mcp-gateway

Designed primarily as a local development and debugging tool. Captured MCP traffic, including potentially sensitive OAuth tokens or API keys, is stored unencrypted in SQLite databases (`~/.mcp-gateway/logs.db`) and custom HTTP headers are stored in `mcp.json`. Authentication tokens for the Gateway's Web UI/API are displayed in the terminal and can be visible in browser URLs. By default, it operates on `localhost` without TLS, making it vulnerable to local Man-in-the-Middle attacks. No built-in rate limiting, audit logging, or secret management. While generally safe for its intended local debugging purpose, it is explicitly not recommended for production use without significant security hardening (e.g., reverse proxy with TLS/auth, stricter file permissions, external secret management).