fold is the one. fold.run is the execution.

The enterprise
MCP gateway.

One governed endpoint between every MCP client and every MCP server. Federation, auth, policy, caching, and audit — built on the official MCP Go SDK on both sides of the proxy.

Get started Try the live demo View source

# every team's servers, one governed endpoint
{
  "upstreams": [
    { "id": "github-tools", "url": "…", "namespace": "gh" },
    { "id": "ml-search",    "url": "…", "namespace": "search",
      "rateLimit": { "requestsPerMinute": 600 },
      "circuitBreaker": { "failureThreshold": 5 } }
  ],
  "auth":   { "mode": "required", "…": "…" },
  "policy": { "defaultDecision": "deny", "…": "…" }
}

40/40official MCP conformance checks, run through the gateway on every merge

~0.2 mstypical added p50 latency; CI gates every merge at < 5 ms

1 binarystatic Go binary or ~22 MB distroless container, no local state

Apache-2.0open source, on GitHub

See it live.

demo.fold.run federates three public MCP servers behind one endpoint — the unmodified release binary, governed by its own config. Point any MCP client at it. Rate-limited, unauthenticated, no warranty; live status on /status. Copy-paste walkthrough: try the demo.

# three public MCP servers, one governed endpoint — no signup, no key
https://demo.fold.run/mcp
tools/list           → cfdocs__* · git__* · jobs__*
jobs__start_job      → mints a task on the jobs server
tasks/get            → routed to the owner — carrying nothing but the id
/console             → the federation, live (read-only)

`cfdocs__*`

Cloudflare's public docs MCP server — a real third-party upstream, governed and namespaced like any internal one.

`git__*`

GitMCP — a public 2025-era server on the session handshake. Behind the gateway it is just another namespace.

`jobs__*`

A task-minting demo server. Start a job, then poll it with nothing but the task id — fold routes every poll to the owner.

Run it in 60 seconds.

fold is a single static binary with no local state. One config file in front of your first server, governance when you're ready.

# one upstream, one governed endpoint — 60 seconds
$ go run github.com/fold-run/fold/cmd/fold@latest --config fold.config.json
# or the container:
$ docker run -p 8080:8080 -e FOLD_CONFIG="$(cat fold.config.json)" ghcr.io/fold-run/fold
# MCP endpoint: http://localhost:8080/mcp · health: /healthz · metrics: /metrics

`binary`

A single static Go binary — go install, or grab a prebuilt archive from GitHub releases. Linux and macOS, amd64 and arm64.

`container`

ghcr.io/fold-run/fold — multi-arch and distroless, ~22 MB. Config injected as a file or straight through FOLD_CONFIG.

`kubernetes`

A Helm chart with probes, HPA, and ServiceMonitor — plus fold-discovery, so labeled Services join the federation on their own.

One gateway. A family of problems.

Most deployments start with one of these and grow into the others — they all ride the same config file.

Unify a federation

Acquisitions, child orgs, and teams each ship their own MCP servers — any language, any SDK. fold presents them as one virtual server with namespaced tools. No team rewrites anything.

Draw the security boundary

One choke point for authentication, deny-by-default tool allowlists, per-principal visibility, and an audit event for every request — including the denials.

Discover upstreams automatically

A team ships an MCP server, the registry lists it, and it appears behind the gateway — no config change. On Kubernetes, label a Service fold.run/upstream: "true" and fold-discovery does the rest.

Run tasks across the federation

Long-running work flows through fold: task polls and updates route to the server that owns the task — remembered at mint, or found by probe — and tasks/list merges every org, scoped per principal.

Broker credentials

Clients hold one token with fold as audience; fold exchanges it per upstream (RFC 8693) or injects service credentials. API keys never reach agents.

Protect fragile services

List caching, global and per-upstream rate limits, and circuit breakers stand between agent traffic storms and your internal systems.

Govern vendor MCP servers

Put third-party and SaaS MCP endpoints behind your own auth, policy, and audit — instead of scattering per-user API keys across every client.

Expose tools outward, carefully

Offer partners a curated, policy-scoped subset of internal tools on one hardened endpoint — a single static binary, self-hosted in your VPC.

Conformant, provably

The official MCP conformance suite runs through fold on every merge — 40/40 checks, including sampling, elicitation, and subscriptions bridged through the gateway.

Start where it hurts.

A single passthrough upstream in front of your most-used server is one config file away. Governance grows from there.

Read the docs

The enterpriseMCP gateway.