A gateway that aggregates multiple MCP servers into a single federated endpoint, exposing tools, prompts, and resources from all upstream servers through one Streamable HTTP MCP interface.
mcpgateway exposes a single meta-tool (search_tools) that aggregates federated upstream tools. The search_tools tool has a clear verb-noun name and a reasonable description (89 chars). Input schema is present with proper type and description for the 'query' parameter. However, the tool lacks output schema documentation, callers cannot see what structure SearchTools returns. The tool is READ_ONLY (appropriate risk classification). No parameter constraints (enums, min/max) are defined. Error handling in searchHandler is minimal: parse errors are wrapped but not actionable to an LLM. The gateway itself is well-architected (audit logging, hot-reload, federation), but the exposed tool definition is incomplete by production standards.
Search federated tools by name or description. Returns matching tool names — call them directly.
Output schema not documented. searchHandler returns JSON-marshaled matches but callers cannot see the structure (fields, types, pagination). LLMs cannot plan downstream tool calls without knowing what fields to extract.
No input constraints. 'query' parameter accepts any string with no length limit, pattern, or guidance. LLMs may pass empty strings or extremely long queries, wasting tokens or hitting limits.
Error messages lack recovery guidance. searchHandler returns 'parse query: <err>' and 'encode results: <err>', raw errors that do not tell the LLM what to do next or how to self-correct.
No pagination or result limit guidance in description. searchToolsLimit=50 is enforced server-side but not documented in the tool description. LLMs cannot know results are capped and may expect more items.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Description does not explain what 'matching tool names' means. Does it match by name prefix, substring, fuzzy match, or description text? The description says 'call them directly' but does not clarify the matching algorithm or what fields are searched.