# Vaubaan Gateway

> An open source MCP gateway you install on your own network: coding agents use your cloud services through missions, never through your credentials. A person creates a mission (the accounts and resources an agent may touch, its permissions, limits per period and per minute, and which actions ask them first); the agent gets a key for that mission; the gateway checks every MCP tool call against it, runs it with a credential that stays on the instance, and records it. Pre-release, Apache-2.0, installed with Docker.

Every page below is Markdown at the address given; the HTML page is the same address without `.md`. The whole of it in one file: https://vaubaan.com/llms-full.txt. Every plugin as JSON: https://vaubaan.com/plugins.json. Source: https://github.com/vaubaan/gateway.

## Docs

- [Vaubaan Gateway docs](https://vaubaan.com/docs.md): How to try, install, configure and run a Vaubaan Gateway instance, and how to give agents missions.
- [Concepts](https://vaubaan.com/docs/concepts.md): The words of Vaubaan Gateway — instance, account, resource, mission, key, permission, preset, limit, ask me first, activity — and the names the protocol keeps for them.
- [Quick look](https://vaubaan.com/docs/quick-look.md): Run the demo on a laptop — the whole interface, seeded people, accounts and missions, simulated sign-in and services, nothing to register.
- [Install](https://vaubaan.com/docs/install.md): What an instance needs — a host with Docker or a Railway service, a DNS name, a sign-in provider, a master key — and the first sign-in.
- [Install with Docker Compose](https://vaubaan.com/docs/install/docker-compose.md): Build the image from the repository and run it with the bundled Caddy proxy, which obtains the TLS certificate for your domain.
- [Install on Railway](https://vaubaan.com/docs/install/railway.md): One Railway service built from the repository's Dockerfile, one volume at /data, the configuration in Railway variables, sign-in through GitHub.
- [Install with your coding agent](https://vaubaan.com/docs/install-with-your-coding-agent.md): One block to paste into a coding agent so it installs a Vaubaan Gateway instance with Docker Compose, asks you what only you know, and checks the result.
- [Configuration](https://vaubaan.com/docs/configuration.md): How an instance reads its configuration — environment variables and a YAML file — and how to set sign-in providers, the admin rule and company apps.
- [Configuration keys](https://vaubaan.com/docs/configuration/keys.md): Every configuration key of an instance (42 rows), its environment variable, type, default and accepted values.
- [Connect a provider](https://vaubaan.com/docs/providers.md): How an account of a service is connected to an instance — a company app or a token — and one page per service, generated from its plugin.
- [Connect Cloudflare DNS](https://vaubaan.com/docs/providers/cloudflare-dns.md): How to connect a Cloudflare DNS account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Context7](https://vaubaan.com/docs/providers/context7.md): How to connect a Context7 account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Fly.io](https://vaubaan.com/docs/providers/fly.md): How to connect a Fly.io account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect GitHub](https://vaubaan.com/docs/providers/github.md): How to connect a GitHub account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Gmail](https://vaubaan.com/docs/providers/gmail.md): How to connect a Gmail account to Vaubaan Gateway (experimental plugin): the company app or the token, and what to grant.
- [Connect Miro](https://vaubaan.com/docs/providers/miro.md): How to connect a Miro account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Notion](https://vaubaan.com/docs/providers/notion.md): How to connect a Notion account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Railway](https://vaubaan.com/docs/providers/railway.md): How to connect a Railway account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Resend](https://vaubaan.com/docs/providers/resend.md): How to connect a Resend account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect SSH (bash)](https://vaubaan.com/docs/providers/ssh.md): How to connect a SSH (bash) account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Stripe](https://vaubaan.com/docs/providers/stripe.md): How to connect a Stripe account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Supabase](https://vaubaan.com/docs/providers/supabase.md): How to connect a Supabase account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Upstash Redis](https://vaubaan.com/docs/providers/upstash-redis.md): How to connect a Upstash Redis account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Connect Vercel](https://vaubaan.com/docs/providers/vercel.md): How to connect a Vercel account to Vaubaan Gateway: the company app or the token, and what to grant.
- [Missions and agents](https://vaubaan.com/docs/missions.md): Create a mission, give its key to an agent with the kit the instance prints, and what the agent reads when a call is refused.
- [MCP clients](https://vaubaan.com/docs/missions/mcp-clients.md): Point Claude Code, Cursor or another MCP client at the execution door with a mission key, and name each agent with a label.
- [Management door](https://vaubaan.com/docs/missions/management-door.md): Let an agent prepare missions in your name through /mcp/manage, authorized once through OAuth; it creates missions within your authority and executes nothing.
- [Git remote](https://vaubaan.com/docs/missions/git-remote.md): Agents clone and push through the instance with the mission key as the password; every pushed ref is decided like a tool call.
- [Operations](https://vaubaan.com/docs/operations.md): Running an instance day to day — health, logs, audit retention, the reverse proxy — and the procedures for backup, key rotation, upgrade and telemetry.
- [Backup and restore](https://vaubaan.com/docs/operations/backup-and-restore.md): Make a consistent copy of the database while the instance runs, keep the master key apart, and what restoring a copy involves.
- [Master key rotation](https://vaubaan.com/docs/operations/master-key-rotation.md): Rotate the master key and reseal every stored secret under the new one, with a backup first, a dry run, and the removal of the old key at the end.
- [Upgrade](https://vaubaan.com/docs/operations/upgrade.md): Back up, take the new version, restart; migrations run at start and there is no downgrade.
- [Telemetry](https://vaubaan.com/docs/operations/telemetry.md): Community telemetry is off by default and sends nothing today; the two levels, who decides, and what leaves the instance when it is on.
- [Known limitations](https://vaubaan.com/docs/known-limitations.md): What has not been done and what is not there in this version: never run for real, not enforced, one process, not built.
- [How Vaubaan compares](https://vaubaan.com/docs/compare.md): How Vaubaan Gateway differs from handing an agent a token, from a secrets manager and from other MCP gateways, and what it is not.

