C
MCP Contextforge Gateway
mcp-contextforge-gateway
A production-grade MCP Gateway & Proxy built with FastAPI. Supports multi-server registration, virtual server composition, authentication, retry logic, observability, protocol translation, and a unified federated tool catalog.
No known CVEs
No license
Maintenance unknown
No commit data
Works with most clients
Transport: stdio, http
0 tools
Grade F
MCP Contextforge Gateway is an MCP server that a production-grade MCP Gateway & Proxy built with FastAPI. Supports multi-server registration, virtual server composition, authentication, retry logic, observability, protocol translation, and a unified federated tool catalog. Its tool list has not been published yet over stdio and http, requires no API key, and scores 31/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients - only the file and path differ.
CD
Supported in Claude Desktopstdio, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"mcp-contextforge-gateway": {
"command": "uvx",
"args": [
"mcp-contextforge-gateway"
]
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/mcp-contextforge-gateway)
Read me
What Mcp Contextforge Gateway does
A production-grade MCP Gateway & Proxy built with FastAPI. Supports multi-server registration, virtual server composition, authentication, retry logic, observability, protocol translation, and a unified federated tool catalog.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
uvx 'mcp-contextforge-gateway' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories - click any category to see the underlying evidence.
Score breakdown
31/100across 5 weighted dimensions
0255075100
20
10
−69
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev3 fixed
CVE-2026-53710critical · fixedCVSS 10
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
**Commit:** `f855e54d5b7bc1c91b977574a03b91eff6b86bb6` **Component:** `mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py` ## Vulnerability RestrictedPython's sandbox in ContextForge's `python_sandbox_server` sub-project allows arbitrary Python execution via three compounding weaknesses: 1. Raw `getattr` is exposed in `safe_builtins`, bypassing `_getattr_` mediation. 2. `validate_code` checks for literal dangerous dunder strings, but the payload constructs th
GHSA-vwf3-4xxj-qg6hhigh · fixed
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
### Summary `mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's plain `Environment()` rather than `SandboxedEnvironment`. An authenticated user with permission to register or update prompt templates can store a malicious template that, on subsequent rendering, executes arbitrary Python code on the gateway host with the privileges of the gateway process. This is a Server-Side Template Injection (SSTI) vulnerability leading to Remote Code Execu
CVE-2026-53708medium · fixedCVSS 6.6
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
## Summary The `/admin/gateways/test` endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable via DNS rebinding. The source code explicitly acknowledges this limitation in two separate locations. ## Details `validate_gateway_test_url()` in `mcpgateway/common/validators.py` (lines 1527–17
Help improve this page
This server is missing a description. Tools and install config are also missing. If you've used it, help the community.
Add informationCommunity
Reviews
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is Mcp Contextforge Gateway safe to use?
- Mcp Contextforge Gateway has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment.
- How do I install Mcp Contextforge Gateway?
- Install Mcp Contextforge Gateway via pip: `pip install mcp-contextforge-gateway`. Then configure it in your MCP client.
- What AI clients work with Mcp Contextforge Gateway?
- Mcp Contextforge Gateway is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Related
Similar servers
Others in developer-tools / devops
XcodeBuildMCP97XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
6.5k 2
X
XcodeBuildMCP97XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
6.5k 1
G
Mcp Gitlab96MCP server for using the GitLab API
2.0k 12
Supabase MCP Server96Manage Supabase projects — databases, auth, storage, and edge functions
2.9k 4
MCP Security Weekly
Get CVE alerts and security updates for Mcp Contextforge Gateway and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.