MCP Gateway Home Manager Module

homeManagerModules.mcp-gateway exposes services.mcp-gateway and renders ~/.config/mcp-gateway/gateway.yaml from Nix options.

Import

home-manager.sharedModules = [
  mcp-servers.homeManagerModules.mcp-gateway
];

Minimal example

services.mcp-gateway = {
  enable = true;
  server = {
    host = "100.64.0.19";
    port = 39401;
  };

  environmentFile = "/run/secrets/rendered/mcp_gateway_env";

  auth.apiKeys.dev = {
    key = "env:DEV_GATEWAY_KEY";
    backends = [ "nixos" "fetch" ];
  };

  backends = {
    nixos.command = "${pkgs.mcp-nixos}/bin/mcp-nixos";
    fetch.command = "${pkgs.mcp-server-fetch}/bin/mcp-server-fetch";
  };
};

services.mcp-gateway.url is read-only and resolves to http://<server.host>:<server.port>/mcp, for use by MCP clients.

Backends

Backends are keyed by name and support:

command for stdio backends, or httpUrl for HTTP backends
cwd, timeout, env, headers
passthrough, allowCleartextCredentials
resolveEnv = true to wrap commands that read literal ${env.VAR} placeholders
extraConfig for fields not modelled by the module

API keys

API keys are keyed by client name. The key may use the gateway's env:VAR, keychain:NAME, or oauth:PROVIDER indirection. Avoid literal secrets in the Nix store.

Routing profiles

routingProfiles.<name> supports allowBackends, denyBackends, allowTools, and denyTools. Set defaultRoutingProfile to the profile used when a session has not selected one.

1.5 KiB Raw Blame History