Native 2026-07-28, legacy welcome
Stateless core with Mcp-Method/Mcp-Name header routing and zero-copy
streaming. Legacy stateful clients are terminated at the gateway; pre-2026
upstreams fold in through held SDK sessions. Matched eras never translate.
Federation with namespaces
Register any number of upstreams — internal teams or vendors, any
language, any SDK. fold fans out lists, merges and namespaces results
(github__create_pr), synthesizes discovery, and degrades gracefully
when an upstream is down.
Enterprise governance
OAuth 2.0 resource server, Enterprise-Managed Authorization (ID-JAG), RFC 8693 token exchange per upstream, deny-by-default tool allowlists with per-principal visibility, and an audit event for every request — including the denials.
Provably conformant
The official MCP conformance suite runs through fold in CI — 40/40 on Node.js and Cloudflare Workers — plus a latency-budget perf gate and a daily watcher that opens a PR when the spec, SEPs, or SDKs move.