## Plugins

- [Plugins](https://vaubaan.com/plugins.md): The 14 plugins shipped with Vaubaan Gateway, with their version, status and health.
- [Plugin health](https://vaubaan.com/plugins/health.md): Per plugin version, the calls reported by the instances that opted in to telemetry, and whether it is validated.
- [Cloudflare DNS plugin](https://vaubaan.com/plugins/cloudflare-dns.md): Cloudflare DNS plugin of Vaubaan Gateway, version 3.0.0: 12 permissions, 3 presets, 15 tools.
- [Context7 plugin](https://vaubaan.com/plugins/context7.md): Context7 plugin of Vaubaan Gateway, version 0.1.0: 2 permissions, 1 presets, 2 tools.
- [Fly.io plugin](https://vaubaan.com/plugins/fly.md): Fly.io plugin of Vaubaan Gateway, version 0.1.0: 25 permissions, 4 presets, 42 tools.
- [GitHub plugin](https://vaubaan.com/plugins/github.md): GitHub plugin of Vaubaan Gateway, version 3.2.0: 19 permissions, 3 presets, 26 tools.
- [Gmail plugin](https://vaubaan.com/plugins/gmail.md): Gmail plugin of Vaubaan Gateway, version 0.3.0: 16 permissions, 2 presets, 0 tools.
- [Miro plugin](https://vaubaan.com/plugins/miro.md): Miro plugin of Vaubaan Gateway, version 0.1.0: 7 permissions, 3 presets, 30 tools.
- [Notion plugin](https://vaubaan.com/plugins/notion.md): Notion plugin of Vaubaan Gateway, version 0.1.0: 15 permissions, 3 presets, 18 tools.
- [Railway plugin](https://vaubaan.com/plugins/railway.md): Railway plugin of Vaubaan Gateway, version 4.2.0: 10 permissions, 3 presets, 14 tools.
- [Resend plugin](https://vaubaan.com/plugins/resend.md): Resend plugin of Vaubaan Gateway, version 0.3.0: 18 permissions, 4 presets, 27 tools.
- [SSH (bash) plugin](https://vaubaan.com/plugins/ssh.md): SSH (bash) plugin of Vaubaan Gateway, version 2.0.0: 8 permissions, 3 presets, 1 tools.
- [Stripe plugin](https://vaubaan.com/plugins/stripe.md): Stripe plugin of Vaubaan Gateway, version 0.4.0: 17 permissions, 3 presets, 27 tools.
- [Supabase plugin](https://vaubaan.com/plugins/supabase.md): Supabase plugin of Vaubaan Gateway, version 4.2.0: 26 permissions, 3 presets, 44 tools.
- [Upstash Redis plugin](https://vaubaan.com/plugins/upstash-redis.md): Upstash Redis plugin of Vaubaan Gateway, version 3.0.0: 11 permissions, 3 presets, 21 tools.
- [Vercel plugin](https://vaubaan.com/plugins/vercel.md): Vercel plugin of Vaubaan Gateway, version 3.0.0: 17 permissions, 3 presets, 31 tools.

## Trust center

- [Trust center](https://vaubaan.com/trust.md): What protects the credentials an instance holds, what is not covered, what leaves an instance, and how to report a vulnerability.

## Optional

- [Home page](https://vaubaan.com/index.md): the pitch and the questions people ask
- [Repository](https://github.com/vaubaan/gateway): code, specification, handbooks and decisions