binary
A single static Go binary — go install, or grab a prebuilt archive from GitHub releases. Linux and macOS, amd64 and arm64.
fold is the one. fold.run is the execution.
The enterprise
MCP gateway.
One governed endpoint between every MCP client and every MCP server. Federation, auth, policy, caching, and audit — built on the official MCP Go SDK on both sides of the proxy.
# every team's servers, one governed endpoint
{
"upstreams": [
{ "id": "github-tools", "url": "…", "namespace": "gh" },
{ "id": "ml-search", "url": "…", "namespace": "search",
"rateLimit": { "requestsPerMinute": 600 },
"circuitBreaker": { "failureThreshold": 5 } }
],
"auth": { "mode": "required", "…": "…" },
"policy": { "defaultDecision": "deny", "…": "…" }
}40/40official MCP conformance checks, run through the gateway on every merge
~0.2 mstypical added p50 latency; CI gates every merge at < 5 ms
1 binarystatic Go binary or ~22 MB distroless container, no local state
Apache-2.0open source, on GitHub
Run it in 60 seconds.
fold is a single static binary with no local state. One config file in front of your first server, governance when you're ready.
# one upstream, one governed endpoint — 60 seconds
$ go run github.com/fold-run/fold/cmd/fold@latest --config fold.config.json
# or the container:
$ docker run -p 8080:8080 -e FOLD_CONFIG="$(cat fold.config.json)" ghcr.io/fold-run/fold
# MCP endpoint: http://localhost:8080/mcp · health: /healthz · metrics: /metricscontainer
ghcr.io/fold-run/fold — multi-arch and distroless, ~22 MB. Config injected as a file or straight through FOLD_CONFIG.
kubernetes
A Helm chart with probes, HPA, and ServiceMonitor — plus fold-discovery, so labeled Services join the federation on their own.
One gateway. A family of problems.
Most deployments start with one of these and grow into the others — they all ride the same config file.
Unify a federation
Acquisitions, child orgs, and teams each ship their own MCP servers — any language, any SDK. fold presents them as one virtual server with namespaced tools. No team rewrites anything.
Draw the security boundary
One choke point for authentication, deny-by-default tool allowlists, per-principal visibility, and an audit event for every request — including the denials.
Discover upstreams automatically
A team ships an MCP server, the registry lists it, and it appears behind the gateway — no config change. On Kubernetes, label a Service fold.run/upstream: "true" and fold-discovery does the rest.
Run tasks across the federation
Long-running work flows through fold: task polls and updates route to the server that owns the task — remembered at mint, or found by probe — and tasks/list merges every org, scoped per principal.
Broker credentials
Clients hold one token with fold as audience; fold exchanges it per upstream (RFC 8693) or injects service credentials. API keys never reach agents.
Protect fragile services
List caching, global and per-upstream rate limits, and circuit breakers stand between agent traffic storms and your internal systems.
Govern vendor MCP servers
Put third-party and SaaS MCP endpoints behind your own auth, policy, and audit — instead of scattering per-user API keys across every client.
Expose tools outward, carefully
Offer partners a curated, policy-scoped subset of internal tools on one hardened endpoint — a single static binary, self-hosted in your VPC.
Conformant, provably
The official MCP conformance suite runs through fold on every merge — 40/40 checks, including sampling, elicitation, and subscriptions bridged through the gateway.
Start where it hurts.
A single passthrough upstream in front of your most-used server is one config file away. Governance grows from there.