Skip to main content

What is Gig'MCP?

Gig'MCP is an open-source, security-first MCP (Model Context Protocol) gateway. It runs community MCP servers in kernel-enforced sandboxes and injects your credentials at the network boundary — so one compromised tool can never expose your keys.

You connect your MCP client (Claude Code, Cursor, ...) to a single gateway endpoint. The gateway aggregates sandboxed MCP servers behind it and handles authentication, credential storage, and egress control for all of them.

The problem​

Today, every MCP server you install:

  • holds your raw API keys in its environment or config,
  • has unrestricted network access — it can send those keys anywhere,
  • has unrestricted filesystem access on your machine,
  • is configured separately in every client you use.

Community MCP servers are useful and plentiful, but each one is third-party code you're handing your credentials to. A single malicious or compromised server — or a prompt-injected dependency — can exfiltrate every key it was given.

How Gig'MCP solves it​

Gig'MCP's model is: MCP servers are untrusted; the kernel is the boundary; keys live only on the trusted side.

  1. Sandbox. Each server runs as a bubblewrap child process inside the gateway container, with its own user, PID, mount, and network namespaces, a seccomp-BPF filter, and a capability drop to uid 65534 with zero capabilities. No host filesystem, cleared environment.
  2. Placeholder credentials. The sandbox receives only a placeholder token in its environment — never the real key.
  3. Egress proxy. Each sandbox's network namespace has exactly one route: the gateway's embedded MITM egress proxy. The proxy identifies which sandbox is calling by the connection's source IP (unforgeable — each sandbox can only source its own /30), checks the destination domain against the server's manifest allowlist, and only then swaps the placeholder for the real key.
  4. Vault. Real credentials are stored envelope-encrypted (per-secret DEKs, XChaCha20-Poly1305, wrapped by a master key that never touches the database). See vault.
  5. Registry. Servers come from a curated, PR-gated registry of digest-pinned OCI images with author-declared entitlement manifests. CI publishes a signed index.json that the gateway verifies before trusting any entry.
  6. Dashboard. A Next.js dashboard manages servers, profiles, credentials, and users against the gateway's REST API.

The full request flow: client calls a tool → gateway routes to that user's sandbox instance → server makes an HTTPS call with the placeholder token → the only route is the proxy → proxy resolves identity from the source IP, checks the allowlist, swaps in the vault-decrypted key, forwards, and writes an audit log entry.

Who it's for​

  • Self-hosters and homelab operators who want to use community MCP servers without handing them credentials. Deploys with Docker Compose on any Linux host (on macOS, it runs inside Docker — bubblewrap and network namespaces are Linux-only).
  • Teams that want one managed MCP endpoint per profile, with multi-user auth (OIDC/SSO today; local login is in the design), roles, and an audit trail, instead of per-client config sprawl.
  • Anyone who refuses to upload API keys to a third party. Credentials can stay entirely on your own hardware.

Compared to running MCP servers directly​

Running servers directlyGig'MCP
Who holds your API keysEvery server processThe encrypted vault, outside the sandbox
Network accessUnrestrictedManifest-declared egress allowlist, enforced by the proxy
Filesystem accessYour whole machinePrivate mount namespace, no host filesystem
Trust modelTrust every authorKernel sandbox + proxy make trust unnecessary
What runsWhatever the package manager fetchedDigest-pinned OCI image, exactly what was reviewed
Client configRepeated per client, per serverOne gateway endpoint per profile
AuditNonePer-request log of user, server, domain, method

Project status​

note

Gig'MCP is under active development. The egress proxy and credential vault are complete: bearer auth, bubblewrap sandboxing, SQLite storage, the embedded MITM proxy, and the envelope-encrypted vault all ship today, with one bundled echo server. Registry-driven installs, multi-user auth, and the dashboard are landing per the project's design record. The registry catalogs 221 planned manifests, but their image digests are placeholders pending CI builds — placeholder digests are not installable.

Next steps​