MetaMCP — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track routing, proxy, and configuration behavior as MCP server fleets grow

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Aggregating multiple MCP servers behind managed namespaces, endpoints and gateway controls.

What we know

MetaMCP aggregates multiple MCP servers behind configurable namespaces and endpoints and supports inspection, tool enable/disable controls and endpoint authentication.

Maintenance / activity evidence

Observed Jun 22, 2026 (UTC)Update README.md

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Can start, aggregate and expose configured MCP servers and their tools. Writes: Administrative configuration; Upstream tools may write.
API-key/OAuth available for exposed endpoints.
Sensitive access: Gateway secrets, Upstream MCP credentials, Tool payloads

The gateway centralizes credentials and tool authority; secure endpoint auth and least-privilege upstream configuration are essential.
Environment references can keep secret values out of committed configuration.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

2,694 repository stars

Stars observed Oct 6, 2026.

All limitations / Review context

Does MetaMCP still preserve the documented routing and gateway model?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The gateway centralizes credentials and tool authority; secure endpoint auth and least-privilege upstream configuration are essential.
Environment references can keep secret values out of committed configuration.
Can start, aggregate and expose configured MCP servers and their tools.
API-key/OAuth available for exposed endpoints.
Upstream MCP requests/responses and secret references pass through the gateway.
Reviewed write actions: Administrative configuration; Upstream tools may write
Sensitive access: Gateway secrets, Upstream MCP credentials, Tool payloads
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Comparable package-download metric
Gateway security depends heavily on deployment configuration.
Some advertised middleware/tool-selection capabilities remain evolving.

Original activity observations

2026-06-22T16:50:48Z: Update README.md

Technical identity

github.com/metatool-ai/metamcp

Exact implementation source: https://github.com/metatool-ai/metamcp ↗
Reviewed resource type: Gateway
Repository identity: metatool-ai/metamcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
metatool-ai/metamcp
Recorded repository material and project history.
Evidence source ↗
docs.metamcp.com/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Self-hosted gateway service setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Do not publish default gateway with weak auth or empty APP_URL.
Different transport/headers must be configured for real deployments.
Configure secrets, database volumes and APP_URL first; startup changes local Docker state. Review environment effects, installation permissions, and publisher scripts before running. Source-backed ordered steps assembled from publisher README; not claimed to be one verbatim block.
Publisher-documented mcp-proxy; endpoint and token must be created in the running MetaMCP. Do not substitute mcp-remote. Publisher-supported parameters assembled into a machine-readable JSON example; placeholders are user-specific and no real credentials are included. Treat as reviewed composed example rather than a verbatim executable test. Replace the supplied credential/path placeholders privately; use the named host's configuration schema.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.

Install / connect
Publisher instructions
MetaMCP is a self-hosted aggregator/gateway requiring deployment and a named exposed endpoint.
package install · Publisher instructions · Review before use
```
git clone https://github.com/metatool-ai/metamcp.git
cd metamcp
cp example.env .env
docker compose up -d
```
Configure / authenticate
MCP100 setup guide
MetaMCP is a self-hosted gateway with Docker Compose, config secrets, upstream-server registry and OAuth/API-key auth modes; reference environment variables, do not copy credentials into public snippets.
Advanced configuration · claude desktop json · MCP100 composed guide
claude desktop json · MCP100 composed guide
{ "mcpServers": { "MetaMCP": { "args": [ "mcp-proxy", "--transport", "streamablehttp", "http://localhost:12008/metamcp/<YOUR_ENDPOINT_NAME>/mcp" ], "command": "uvx", "env": { "API_ACCESS_TOKEN": "<YOUR_API_KEY_HERE>" } } } }
Check connection
Suggested check
Check local health and endpoint tool discovery with a newly provisioned least-privileged account.
Remove / uninstall / revoke
MCP100 setup guide
In the MetaMCP deployment directory only, after unregistering the gateway MCP entry from host. Keep volumes and database; this does not remove registered downstream servers.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
docker compose down

Official Documentation & Sources

What it does

MetaMCP aggregates multiple MCP servers behind configurable namespaces and endpoints and supports inspection, tool enable/disable controls and endpoint authentication.

Capability: Developer Tools
Resource type: Gateway
Industry: Software & Technology
Best fit: Aggregating multiple MCP servers behind managed namespaces, endpoints and gateway controls.

Representative uses

Group multiple MCP servers
Expose unified remote endpoints
Enable/disable tools
Inspect saved MCP server configurations

Limitations

Gateway security depends heavily on deployment configuration.
Some advertised middleware/tool-selection capabilities remain evolving.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: API-key/OAuth available for exposed endpoints.
Permissions: Can start, aggregate and expose configured MCP servers and their tools.
Data handling: Upstream MCP requests/responses and secret references pass through the gateway.
Cost: free
Risk and cautions: The gateway centralizes credentials and tool authority; secure endpoint auth and least-privilege upstream configuration are essential.

Access scope and cautions

Write actions: Administrative configuration Upstream tools may write
Sensitive access: Gateway secrets Upstream MCP credentials Tool payloads
Risk level: high
Security notes: Environment references can keep secret values out of committed configuration.

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Group multiple MCP servers; Expose unified remote endpoints; Enable/disable tools; Inspect saved MCP server configurations.

What authentication is documented?

API-key and OAuth endpoint authentication are documented.

Can it modify data or perform write operations?

Documented write actions include: Administrative configuration; Upstream tools may write. Recorded permission boundary: Can start, aggregate and expose configured MCP servers and their tools.

What data-handling boundary should I consider?

Upstream MCP requests/responses and secret references pass through the gateway. Recorded sensitive-access context: Gateway secrets; Upstream MCP credentials; Tool payloads.

What limitations and risks should I check before use?

The gateway centralizes credentials and tool authority; secure endpoint auth and least-privilege upstream configuration are essential. Gateway security depends heavily on deployment configuration. Some advertised middleware/tool-selection capabilities remain evolving. Environment references can keep secret values out of committed configuration. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

MetaTool AI is listed as First-party MCP in MCP100’s current evidence.