MCP REST Bridge

English

Español

English

Español

Appearance

MCP REST BridgeAny REST, GraphQL or MCP server → secure, governed AI tools

The self-hosted MCP gateway with a real admin UI. Auto-discover tools from OpenAPI, GraphQL, a cURL command or a Postman export — or aggregate other MCP servers. Per-tool guardrails, RBAC and circuit breaking in one binary. No Kubernetes.

Try the live demo ↗
Get started
⭐ Star on GitHub

Connect anything

Auto-discover tools from an OpenAPI or GraphQL spec, a cURL command or a Postman export — or re-expose an existing MCP server. REST, GraphQL and MCP-to-MCP in one gateway.

A real admin UI

Not a pile of YAML. A full Vue 3 dashboard for servers, tool bundles, keys, usage, alerts, schedules and the audit log.

Secure by default

SSRF + DNS-rebinding protection with IP pinning, prompt-injection sanitizing, secret detection and fail-closed per-tool key restrictions — built in, not a plugin.

Per-tool governance

Rate limits, timeouts and allowed-key rules on any single tool, plus per-client circuit breakers. RBAC (admin / operator / auditor / viewer) plus team multi-tenancy.

Observable & auditable

Prometheus /metrics, OpenTelemetry tracing per call, usage-anomaly alerts, and a tamper-evident hash-chained audit log with SIEM streaming.

Runs anywhere

Bun single process with bun:sqlite storage. No external database, no Kubernetes. One Docker image, or `bun src/index.ts`.

See it in action ​

The whole bridge is managed from a built-in dashboard — register backends, curate what each client sees, and watch health, usage and audit trails live.

MCP REST Bridge admin — OverviewMCP REST Bridge admin — ServersMCP REST Bridge admin — Usage▶ Open the live demo

🎮 Try the live demo → — the real admin UI running on mock data, right in your browser. No install, no signup.

Convert anything to MCP

Six ways to turn a backend into governed MCP tools — all through the same guard pipeline.

openapi_url

OpenAPI / Swagger

Auto-discover one MCP tool per operation from the spec.

graphql_url

GraphQL

Introspect the schema — one tool per query & mutation.

curl_input

cURL command

Paste a working curl invocation and get one tool.

postman_collection

Postman

One tool per request in a v2.1 collection export.

tools[]

Manual

No spec? Hand-write exactly the tools you need.

kind: "mcp"

MCP server

Re-expose an existing MCP server's tools, governed.

See every registration path →

60-second quickstart ​

bash
docker build -t mcpbridge .

export ADMIN_API_KEY=$(openssl rand -hex 24)

docker run -p 3000:3000 \
  -e NODE_ENV=development \
  -e SESSION_COOKIE_SECURE=false \
  -e BOOTSTRAP_ADMIN_USERNAME=admin \
  -e BOOTSTRAP_ADMIN_PASSWORD=change-me-min-12-chars \
  -e ADMIN_API_KEYS=$ADMIN_API_KEY \
  -v "$PWD/data:/app/data" \
  mcpbridge

Open http://localhost:3000/admin, log in, and add your first server. $ADMIN_API_KEY is the Bearer token the curl/CLI examples throughout these docs use — keep it exported in the same shell. Then point any MCP client at that backend's shard — http://localhost:3000/mcp/<your-server> — or curate a bundle to serve several backends behind one endpoint. Full walkthrough in Getting started →

How it works ​

How MCP REST Bridge works AI clients send tool calls over MCP; the bridge runs each call through SSRF checks, guardrails, per-tool policy, circuit breakers and an audit log, then dispatches it to your REST APIs or upstream MCP servers. AI CLIENTSYOUR BACKENDSSSRFGuardrailsBreakerDispatchAuditMCP REST Bridgeone governed path for every callGUARD PIPELINEClaudeCursorAgents & IDEsREST / OpenAPIMCP upstreamsMCPRESTMCP
Tool calls in over MCP — dispatched out to your REST APIs or MCP servers, through the full guard stack on every hop.

Serve backend tools two ways: per-client /mcp/:name for one backend, or a curated bundle /mcp-custom/:bundle to put several behind one endpoint. The /mcp root is the control plane — sys_* tools an agent uses to operate the gateway itself, not backend tools. (How bundles aggregate several backends →)

Why teams pick it ​

  • The UI is the product. Most open-source MCP gateways are config-file only. This one ships a dashboard you'd actually hand to a teammate.
  • One tool, both directions. Bridge REST APIs and aggregate MCP servers behind a single governed endpoint.
  • Security isn't an add-on. SSRF, injection sanitizing and secret detection are on by default, on every path.
  • No heavy infra. No Kubernetes, no Postgres, no sidecars. A binary and a SQLite file.
  • Tested for real. 330+ backend test files, Vitest, Playwright e2e and Stryker mutation testing — coverage that measures whether the tests catch bugs, not just run lines.

Released under the MIT License · Built with Bun + Vue.

Open source · https://github.com/CarlxsMG/mcpbridge