{"slug": "enterprise-mcp-gateway-in-flight-pii-redaction-and-audit-in-go", "title": "Enterprise MCP Gateway: In-Flight PII Redaction and Audit in Go", "summary": "The Enterprise MCP Gateway, an open-source Go project by developer goschan, provides a production-grade Model Context Protocol bridge that redacts PII and secrets in-flight and emits tamper-resistant JSON audit logs, connecting AI agents such as Claude Desktop, Cursor, Antigravity, and LangGraph to enterprise backends. The single static Go binary (<25MB resident memory, sub-millisecond routing overhead) supports stdio and HTTP-SSE transports, dynamic OpenAPI 3.0 tool registration, and role-based tool governance, with features including Luhn-validated credit card masking, SSN/email/phone redaction, and SHA-256 hashed parameter logging.", "body_md": "**Production-grade, high-performance Model Context Protocol (MCP) Gateway in Go.**\n\n*A secure, audited, and PII-sanitized bridge connecting AI agents (Claude Desktop, Cursor, Antigravity, LangGraph) to enterprise backends (OpenAPI, Java/Spring Boot, Go microservices, relational databases).*\n\n[\n](/BenjaminJ/enterprise-mcp-gateway/blob/master/docs/assets/demo.gif)\n\n**Live Demo:** AI Agent querying CRM with in-flight PII & card redaction (left) while the Gateway streams structured JSON audit logs in real-time (right).\n\n**⚡ Blazing Fast & Lightweight:** Single static Go binary (<25MB resident memory footprint, sub-millisecond routing overhead, zero external runtime dependencies).**🛡️ High-Performance PII & Secret Redaction:** Real-time stream and JSON-key masking (Credit Cards with Luhn checksum validation, SSNs, emails, phone numbers, AWS keys, JWTs, GitHub PATs, and custom regex rules) before tool responses reach LLMs.**🔐 Role-Based Tool Governance (RBAC):** Token-to-role resolution that limits tool visibility in`tools/list`\n\nand enforces execution permissions during`tools/call`\n\n.**🔌 Dynamic OpenAPI / Swagger Connector:** Instantly registers validated MCP tools directly from OpenAPI 3.0/Swagger YAML or JSON specs without writing backend glue code.**📜 Structured JSON Audit Logging:** Emits tamper-resistant, structured JSON logs containing caller identity, tool invoked, SHA-256 hashed parameters, execution latency, and PII redaction metrics.**🔄 Dual Transport Support:** Fully compliant JSON-RPC 2.0 engine supporting both standard`stdio`\n\n(for Claude Desktop / Cursor) and HTTP Server-Sent Events (`SSE`\n\n) for distributed microservices.\n\n```\n┌────────────────────────────────────────────────────────┐\n│           AI Client (Claude / Cursor / Agent)          │\n└──────────────────────────┬─────────────────────────────┘\n                           │ JSON-RPC 2.0 (stdio or SSE)\n                           ▼\n┌────────────────────────────────────────────────────────┐\n│           Enterprise MCP Gateway (Single Go Binary)    │\n│                                                        │\n│  1. Transport Layer (pkg/mcp/transport)                │\n│     - Stdio & HTTP-SSE Transceivers                    │\n│  2. Security & Auth Guard (pkg/governance/rbac)        │\n│     - Token authentication & least-privilege filtering │\n│  3. Router & Tool Registry (pkg/mcp/protocol)          │\n│     - JSON-RPC 2.0 & MCP handshake engine              │\n│  4. Backend Dispatcher (pkg/connector/openapi)         │\n│     - Dynamic OpenAPI 3.0 path/query/body mapper       │\n│  5. Sanitization Engine (pkg/sanitizer/pii)            │\n│     - Zero-alloc PII, secret, & JSON key redactor      │\n│  6. Structured Audit Logger (pkg/audit)                │\n│     - Cryptographic JSON event trail for SIEM          │\n└──────────────────────────┬─────────────────────────────┘\n                           │ Authorized & Sanitized Calls\n                           ▼\n┌────────────────────────────────────────────────────────┐\n│      Internal Enterprise Services (Java / Go / DBs)    │\n└────────────────────────────────────────────────────────┘\n```\n\nEnsure you have Go 1.24+ installed:\n\n```\n# Clone the repository\ngit clone https://github.com/goschan/enterprise-mcp-gateway.git\ncd enterprise-mcp-gateway\n\n# Build gateway and mock backend server\ngo build -o bin/mcp-gateway ./cmd/gateway\ngo build -o bin/mockserver ./cmd/mockserver\n./bin/mockserver --port 8081\n./bin/mcp-gateway --config ./examples/config.yaml --token \"agent-support-key\"\n./bin/mcp-gateway --config ./examples/config.yaml --transport sse --port 8080\n```\n\nFollow and format structured audit records as tools execute:\n\n**PowerShell (Windows):**\n\n```\nGet-Content -Path .\\audit.log -Wait -Tail 10 | ForEach-Object {\n    if ($_ -match '^\\s*\\{') {\n        $e = $_ | ConvertFrom-Json\n        $time = ([DateTime]$e.timestamp).ToLocalTime().ToString(\"HH:mm:ss\")\n        $statusColor = if ($e.status -eq \"SUCCESS\") { \"Green\" } else { \"Red\" }\n        $redactColor = if ($e.pii_redacted_count -gt 0) { \"Yellow\" } else { \"DarkGray\" }\n        Write-Host \"[$time] \" -NoNewline -ForegroundColor DarkGray\n        Write-Host \"[$($e.status)] \" -NoNewline -ForegroundColor $statusColor\n        Write-Host \"$($e.tool) \" -NoNewline -ForegroundColor Cyan\n        Write-Host \"(Role: $($e.role), Latency: $($e.duration_ms)ms, Redacted: $($e.pii_redacted_count))\" -ForegroundColor $redactColor\n    }\n}\n```\n\n**Bash / Linux / macOS ( jq):**\n\n```\ntail -f audit.log | jq -c '{time: .timestamp, status: .status, tool: .tool, role: .role, latency_ms: .duration_ms, redacted: .pii_redacted_count}'\n```\n\nYou can test and inspect the gateway using Anthropic's official `@modelcontextprotocol/inspector`\n\n:\n\n```\nnpx @modelcontextprotocol/inspector ./bin/mcp-gateway --config ./examples/config.yaml --token agent-support-key\n```\n\n- Start the gateway in SSE mode:\n\n```\n./bin/mcp-gateway --config ./examples/config.yaml --transport sse --port 8080\n```\n\n- Open the inspector pointing to the SSE endpoint:\n\n```\nnpx @modelcontextprotocol/inspector http://localhost:8080/sse\n```\n\nTo connect Claude Desktop to your enterprise systems through `enterprise-mcp-gateway`\n\n:\n\n-\nOpen your Claude Desktop configuration file:\n\n**macOS:**`~/Library/Application Support/Claude/claude_desktop_config.json`\n\n**Linux:**`~/.config/Claude/claude_desktop_config.json`\n\n**Windows:**`%APPDATA%\\Claude\\claude_desktop_config.json`\n\n-\nAdd\n\n`enterprise-mcp-gateway`\n\nto the`mcpServers`\n\nobject:\n\n```\n{\n  \"mcpServers\": {\n    \"enterprise-gateway\": {\n      \"command\": \"/absolute/path/to/enterprise-mcp-gateway/bin/mcp-gateway\",\n      \"args\": [\n        \"--config\",\n        \"/absolute/path/to/enterprise-mcp-gateway/examples/config.yaml\",\n        \"--token\",\n        \"agent-support-key\"\n      ]\n    }\n  }\n}\n```\n\n- Restart Claude Desktop. The enterprise tools (\n`listCustomers`\n\n,`getCustomerDetails`\n\n,`createSupportTicket`\n\n, etc.) will appear with a hammer icon in the prompt interface.