fold is one gateway with one job — govern the path between MCP clients and MCP servers — and that single position covers a family of problems. Most deployments start with one of these and grow into the others, because they all ride the same config.
Unify a federation
Acquisitions, child orgs, and regional teams each build their own MCP
servers — Python from the ML org, TypeScript from platform, Go from last
year’s acquisition. fold presents them as one virtual server with
namespaced tools (gh__create_pr, search__query), per-upstream
owner: { org, team } metadata, and graceful degradation when one team’s
server is down. No team rewrites anything.
Draw the security boundary
One choke point instead of N: OAuth 2.0 resource server with enterprise IdP integration (EMA/ID-JAG), deny-by-default tool allowlists, list filtering so callers never see tools they can’t call, and an audit event for every request — including the 401s, 403s, and 429s your SOC team actually hunts for.
Insulate protocol eras
The 2026-07-28 spec went stateless; your fleet didn’t, overnight. fold speaks the new protocol natively and translates in both directions — legacy clients are terminated at the gateway, legacy upstreams fold in through held sessions. Every team migrates on its own schedule; clients never notice.
Broker credentials
Agents hold exactly one token, audience-bound to fold. Per upstream, fold exchanges it (RFC 8693) for an upstream-audience token preserving user identity, or injects service credentials. Upstream API keys live in the gateway’s secret store and never reach a model’s context window.
Protect fragile services
Agent traffic is bursty and retry-happy. SEP-2549 response caching, global and per-upstream rate limits with Retry-After, and per-upstream circuit breakers stand between an agent storm and the twenty-year-old ERP that must not fall over.
Govern vendor MCP servers
Third-party and SaaS MCP endpoints go behind your auth, your allowlists, and your audit trail — instead of every employee pasting a personal API key into every client. Swap a vendor without touching a single client configuration.
Expose tools outward, carefully
Give partners or customers a curated, policy-scoped subset of internal tools on one hardened endpoint — DNS-rebinding protection, host allowlists, and Bearer-guarded health surfaces included. Deploy self-hosted in your VPC or at the edge on Cloudflare Workers.
Stay current automatically
A daily watcher diffs the MCP spec repo, SEP index, and SDK registries against fold’s alignment manifest and opens a human-reviewed PR when the ecosystem moves. The official conformance suite gates every merge on both runtimes.
Every use case above is the same binary and the same config file — an
upstreams list plus optional auth, policy, and audit blocks. Begin
with a single passthrough upstream in front of your most-used server, then
add governance as the surface grows.