Getting started
A governed endpoint in 60 seconds, from one config file and one binary.
fold
fold is a single Go binary that presents any number of upstream MCP (Model Context Protocol) servers as one governed virtual server: one endpoint, one policy, one audit trail. It is built on the official MCP Go SDK on both sides of the proxy, and the official conformance suite runs through it on every merge.
Before running it against anything that matters:
- Describe your upstreams in one config file, validated at load.
- Put a policy in front of them — fold is deny-by-default, and an empty allowlist denies everything.
Run it locally
The same thing on your own machine, against upstreams you already have.
Federate
Section titled “Federate”ArchitectureThe request pipeline end to end: classify, route, authorize, proxy, audit.
ConfigurationUpstreams, namespaces, policy, tenants and budgets, in one validated file.
Discovery & KubernetesLabelled Services join the federation on their own, with no config edit.
Local stdio serversFederate a process that speaks stdio alongside remote HTTP upstreams.
Govern
Section titled “Govern”Security modelTrust anchors, the inbound auth chain, deny-by-default policy, credential brokering.
TenancyGroup principals into one allowance, one rate-limit bucket, one bounded view.
Budgets & meteringPer-tenant call budgets, charged narrowest-first, refused rather than billed.
Conformance40/40 official MCP checks, run through the gateway on every merge.
Operate
Section titled “Operate”DeploymentStatic binary, ~22 MB distroless container, or a Helm chart with probes and HPA.
OperationsHot reload, Redis-shared state, Prometheus metrics, OpenTelemetry traces, health.
The consoleWatch calls resolve through the gateway, upstream by upstream, in real time.
BenchmarksAdded proxy latency with its caveats attached: < 5 ms p50, ~0.2 ms typical.
Everything else
Section titled “Everything else”Use cases is the shortest route to whether fold fits what you have. Defaults lists every value fold picks for you and why. Embedding in Go is for putting the gateway inside your own binary. The source is on GitHub under Apache-2.0.