Peta Core

A control-plane runtime for MCP (Model Context Protocol). Gateway, vault, policy engine, and audit trail for every tool call between AI agents and downstream MCP servers.

Supports the core infrastructure components required to run MCP in production: gateway routing, runtime supervision, policy enforcement, credential management, and audit logging.

Key guarantees:

• Credential vault. Secrets stay encrypted at rest (PBKDF2 + AES-GCM) and are injected server-side at execution time. Clients never see raw credentials.
• Policy engine. RBAC/ABAC with per-user, per-tool capability filtering. Optional human-in-the-loop approval for high-risk operations.
• Audit trail. Every tool call is logged with caller identity, policy decision, and outcome. Secrets are never included in logs.
• Managed runtime. Supervises downstream MCP servers with lifecycle controls and automated recovery.
• Protocol compatibility. Standard MCP upstream, plus downstream compatibility for the shared gateway flows that Peta Core currently supports. Standard server-initiated reverse requests (sampling, roots, elicitation) are intentionally not exposed in the current shared runtime.
• Self-hosted. On-premises deployment model. No hosted SaaS dependency.

Quick Start | Website | Documentation

---

Architecture

Peta Core sits between MCP clients (Claude, ChatGPT, Cursor, n8n, or any MCP-compatible client) and downstream MCP servers. From the client's perspective, it connects to a single MCP server. Behind that endpoint, Peta Core routes to multiple downstream servers using standard MCP for the shared forward-request flows it supports.

Peta Core is one component of the Peta MCP stack:

• Peta Core (this repository) — MCP gateway, credential vault, policy engine, and audit runtime.
• Peta Console — Admin UI for users, servers, policies, approvals, and audit logs.
• Peta Desk — Desktop client for approval workflows and per-user server configuration.

This repository contains only Peta Core. See docs.peta.io for the full stack.

---

Features

MCP Gateway

• Transparent MCP proxying. Acts as an MCP server upstream and an MCP client downstream. Routes tool calls via namespaced identifiers (serverId::toolName).
• MCP 2026-07-28 support. Modern clients can use stateless server/discover, POST-only Streamable HTTP, subscriptions/listen, OAuth resource metadata, and per-request protocol metadata behind a rollout flag while legacy sessionful clients remain supported.
• Built-in OAuth 2.0 authorization server. Authorization Code with PKCE, refresh tokens, dynamic client registration, token introspection, and revocation.
• Anonymous public access mode. Optionally allow token-less access for selected public servers through /mcp/public, while authenticated traffic continues on the standard /mcp endpoint, with configurable anonymous rate limits.

Runtime & Extensions