The Model Context Protocol (MCP) is how an AI agent calls a tool. Instead of hard-coding an integration, the agent connects to an MCP server, asks it what tools it offers, and invokes them by name with structured arguments. It is a clean, general interface — and like every clean, general interface that reaches production, it eventually needs something sitting in front of it.
An MCP gateway is that something. It is the same idea the web settled on years ago: you do not expose your services directly to callers, you put an API gateway and a web application firewall (WAF) between them. Meandr applies that discipline to the agent-to-tool boundary. The mental model we build to is “Cloudflare for MCP” — a managed proxy that every tool call passes through, where policy, rate limits, approvals, audit, and cost attribution live.
Why put a gateway in front at all
Left to itself, an agent talks straight to a tool server with a long-lived credential and no supervision. That is fine on a laptop and alarming in production. A misbehaving agent can burn an API key, trigger a destructive operation, or leak data through a badly shaped argument — and nothing is watching. There is no per-tenant rate limit, no enforcement on the shape of a call, no audit trail, and no way to attribute cost.
The gateway is where all of that becomes possible, because it is the one point every call has to cross. Once traffic flows through a single control plane you can decide allow, deny, or require a human’s approval on each call, cap how fast an agent may run, keep an immutable record of what happened, and roll cost up per project — none of which the agent has to know about.
What Meandr terminates, and what it forwards
Agents connect to one Meandr endpoint over standard MCP — streamable HTTP or SSE on port 443. To the agent, Meandr is the MCP server: it answers the agent’s initialize handshake itself, terminates that session, and runs its own separate sessions to the real upstream servers behind it. Nothing about the agent changes. There is no SDK to adopt and no code to rewrite — you point the client at a different URL. That is the whole of “one endpoint, zero agent code changes.”
Concretely, the change is a config block: the project endpoint, plus a Meandr token as a bearer header. Any MCP client that supports a remote server with custom headers reads it as JSON like this.
{
"mcpServers": {
"meandr": {
"type": "http",
"url": "https://<your-slug>.meandr.io/",
"headers": {
"Authorization": "Bearer tok_<your-key>"
}
}
}
}That single endpoint is the MCP gateway in front of every tool server — routing, rate limits and policy all happen on the way through it.
On the security boundary, Meandr terminates TLS from the agent and re-encrypts to each upstream, with upstream certificate verification on by default. It aggregates every tool server a project connects into a single tools/list, filtered per agent by policy, and routes each tools/call to the correct upstream. Whatever authentication a given server expects — a bearer token, a custom header, OAuth, mutual TLS, or AWS SigV4 — Meandr signs in for you, so the agent never holds the upstream credential.
In between the two sessions, every call is read in full and judged before a single byte reaches the upstream. A denied call is never dialed. Because the payloads are structured, a rule can match the actual argument value — amount > 10000 matches the real parameter, not a regex over a blind body, which is what makes a WAF for tool calls stronger than a WAF for raw HTTP.
What a gateway is not
Meandr proxies to tool servers; it does not host them, and it is deliberately not a workflow builder, an agent framework, or a model router. It governs the boundary between agents and the tools they already use — nothing more, and it does that one job thoroughly.
That narrow scope is the point. A gateway earns its place by being the calm, predictable layer every call passes through: one endpoint for the agent, one place to write the rules, one record of everything that happened.
From here, read how governance works across a fleet of agents, or start with your first policy.