Every developer. Every tool.That's a security failure.
MCPAmbassador is a tool multiplexer. Your developers install one client — their unique key determines which tools appear. Not which MCP servers. Which tools. Pulled selectively from any combination of MCP servers, composed into a single, role-specific toolset, delivered on connection.
A junior dev gets read-only database access, issue tracking, and test runners. A DevOps lead gets deployment pipelines, infrastructure provisioning, and production credentials. Same endpoint. Entirely different tool surfaces.
{ "mcpServers": { "ambassador": { "command": "npx", "args": ["-y", "@mcpambassador/client"], "env": { "MCP_AMBASSADOR_PRESHARED_KEY": "amb_pk_your_key" } } }}Every developer reaching the same MCP tools is a governance and security failure. Different roles need different tool surfaces.
Provision exactly what each role needs — pulled from any MCP, controlled by admins, invisible to everyone else.
Every client, a different surface. One endpoint for all of them.
MCPAmbassador 0.8.0-beta.1 ships with a complete enterprise feature set. Apache 2.0. Self-hosted. No feature gates.
MCPAmbassador composes a bespoke, role-specific tool surface from any number of downstream MCP servers and delivers it through a single client connection. Developers connect once — their authorized tools appear. Admins control which specific tools each user or group receives.
Per-user AES-256-GCM encrypted storage with HKDF key derivation. Credentials are decrypted only at spawn time, injected into the MCP process, and zeroed from memory. Developers never see raw API keys.
Group-based access control. Assign users to groups, assign MCPs to groups. Users see only the MCPs their groups authorize. Role inheritance is additive.
Self-service MCP discovery. Users browse, view full tool lists, subscribe, and select exactly which tools to enable — no tickets, no manual admin provisioning.
One user, many devices. Each client (VS Code, Claude Code, CI agent) has independent MCP subscriptions and tool selections. Revoke one without affecting others.
Instantly disable any MCP server — or any individual tool within an MCP — from the admin dashboard. Effect is immediate on next tool call. No client restart required.
Every tool invocation logged: who called what, from which device, with what arguments, and what was returned. JSON structured logs, queryable in the admin portal.
38+ pre-configured MCP server definitions. GitHub, PostgreSQL, Slack, Stripe, Grafana, Notion, and dozens more — spawn commands and env var schemas already defined.
Full React 19 SPA for both admin and user workflows. MCP catalog management, group RBAC, marketplace, client management, and subscriptions. Dark mode, responsive, accessible.
Everything runs in one Docker container. Auto-generated TLS certs, auto-run migrations, auto-generated credential keys on first boot. One command to a running gateway.
The community registry ships spawn commands, environment variable schemas, and tool metadata for every popular MCP server. Admins add them to the catalog in minutes.
Every feature ships free under Apache 2.0. Enterprise capabilities like PostgreSQL, HA, and SSO are on the roadmap — built in partnership with the organizations that need them. Open source, open roadmap.
The full product, self-hosted. No registration required.
For organizations deploying MCP Ambassador under compliance requirements or at a scale that demands PostgreSQL, HA, and SSO. These capabilities are on the roadmap — get in touch to discuss timelines or co-development.
One Docker command. Five minutes to your first curated toolset.
Apache 2.0 · v0.8.0-beta.1 · 327 tests passing · Zero telemetry · Self-hosted