EQTY Lab MCP Guardian MCP Server Management GUI

Overview

EQTY Lab’s Guardian MCP Server Management GUI is a lightweight management layer and web interface designed to sit in front of a Model Context Protocol (MCP) server. Guardian provides a unified way to proxy MCP traffic, centralize configuration, secure access, and surface operational tooling (logs, metrics, tool invocations) so teams can run MCP-backed systems with more control and visibility.

Guardian is useful when you want to add enterprise-friendly features to an MCP deployment without changing the underlying model server: authentication and API-key management, rate limiting, runtime configuration of tools and prompts, audit logging, and a small GUI for operators. It is intended for developers and operators who need to manage multiple integrations or environments, test and debug tool invocations, and enforce access policies for MCP endpoints.

Features

• Web-based GUI for managing MCP server access, configuration, and tools
• Reverse-proxying of MCP API requests to one or more backend MCP servers
• API key / token management and simple RBAC controls
• Request/response logging and audit trails for debugging
• Health checks, status dashboard, and basic metrics
• Rate limiting and connection controls to protect backends
• Hot-reloadable configuration for tools, prompts, and routes
• CLI/API for automation and integration with CI/CD
• Docker-compose/Kubernetes friendly deployment patterns
• Extensible tool integration points (script runners, webhooks, DB connectors)

Installation / Configuration

The project can be run locally for development or deployed via Docker. Below are typical workflows.

Clone repository

git clone https://github.com/eqtylab/mcp-guardian.git
cd mcp-guardian

Run with Docker Compose

1. Create an .env file (example below).
2. Start services:

docker-compose up -d

Example docker-compose.yml (simplified)

version: "3.8"
services:
  guardian:
    image: eqtylab/mcp-guardian:latest
    env_file: .env
    ports:
      - "8080:8080"
    volumes:
      - ./config:/app/config

Example .env

GUARDIAN_PORT=8080
MCP_BACKEND_URL=https://mcp-backend.internal:443
AUTH_METHOD=apikey          # supported modes: none, apikey, oauth
ADMIN_TOKEN=changeme123
RATE_LIMIT=1000             # requests per minute

Local development (node-based frontend/backend)

# install deps (if applicable)
npm install

# run backend server (example)
npm run dev:server

# run frontend
npm run dev:ui

Configuration files

• config/routes.yml — route definitions and proxy rules
• config/tools.yml — tool definitions, commands, and invocation metadata
• config/policies.yml — RBAC and rate-limit configs

Guardian watches the config directory and will apply changes without restarting (hot-reload), making it easy to iterate on routes and tools.

Important environment variables

Available Resources

• GitHub repository: https://github.com/eqtylab/mcp-guardian
• Configuration directory (local): ./config — place routes, tools, and policy files here
• Management API endpoints (examples)
  • POST /api/token — create API tokens
  • GET /api/metrics — fetch runtime metrics
  • GET /api/logs — tail recent proxy logs
  • POST /api/tools/:id/execute — invoke a configured tool
• Web UI routes
  • /admin — dashboard and configuration editor
  • /tokens — manage API keys and tokens
  • /tools — list and run tools
  • /proxy/* — proxied MCP endpoints

Use Cases

1. Secure a shared MCP deployment

   • Place Guardian in front of MCP server(s) and require API keys for access. Define tokens for apps and teams, revoke keys centrally, and audit requests to meet compliance requirements.

2. Centralize tool and prompt configuration

   • Define reusable tools (e.g., web search, knowledge-base lookups, DB queries) and expose them to MCP prompts. Operators can update tool definitions in a YAML file and have Guardian reload changes without downtime.

3. Protect backend capacity with rate limiting

   • Enforce per-token or per-route rate limits to prevent noisy clients from overwhelming an expensive model backend.

4. Debug tool invocations and responses

   • Use Guardian’s request/response logs and the GUI “replay” feature to reproduce and troubleshoot problematic interactions between an MCP client and tools.

5. Multi-environment proxying

   • Use route rules to proxy requests to different MCP backends depending on headers or path (e.g., staging vs. production) to simplify local testing and gradual rollouts.

Getting Started Tips

• Start with a single backend MCP server and enable an admin token for the GUI. Add tokens for client apps and verify proxying works before enabling rate limits.
• Keep tools and policies in source control (e.g., config/ directory) and mount them into the container for reproducible deployments.
• Use the metrics and logs endpoints to integrate with Prometheus/Grafana or external log aggregators for long-term observability.

For full API reference, configuration schema, and advanced deployment examples (Kubernetes manifests, Helm charts), see the project README and docs in the repository: https://github.com/eqtylab/mcp-guardian.