MCP Gateway (MCPG)

MCP Gateway (MCPG)

The MCP Gateway (gh-aw-mcpg) is the upstream MCP routing layer that connects agents to their configured MCP servers.

Architecture

Host
┌───────────────────────────────────────────────┐
│ MCPG Gateway (awmg-mcpg, Docker bridge)      │
│  ├─ SafeOutputs stdio child (`ado-aw mcp`)   │
│  └─ Configured custom MCP backends           │
└────────────────────────┬──────────────────────┘
                         │ awmg-mcpg:8080
┌────────────────────────┴──────────────────────┐
│ AWF container (awf-net)                      │
│  Copilot agent ── HTTP ── MCPG               │
└───────────────────────────────────────────────┘

SafeOutputs has no network listener. MCPG spawns it as a hardened stdio child container with no network access and routes the agent’s MCP calls to it.

How It Works

1. Generate MCPG configuration

   The compiler defines SafeOutputs as a stdio backend and adds any custom stdio or HTTP backends configured in the workflow.

2. Start MCPG

   MCPG starts as the named awmg-mcpg container on Docker’s bridge network. It receives the generated configuration on stdin and can use the mounted Docker socket to create stdio child containers.

3. Attach the agent

   AWF runs the agent with strict network isolation and attaches the trusted MCPG container to awf-net. The agent reaches MCPG at http://awmg-mcpg:8080/mcp; it has no route to the host.

4. Route tools

   MCPG routes SafeOutputs calls to the ado-aw mcp stdio child and custom tool calls to their configured backends.

5. Clean up

   The pipeline stops MCPG and its stdio children after the agent completes.

SafeOutputs Configuration

The generated MCPG configuration models SafeOutputs as a containerized stdio server:

{
  "mcpServers": {
    "safeoutputs": {
      "type": "stdio",
      "container": "<pinned-agent-image>",
      "entrypoint": "/usr/local/bin/ado-aw",
      "entrypointArgs": [
        "mcp",
        "/safeoutputs",
        "/workspace"
      ],
      "mounts": [
        "/tmp/awf-tools/ado-aw:/usr/local/bin/ado-aw:ro",
        "/workspace:/workspace:rw",
        "/tmp/awf-tools/staging:/safeoutputs:rw"
      ],
      "args": [
        "--network", "none",
        "--cap-drop", "ALL",
        "--security-opt", "no-new-privileges",
        "--read-only"
      ],
      "env": {
        "HOME": "/tmp"
      }
    }
  },
  "gateway": {
    "port": 8080,
    "domain": "awmg-mcpg",
    "apiKey": "${MCP_GATEWAY_API_KEY}"
  }
}

The exact paths, mounts, user IDs, enabled tool arguments, image, and hardening options are generated from the workflow and runner environment. See the detailed MCPG reference in the repository.

Pipeline Integration

The compiler writes the configuration to $(Agent.TempDirectory)/staging/mcpg-config.json, starts MCPG before the agent, and tears it down afterward. The SafeOutputs child runs as non-root, with a read-only root filesystem, --network none, and only the required worktree and staging mounts.