Peta Core

A control-plane runtime for MCP (Model Context Protocol). Gateway, vault, policy engine, and audit trail for every tool call between AI agents and downstream MCP servers.

Supports the core infrastructure components required to run MCP in production: gateway routing, runtime supervision, policy enforcement, credential management, and audit logging.

Key guarantees:

• Credential vault. Secrets stay encrypted at rest (PBKDF2 + AES-GCM) and are injected server-side at execution time. Clients never see raw credentials.
• Policy engine. RBAC/ABAC with per-user, per-tool capability filtering. Optional human-in-the-loop approval for high-risk operations.
• Audit trail. Every tool call is logged with caller identity, policy decision, and outcome. Secrets are never included in logs.
• Managed runtime. Supervises downstream MCP servers with lifecycle controls and automated recovery.
• Protocol compatibility. Standard MCP upstream, plus downstream compatibility for the shared gateway flows that Peta Core currently supports. Standard server-initiated reverse requests (sampling, roots, elicitation) are intentionally not exposed in the current shared runtime.
• Self-hosted. On-premises deployment model. No hosted SaaS dependency.

Quick Start | Website | Documentation

Architecture

Peta Core sits between MCP clients (Claude, ChatGPT, Cursor, n8n, or any MCP-compatible client) and downstream MCP servers. From the client's perspective, it connects to a single MCP server. Behind that endpoint, Peta Core routes to multiple downstream servers using standard MCP for the shared forward-request flows it supports.

Peta Core is one component of the Peta MCP stack:

• Peta Core (this repository) — MCP gateway, credential vault, policy engine, and audit runtime.
• Peta Console — Admin UI for users, servers, policies, approvals, and audit logs.
• Peta Desk — Desktop client for approval workflows and per-user server configuration.

This repository contains only Peta Core. See docs.peta.io for the full stack.

Features

MCP Gateway

• Transparent MCP proxying. Acts as an MCP server upstream and an MCP client downstream. Routes tool calls via namespaced identifiers (serverId::toolName).
• Built-in OAuth 2.0 authorization server. Authorization Code with PKCE, refresh tokens, dynamic client registration, token introspection, and revocation.
• Anonymous public access mode. Optionally allow token-less access for selected public servers through /mcp/public, while authenticated traffic continues on the standard /mcp endpoint, with configurable anonymous rate limits.

Runtime & Extensions

• Downstream server runtime. Lazy start on first request, health checks, idle timeouts, and capability caching.
• Custom MCP tools (HTTPS or stdio). HTTPS-based custom tools remain supported, with stdio transport added for process-based tools.
• Docker-safe CustomStdio execution. In Docker deployments, non-docker stdio commands are transparently executed inside petaio/mcp-runner:latest; explicit docker commands keep their original behavior.
• REST API adapter. Register HTTP endpoints as MCP servers. Peta Core translates tool calls to HTTP requests without writing a custom MCP server.
• Skill packages. Upload per-server ZIP bundles with SKILL.md metadata. Served as namespaced MCP tools, isolated by server ID.

Credential Vault

• Server-side credential injection. Credentials are decrypted and injected at execution time. They never appear in client configs or prompts.
• Enc

... View full README on GitHub