# Mcp X

> A single-file multi-client MCP gateway with per-tool access control.

- **Type:** MCP server
- **Install:** `agentstack add mcp-camelop-mcp-x`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [camelop](https://agentstack.voostack.com/s/camelop)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [camelop](https://github.com/camelop)
- **Source:** https://github.com/camelop/mcp-x
- **Website:** https://mcp-x.org

## Install

```sh
agentstack add mcp-camelop-mcp-x
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP-X

MCP-X is a **single-file** **multi-client** MCP gateway with per-tool access control. The entire implementation lives in `mcp_x.py`.

Each client authenticates with a Bearer token and can bring a list of their own MCP servers, then share specific tools from those servers with other clients. Clients talk MCP at `/mcp`; the middleware filters which tools each client can see/call based on `config.toml` policies. Server owners always have full access to their own tools.

```
                        MCP-X (:9000)
                     ┌─────────────────┐
 ┌───────┐  auth     │  FastAPI REST   │
 │ alice ├──token──> │  /register_*    │
 └───┬───┘           │  /update_*      │
     │               │  /get_*         │
     │  MCP          ├─────────────────┤          ┌──────────┐
     └──protocol──>  │   FastMCP       │──proxy──>│ server_a │   │  │ middleware │ │──proxy──>│ server_b │  static auth token
[clients.alice]
auth_token = "123"

[clients.bob]
auth_token = "456"

# 2. MCP servers: name -> upstream URL + which client registered it
[mcp_servers.server_a]
url = "http://localhost:9001"
from_client = "alice"          # alice owns server_a

[mcp_servers.server_b]
url = "http://localhost:9002"
from_client = "bob"

# 3. Access control: server_name -> { client -> [tool_patterns] }
#    Patterns use fnmatch syntax: * ? [seq] [!seq]
[allow.server_a]
bob = ["*"]                            # bob can use all tools on server_a
charlie = ["tool_0", "tool_1*", "*_2"] # charlie gets specific tools

[allow.server_b]
alice = ["b-*a*"]                      # alice gets matching tools on server_b
```

Server owners (the `from_client` field) always have full access to their own server's tools -- no `[allow]` entry needed.

**Note on duplicate tool names:** If a client has access to multiple servers that expose a tool with the same name, only one will be used (from whichever server is matched first). Tools from owned servers are always checked before shared ones.

### Live Reload

`config.toml` is checked for changes on every request (throttled to once per second). Edit it while the server is running and changes take effect immediately -- no restart needed.

The file is also written to by the server when clients register via the REST API (`POST /register_client`, `/register_mcp_server`, `/update_access_control`). Manually-configured client tokens in the file are preserved across these writes.

## REST API

All endpoints (except `/register_client`) require a `Bearer` token in the `Authorization` header.

| Method | Endpoint | Description |
|--------|----------|-------------|
| `POST` | `/register_client` | Create a new client. Returns a `client_id` and a JWT `auth_token` (1h expiry). |
| `POST` | `/register_mcp_server` | Register an upstream MCP server URL. The calling client becomes the owner. |
| `POST` | `/update_access_control` | Grant or revoke another client's access to tools on your servers. Accepts `client_id` and `server_access: {server_name: [tool_patterns]}`. |
| `GET`  | `/get_access_control` | View current access policies for all servers you own. |

The MCP endpoint is at `/mcp` (stateless HTTP). Clients use standard MCP protocol to list and call tools.

## How It Works

- **Server name hashing** -- server names are stored internally as SHA-256 hashes. This avoids collisions when FastMCP concatenates server and tool names with underscores (e.g. a server named `foo` with tool `bar_baz` vs server `foo_bar` with tool `baz`).

- **Tool name rewriting** -- the middleware strips the internal server-hash prefix before returning tools to clients, so clients see clean tool names. On `call_tool`, the middleware re-adds the correct prefix and tries each allowed server until one succeeds.

- **JWT** -- `POST /register_client` issues a JWT (1h expiry). The signing secret is auto-generated and saved to `jwt_secret` on first run.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [camelop](https://github.com/camelop)
- **Source:** [camelop/mcp-x](https://github.com/camelop/mcp-x)
- **License:** Apache-2.0
- **Homepage:** https://mcp-x.org

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-camelop-mcp-x
- Seller: https://agentstack.voostack.com/s/camelop
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.