ContextForge MCP Gateway

Before starting the gateway, generate a cryptographically secure secret. This is required for JWT token signing and must be at least 32 characters.

openssl rand -hex 32

Run the gateway container with the required security environment variables. Replace the placeholders with real credentials. The admin UI will be available at port 4444.

docker run -d --name mcpgateway -p 4444:4444 \
  -e MCPGATEWAY_UI_ENABLED=true \
  -e JWT_SECRET_KEY=your-32-plus-char-secret-here \
  -e [email protected] \
  -e PLATFORM_ADMIN_PASSWORD=changeme \
  ghcr.io/ibm/mcp-context-forge:1.0.0-RC-3

Create a JWT token using the provided utility. This token is used to authenticate MCP client requests to the gateway. The --exp flag sets the expiry in minutes (10080 = 7 days).

python3 -m mcpgateway.utils.create_jwt_token \
  --username [email protected] \
  --exp 10080 \
  --secret your-32-plus-char-secret-here

Use the REST admin API (or the admin UI at http://localhost:4444) to register your backend services. For an MCP server, POST to /gateways with its SSE URL. For REST APIs, provide the OpenAPI spec URL for automatic schema extraction.

curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"my_server","url":"http://localhost:8003/sse"}' \
  http://localhost:4444/gateways

Point your MCP client at the unified gateway endpoint. Each registered server gets a UUID-based MCP path. Use the Swagger UI at /docs to discover endpoint UUIDs, or list them via the admin API.

{
  "mcpServers": {
    "contextforge-gateway": {
      "command": "npx",
      "args": ["mcp-remote", "http://localhost:4444/mcp"],
      "env": {
        "BEARER_TOKEN": "your-jwt-token-here"
      }
    }
  }
}

List available tools through the admin API to confirm registered backend services are exposed. You can also use MCP Inspector with Streamable HTTP transport pointed at the gateway URL.

curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:4444/tools | jq