Module proxy 

/mcp/{server} — the governed MCP reverse proxy (GL#100).

MCP Streamable HTTP has one endpoint per server: the client POSTs JSON-RPC frames (response arrives as application/json or as an SSE stream), GETs an optional server-push listen stream, and DELETEs its session. The gateway fronts each registered upstream under /mcp/{id}:

• Auth: the proxy’s Bearer guard runs first — org token or per-person gateway key, exactly like the LLM channel. /mcp/* is deliberately not a provider route, so the loopback provider-key fallback never applies.
• Credential isolation: the caller’s Authorization (their gateway key) is always stripped; when the registry entry names an auth_env, the gateway injects Authorization: Bearer <env value> upstream. Tool credentials live in the gateway environment, never on laptops.
• Observe, don’t touch: request and response bytes pass through verbatim (SSE responses are teed, never buffered-and-replayed). Only POST exchanges are metered — tools/call is the billable unit; the GET listen stream carries server-initiated traffic, not tool calls.
• Fail-open: analysis/metering failures log and pass traffic through.

Registry changes (config.toml edits) take effect on gateway restart, the same lifecycle as gateway-keys.toml (documented; live reload is an M4 concern once enforcement makes it safety-relevant).

Functions

handler

The single entry point for every /mcp/{server} request. Mounted on the main proxy router (feature-gated in proxy::start_proxy), so it shares ProxyState — the upstream client and the registry snapshot.