\n\n```\nserver:\n  name: \"enterprise-mcp-gateway\"\n  version: \"1.0.0\"\n  transport: \"stdio\"       # \"stdio\" or \"sse\"\n  host: \"0.0.0.0\"\n  port: 8080\n\ngovernance:\n  enabled: true\n  default_role: \"support_agent\"\n  tokens:\n    \"agent-ro-secret\": \"readonly_agent\"\n    \"agent-support-secret\": \"support_agent\"\n    \"admin-master-secret\": \"admin\"\n  roles:\n    readonly_agent:\n      allowed_tools:\n        - \"list*\"\n        - \"get*\"\n    support_agent:\n      allowed_tools:\n        - \"list*\"\n        - \"get*\"\n        - \"createSupportTicket\"\n    admin:\n      allowed_tools:\n        - \"*\"\n\nsanitizer:\n  enabled: true\n  mask_card_numbers: true  # Luhn-verified Credit Card masking\n  mask_ssn: true           # US SSN masking\n  mask_secrets: true       # Private keys, AWS keys, JWTs, PATs\n  sensitive_keys:\n    - \"password\"\n    - \"secret\"\n    - \"token\"\n    - \"apiKey\"\n    - \"ssn\"\n    - \"creditCard\"\n  custom_regex:\n    - name: \"Internal Employee ID\"\n      pattern: \"\\\\bEMP-[0-9]{6}\\\\b\"\n      replacement: \"[REDACTED-EMP-ID]\"\n\naudit:\n  enabled: true\n  log_path: \"stdout\"       # \"stdout\" or path to file e.g. \"/var/log/mcp-audit.log\"\n  hash_inputs: true        # SHA-256 hashes tool arguments for compliance\n\nconnectors:\n  - name: \"enterprise-crm\"\n    type: \"openapi\"\n    spec_file: \"./examples/crm-openapi.yaml\"\n    base_url: \"http://localhost:8081\"\n    headers:\n      Authorization: \"Bearer backend-secret-token\"\n      X-Gateway-Source: \"enterprise-mcp-gateway\"\n    timeout_seconds: 15\n```\n\nRun all unit and end-to-end integration tests:\n\n```\n# Run all unit and integration tests\ngo test -v ./...\n\n# Run tests with the Go race detector enabled\ngo test -race ./...\n# Build lightweight Docker image\ndocker build -t enterprise-mcp-gateway:latest .\n\n# Run container in SSE mode\ndocker run -d -p 8080:8080 -p 8081:8081 enterprise-mcp-gateway:latest --transport sse --port 8080\n```\n\nMIT License.", "url": "https://wpnews.pro/news/enterprise-mcp-gateway-in-flight-pii-redaction-and-audit-in-go", "canonical_source": "https://github.com/BenjaminJ/enterprise-mcp-gateway", "published_at": "2026-08-30 17:02:20+00:00", "updated_at": "2026-08-30 17:22:17.457834+00:00", "lang": "en", "topics": ["ai-infrastructure", "ai-agents", "ai-tools", "ai-safety"], "entities": ["goschan", "Enterprise MCP Gateway", "Claude Desktop", "Cursor", "Antigravity", "LangGraph", "OpenAPI"], "alternates": {"html": "https://wpnews.pro/news/enterprise-mcp-gateway-in-flight-pii-redaction-and-audit-in-go", "markdown": "https://wpnews.pro/news/enterprise-mcp-gateway-in-flight-pii-redaction-and-audit-in-go.md", "text": "https://wpnews.pro/news/enterprise-mcp-gateway-in-flight-pii-redaction-and-audit-in-go.txt", "jsonld": "https://wpnews.pro/news/enterprise-mcp-gateway-in-flight-pii-redaction-and-audit-in-go.jsonld"}}