Back to MCP Trust Indexm8ven
45
/ 100
27 days ago
glama

Cortex Gateway

A federated MCP gateway that consolidates multiple plain-HTTP backends into a single, OAuth-protected MCP server, enabling agents to access diverse tools through one endpoint with centralized authentication and audit.

→ wellknownmcp/cortex-gateway· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 7 credentials: CORTEX_DEV_BYPASS_TOKEN, CORTEX_TECHNICAL_TOKEN, CORTEX_VAULT_KEY, CRON_SECRET, INTROSPECT_CLIENT_SECRET, OAUTH_INTROSPECT_CLIENT_SECRET, RESEND_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAUTH_EMAIL_FROM
configCORTEX_ALLOWED_ORIGINS— prod Web origins allowed (exact or .suffix)
configCORTEX_AUDIT_RETENTION_DAYS
configCORTEX_BACKENDS— + CORTEX_BACKEND_<ID>_URL yes Federated backends
configCORTEX_CANONICAL_URI— prod Canonical MCP resource URI (RFC 9728), default JWT audience
configCORTEX_DATABASE_URL— no PostgreSQL for audit persistence + gateway tickets
configCORTEX_DEV_BYPASS_ROLE
configCORTEX_DEV_BYPASS_SCOPES— mcp:demo:read
🔐 secretCORTEX_DEV_BYPASS_TOKEN— dev-secret
configCORTEX_MCP_SERVERS
configCORTEX_RATE_LIMIT_PER_MINUTE
configCORTEX_REQUIRED_POOL
configCORTEX_SERVER_NAME
🔐 secretCORTEX_TECHNICAL_TOKEN— demo-technical-token
configCORTEX_TICKET_BACKENDS
configCORTEX_TICKET_WEBHOOK_URL— no Webhook for blocking missing-capability tickets
🔐 secretCORTEX_VAULT_KEY
🔐 secretCRON_SECRET
configINTROSPECT_CLIENT_ID
🔐 secretINTROSPECT_CLIENT_SECRET
configOAUTH_AUDIENCE
configOAUTH_INTROSPECT_CACHE_TTL_SECONDS
configOAUTH_INTROSPECT_CLIENT_ID
🔐 secretOAUTH_INTROSPECT_CLIENT_SECRET
configOAUTH_INTROSPECT_URL
configOAUTH_ISSUER— In production you point at your OAuth 2.1 authorization
configOAUTH_JWKS_URL
configOAUTH_KEY_ID
configOAUTH_MCP_AUDIENCE
configRATE_LIMIT_DISABLED
🔐 secretRESEND_API_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/wellknownmcp-cortex-gateway-1vrt6j)](https://m8ven.ai/mcp/wellknownmcp-cortex-gateway-1vrt6j)
commit: 5ca5054ee17a3f2facb7f39fa7d517b4f3012064
code hash: ccd6c51cdc6b1ccce1db22f29d3a0aa127b4851ab53e21670c432f2dcfaedb6a
verified: 7/4/2026, 9:12:09 AM
view raw JSON →