fold

fold is the one. fold.run is the execution.

The high-performance enterprise MCP gateway: one governed endpoint between every MCP client and every MCP server. fold sits in front of any number of upstream MCP servers — in any language, on any SDK, from any team or vendor — providing federation, enterprise auth, policy, caching, rate limiting, and audit, while staying automatically aligned with the MCP specification, SEPs, and official SDK releases.

Use cases

• Unify a federation. Acquisitions, child orgs, and teams each ship their own MCP servers; fold presents them as one virtual server with namespaced tools — no team rewrites anything.
• Draw the security boundary. One choke point for authentication, deny-by-default tool allowlists, per-principal visibility, and an audit event for every request including denials.
• Insulate protocol eras. fold speaks 2026-07-28 natively and translates in both directions — teams migrate off legacy SDKs on their own schedule while clients never notice.
• Broker credentials. Clients hold one token with fold as audience; fold exchanges it per upstream (RFC 8693) or injects service credentials — API keys never reach agents.
• Protect fragile services. SEP-2549 caching, global and per-upstream rate limits, and circuit breakers stand between agent traffic storms and your internal systems.
• Govern vendor MCP servers. Put third-party/SaaS MCP endpoints behind your own auth, policy, and audit instead of scattering per-user API keys.
• Expose tools outward, carefully. Offer partners or customers a curated, policy-scoped subset of internal tools on one hardened endpoint — self-hosted or at the edge on Cloudflare Workers.

Highlights

• Native 2026-07-28 stateless core. Routes on the Mcp-Method/Mcp-Name headers (SEP-2243) without parsing request bodies; responses stream through untouched.
• Legacy compatible. Stateful 2025-era clients and upstream servers work through the gateway during the deprecation window.
• Portable. One TypeScript core built on web-standard APIs, deployable on Node.js (Docker/k8s) and Cloudflare Workers.
• Conformant, provably. The official @modelcontextprotocol/conformance suite runs against fold fronting a reference server — 40/40 scenarios on Node.js AND on Cloudflare Workers (workerd), with ~1.8 ms p50 added latency on Node.
• Enterprise-governed. OAuth 2.0 resource server (RFC 9207/8707/9728), Enterprise-Managed Authorization (ID-JAG exchange), per-upstream token exchange (RFC 8693), deny-by-default tool allowlists with per-principal list filtering, and an audit event for every request including denials.

Try it now

A live demo gateway runs at https://demo.fold.run/mcp — Cloudflare's modern 2026-07-28 docs server federated with GitMCP (a stateful 2025-era server), unified behind one endpoint. Point any MCP client at it:

https://demo.fold.run/mcp

You'll see cfdocs__* and git__* tools side by side; the legacy upstream is translated live through a held session in a Durable Object. Rate-limited, unauthenticated, no warranty.

Quick start

cat > fold.config.json <<'EOF'
{
  "upstreams": [
    { "id": "github", "url": "https://mcp.example.com/mcp", "namespace": "github" }
  ]
}
EOF

npx @fold-run/gateway --config fold.config.json --port 8080
# MCP endpoint: http://localhost:8080/mcp

Embedding in your own Node service is one call: createFoldGateway(config) from the same package.

Edge deployment (same core, Durable Object-backed sessions and rate limits):

cd apps/gateway-workers
# set FOLD_CONFIG in wrangler.jsonc vars (or a secret), then:
npx wrangler deploy

A single upstream without a namespace runs in zero-copy passthrough mode. Multiple upstreams require namespaces; tools are exposed as {namespace}__{name}.

A federated multi-org config — each upstream owned by a different team, in