MCP Gateway

One address for every tool your agents call

To your agents, Meandr is the MCP server. It hands each call to the server that owns the tool and signs in there for them.

Try for free Follow one call

One endpoint

Your agent's config, before and after

Without a gateway, every agent lists every server it uses and carries a secret for each. With Meandr, it lists one.

Without a gatewayin every agent
{
  "mcpServers": {
    "notion": { "url": "https://mcp.notion.com/mcp",
      "headers": { "Authorization": "Bearer ntn_…" } },
    "postgres": { "command": "npx",
      "args": ["mcp-postgres", "postgres://app:…@db"] },
    "aws": { "command": "uvx",
      "env": { "AWS_SECRET_ACCESS_KEY": "…" } },
    "linear": { "url": "https://mcp.linear.app/mcp",
      "headers": { "Authorization": "Bearer lin_…" } }
  }
}
With Meandrsame tools
{
  "mcpServers": {
    "acme": {
      "url": "https://acme-main.meandr.io",
      "headers": { "Authorization": "Bearer mk_…" }
    }
  }
}

Claude Desktop signs in through OAuth instead, so there is no key to paste at all.

  • Add a server once

    Attach it to the workspace and its tools join the list your agents already use. No agent config to edit.

  • Secrets stay in Meandr

    Each server's credential is kept by Meandr. An agent holds only its own Meandr key, and that key stops at Meandr.

  • Cut off one agent

    Revoke one agent's key and it loses every tool at once, while the servers and the other agents carry on.

How it works

What the MCP gateway does with each tool call

  1. 01 Your agent's side

    Your agents connect to Meandr as their MCP server

    Each workspace is one MCP server at its own connection URL. The Meandr key in each request tells Meandr which agent is calling.

    Connection URL

    https://acme-main.meandr.ioCopy

    The MCP endpoint clients connect to.
    Quickstart: endpoint, key, first call

  2. 02 Routing

    One tool list, each call sent to the server that owns the tool

    The agent asks for its tools and gets one list, built from every server the workspace attaches. Meandr matches each call by tool name to the server that owns the tool and forwards it unchanged, apart from an aliased name. On the way out, Meandr signs in to that server with the server's own method, and the agent's key stops at Meandr.

    The agent's tool list
    • notion_searchNotionOAuth
    • queryPostgresstdio tunnel
    • call_awsAWS MCPAWS SigV4
    • browser_navigatePlaywrighthosted
    • linear_search aliasLinearAPI key
    How Meandr signs in to servers and stores credentials

  3. 03 Rate limits

    Limit calls per workspace, per agent and per server

    Set a cap for the workspace, a default for each agent and a default for each server.

    • Windows in seconds, minutes or hours, several per scope
    • An override for one agent or server can only tighten the default
    • When a workspace attaches a server, you pick Shared (one count across workspaces) or Isolated (a count per workspace)
    Rate limits
    • Per workspace30 / minute
    • Per agent10 / minute
    • Per server500 / hour

Questions about the MCP gateway

How is an MCP gateway different from an API gateway?
An API gateway routes HTTP requests. An MCP gateway reads each MCP call, so it can apply rules per agent and per tool. MCP gateway vs proxy →
Does my agent need to know which server has a tool?
No. The agent calls a tool by its name, and Meandr looks up the server that owns it. However many servers sit behind the workspace, the agent talks to one.

Give your agents one MCP gateway to every server

Your agents get one address. Each server gets the sign-in it expects.

Try for free

Questions? Email us