MonoMCP Gateway

Unified MCP layer for MonoMCP: serves every organization's toolkits as MCP endpoints with per-tool permissions, an async approval queue, and full request/response audit logging.

Endpoints

/{org_slug}/{toolkit_slug}/mcp

• /mono/seo/mcp — public MonoMCP toolkits (org mono)
• /acme/seo/mcp — a company's private toolkit
• /acme/custom-growth-toolkit/mcp — a custom toolkit
• Enterprise custom domains (mcp.acme.com/seo/mcp) map the Host header to an organization (future work; hook in app.py).

Private toolkits return 404 to callers outside the owning organization — they are not discoverable.

Auth

Authorization: Bearer <token> where the token is either:

• an org-scoped API key (mmcp_…, created via the api's /api/v1/api-keys), or
• a monomcp JWT access token (from /api/v1/auth/login).

Tools

Tools are grouped by toolkit bundle. A needs_approval/blocked permission may apply per tool and org (see below).

seo

• sitemap_settings_get — get sitemap generation settings for the org's site
• sitemap_xml_get — render the current sitemap.xml
• robots_txt_get — render the current robots.txt
• llms_txt_get — render the current llms.txt (AI discovery file)

smm (social media)

• strategies_list — list social media strategies
• ideas_list — list content ideas
• calendar_list — list scheduled calendar items
• platforms_list — list configured social platforms

cms

• content_types_list — list content types
• entries_list — list CMS entries
• entry_get — get a CMS entry by id
• navigation_menus_list — list navigation menus

crm

• contacts_list — list CRM contacts
• contact_get — get a CRM contact by id
• labels_list — list CRM labels

ecommerce

• products_list — list products (not yet implemented)
• orders_list — list orders (not yet implemented)

firecrawl

• scrape — scrape a URL (not yet implemented)
• search — search the web (not yet implemented)

brand

• get_profile — get the org's brand profile
• create_profile — create a brand profile
• enrich_profile_from_website — scrape a website and populate the profile
• get_tone_of_voice — get the brand's tone-of-voice profile
• analyze_tone_of_voice_from_url — analyze tone of voice from a URL
• create_tone_of_voice — create a tone-of-voice profile

Built-in

• approval_status — check the status of a pending approval request

Permissions

Each tool call resolves an effective permission — the caller's role-policy override if one exists, else the tool's org-wide default:

• always_allow — executes immediately
• needs_approval — creates a pending approval request; an admin decides via the api/console; re-calling with the same arguments after approval executes. Poll the built-in approval_status tool for progress.
• blocked — rejected

Every call is persisted to audit_request_logs (source=mcp) with full payloads, duration, status, and actor.

Run

cp .env.example .env   # DATABASE_URL + JWT_SECRET must match the api project
uv sync
uv run uvicorn monomcp_gateway.app:app --port 8765

The database schema is owned by the api project (api/alembic); this project only reads/writes existing tables via the mirror models in src/monomcp_gateway/models.py.