews yet.
Related
MCP serversMCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
CLI mediator scans agent network requests and MCP calls for secret leaks, unsafe destinations and injected instructions
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
A Mac key vault for agents: Sallyport runs HTTP and SSH with your keys over MCP, and the agent never receives the key itself
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Lasso MCP Gateway (this card) | yes | not required | 399 | |
| MetaMCP | no | API key | 2,752 | a self-hosted gateway with a web interface, namespaces and API key or OAuth authorization |
| Docker MCP Gateway | yes | not required | 1,626 | a Docker gateway that runs each server in its own container |
| Pipelock | no | 984 | CLI mediator scans agent network requests and MCP calls for secret leaks, unsafe destinations and injected instructions |
README in short
Plugins are selected independently: local masking needs no Lasso account, while cloud checks require a key. Disabling the gateway does not undo child-tool actions or delete saved logs.