x=hub

your toolset

    build deployment
    sign in

    governed-mcp-gateway

    mcpopen · package
    io.github.icohangar-ops/governed-mcp-gateway · v0.1.0
    deploy just this

    HTTP MCP gateway: principal on tools/call + SSE, allowlists, vault rotate, CHP gates.

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    A package that serves HTTP itself; the port comes from its URL template.
    # once, as root:
# as_mcp DIR COMMAND...: runs COMMAND as the mcp user in DIR, its home, sandboxed as the
# units are: a package's install scripts can write to DIR only, as the server later can
as_mcp() {
  local dir="$1"; shift
  systemd-run --quiet --wait --pipe --collect --uid=mcp --gid=mcp \
    -p WorkingDirectory="$dir" -p Environment=HOME="$dir" -p ReadWritePaths="$dir" \
    -p NoNewPrivileges=true -p ProtectSystem=strict -p ProtectHome=true -p PrivateTmp=true \
    -- "$@" </dev/null
}
install -d -m 0750 -o mcp -g mcp /var/lib/mcp/governed-mcp-gateway
# governed-mcp-gateway: its packages, installed whole before its unit starts (no session installs)
# npx takes a half-installed tree for installed: a rerun starts them afresh
systemctl stop mcp-my-agent-governed-mcp-gateway.service 2>/dev/null || true
as_mcp /var/lib/mcp/governed-mcp-gateway rm -rf /var/lib/mcp/governed-mcp-gateway/.npm/_npx
as_mcp /var/lib/mcp/governed-mcp-gateway npx --yes --package=@cubiczan/[email protected] -- true

#!/usr/bin/env bash
# governed-mcp-gateway (io.github.icohangar-ops/governed-mcp-gateway), recipe baremetal (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-governed-mcp-gateway.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec npx -y @cubiczan/[email protected]

[Unit]
Description=MCP server governed-mcp-gateway (toolset my-agent), generated by Hub
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/governed-mcp-gateway
WorkingDirectory=/var/lib/mcp/governed-mcp-gateway
ExecStart=/opt/mcp/my-agent/bin/governed-mcp-gateway.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/governed-mcp-gateway

[Install]
WantedBy=multi-user.target

    connect to it

    copy what your client needs
    {
  "mcpServers": {
    "governed-mcp-gateway": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add governed-mcp-gateway -- CHANGE_ME

    {
  "mcpServers": {
    "governed-mcp-gateway": {
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    {
  "servers": {
    "governed-mcp-gateway": {
      "type": "stdio",
      "command": "CHANGE_ME",
      "args": []
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.icohangar-ops/governed-mcp-gateway
    • not probed yet: tools unpinned, ingest lists them
    • a package that serves HTTP itself: pick a self-hosted target, not 'local'

    tools

    Probe result: faileddocker: no MCP server found (nothing listens on 7474) is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created) (node:14) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created); baremetal: no MCP server found (nothing listens on 7474) is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to …

    runs · 1

    the latest tests of this entry by the hub and its workers, newest first
    dateworkermethodstatussandboxreason
    2026-10-17 03:56 local-mac-vm docker failed gvisor docker: no MCP server found (nothing listens on 7474) is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the war…