MCP-native · TypeScript-first · Deploy anywhere

One secure endpoint for every MCP server.

📘 Docs · 💬 Discord · 🌐 decocms.com/mesh

TL;DR:

• Route all MCP traffic through a single governed endpoint
• Enforce RBAC, policies, and audit trails at the control plane
• Full observability with OpenTelemetry — traces, costs, errors
• Runtime strategies as gateways for optimal tool selection
• Self-host with Docker, Bun/Node, Kubernetes, or run locally

MCP Mesh is an open-source control plane for MCP traffic. It sits between your MCP clients (Cursor, Claude, Windsurf, VS Code, custom agents) and your MCP servers, providing a unified layer for auth, routing and observability.

It replaces M×N integrations (M MCP servers × N clients) with one production endpoint, so you stop maintaining separate configs in every client. Built for multi-tenant orgs: workspace/project scoping for policies, credentials, and logs.

┌─────────────────────────────────────────────────────────────────┐
│                         MCP Clients                             │
│         Cursor · Claude · VS Code · Custom Agents               │
└───────────────────────────┬─────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────────┐
│                         MCP MESH                                │
│       Gateway · Policy Engine · Observability · Token Vault     │
└───────────────────────────┬─────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────────┐
│                       MCP Servers                               │
│      Salesforce · Slack · GitHub · Postgres · Your APIs         │
└─────────────────────────────────────────────────────────────────┘

# Clone and install
git clone https://github.com/decocms/mesh.git
bun install

# Run locally (client + API server)
bun run dev

→ runs at http://localhost:3000 (client) + API server

Or use npx @decocms/mesh to instantly get a mesh running.

As tool surfaces grow, “send every tool definition to the model on every call” gets expensive and slow. The mesh models runtime strategies as gateways: one endpoint, different ways of exposing tools.

Examples:

• Full-context: expose everything (simple and deterministic for small toolsets)
• Smart selection: narrow the toolset before execution
• Code execution: load tools on demand and run code in a sandbox

Gateways are configurable and extensible. You can add new strategies and also curate toolsets (see Virtual MCPs).

Tools are first-class citizens. Type-safe, audited, observable, and callable via MCP.

import { z } from "zod";
import { defineTool } from "~/core/define-tool";

export const CONNECTION_CREATE = defineTool({
  name: "CONNECTION_CREATE",
  description: "Create a new MCP connection",
  inputSchema: z.object({
    name: z.string(),
    connection: z.object({
      type: z.enum(["HTTP", "SSE", "WebSocket"]),
      url: z.string().url(),
      token: z.string().optional(),
    }),
  }),
  outputSchema: z.object({
    id: z.string(),
    scope: z.enum(["workspace", "project"]),
  }),
  handler: async (input, ctx) => {
    await ctx.access.check();
    const conn = await ctx.storage.connections.create({
      projectId: ctx.project?.id ?? null,
      ...input,
      createdById: ctx.auth.user!.id,
    });
    return { id: conn.id, scope: conn.projectId ? "project" : "workspace" };
  },
});

Every tool call automatically gets: input/output validation, access control checks, audit logging, and OpenTelemetry traces.

├── apps/
│   ├── mesh/                # Full-stack MCP Mesh (Hono API + Vite/React)
│   │   ├── src/
│   │   │   ├── api/         # Hono HTTP + MCP proxy routes
│   │   │   ├── auth/        # Better Auth (OAuth + API keys)
│   │   │   ├── core/        # MeshContext, AccessControl, defineTool
│   │   │   ├── tools/       # Built-in MCP management tools
│   │   │   ├── storage/     # Kysely DB adapters
│   │   │   ├── event-bus/   # Pub/sub event delivery system
│   │   │   ├── encryption/  # Token vault & credential management
│   │   │   ├── observability/  # OpenTelemetry tracing & metrics
│   │   │   └── web/         # React 19 admin UI
│   │   └── migrations/      # Kysely database migrations
│   └── docs/                # Astro documentation site
│
└── packages/
    ├── bindings/            # Core MCP bindings and connection abstractions
    ├── runtime/             # MCP proxy, OAuth, and runtime utilities
    ├── ui/                  # Shared React components (shadcn-based)
    ├── cli/                 # CLI tooling (deco commands)
    ├── create-deco/         # Project scaffolding (npm create deco)
    └── vite-plugin-deco/    # Vite plugin for Deco projects

# Install dependencies
bun install

# Run dev server (client + API)
bun run dev

# Run tests
bun test

# Type check
bun run check

# Lint
bun run lint

# Format
bun run fmt

bun run dev:client     # Vite dev server (port 4000)
bun run dev:server     # Hono server with hot reload
bun run migrate        # Run database migrations

# Docker Compose (SQLite)
docker compose -f deploy/docker-compose.yml up

# Docker Compose (PostgreSQL)
docker compose -f deploy/docker-compose.postgres.yml up

# Self-host with Bun
bun run build:client && bun run build:server
bun run start

# Kubernetes
kubectl apply -f k8s/

Runs on any infrastructure — Docker, Kubernetes, AWS, GCP, or local Bun/Node runtimes. No vendor lock-in.

• Multi-tenant admin dashboard
• MCP bindings (swap providers without rewrites)
• Version history for mesh configs
• NPM package runtime
• Edge debugger / live tracing
• Cost analytics and spend caps
• MCP Store — discover and install pre-built MCP apps

The MCP Mesh is the infrastructure layer of decoCMS.

The MCP Mesh ships with a Sustainable Use License (SUL). See LICENSE.md.

• ✅ Free to self-host for internal use
• ✅ Free for client projects (agencies, SIs)
• ⚠️ Commercial license required for SaaS or revenue-generating production systems

Questions? [email protected]

We welcome contributions! Run the following before submitting a PR:

bun run fmt      # Format code
bun run lint     # Check linting
bun test         # Run tests

See AGENTS.md for detailed coding guidelines and conventions.