---
lang: en
tags:
  - agent-permissions
  - mcp
  - mcp-gateway
  - oauth
  - self-hosted
title: >-
  Cortex Gateway: Self-Hosted MCP Federation Where Agent Access Equals Human
  Rights
subtitle: >-
  One OAuth 2.1 MCP server in front of N apps — permissions delegated to the
  apps that own them, never mirrored
description: >-
  Cortex Gateway joins the ecosystem: an MIT-licensed, self-hosted MCP
  federation gateway where every agent call carries the real user's identity.
  Agent-verifiable by design: llms.txt, AGENTS.md, probeable claims.
slug: 2026-07-05-cortex-gateway-self-hosted-mcp-federation
date: 2026-07-05T00:00:00.000Z
lastmod: 2026-07-05T00:00:00.000Z
draft: false
featured: true
type: ecosystem-news
category: ecosystem-analysis
format: announcement
audience:
  - developers
  - protocol-architects
  - platform-teams
difficulty: intermediate
reading_time: 4
---

# Cortex Gateway: self-hosted MCP federation where agent access equals human rights

A new piece of agentic infrastructure ships from the wellknownmcp org: **[Cortex Gateway](https://cortex-gateway.dev)**, an MIT-licensed, self-hosted **MCP federation gateway** — one spec-compliant MCP server (Streamable HTTP, OAuth 2.1) in front of N ordinary web apps.

## The problem it answers

Companies now ship one small internal app per business function — cheap to build, each behind SSO, with rights that follow the org chart. Then every employee wants to hand their own agent the keys. One MCP connector per app doesn't scale (N consents, N token stores, no shared audit); an aggregator on a service account is worse — every agent inherits the union of everyone's rights.

Cortex Gateway's answer: **the agent's access IS the user's access**. Each call carries the real caller's identity (their JWT for first-party apps, their own linked token for proxied third-party MCP servers). Each app keeps enforcing its own permissions. The gateway decides nothing — so there is nothing new to trust, even as copilots become autonomous assistants.

## Why it matters to the agentic-web conversation

- **Backends are self-describing**: every app can expose `get_help(topic?)` — workflows, domain concepts, conventions — and the gateway's server instructions tell every connected agent to prefer it over guessing.
- **Agents close the loop**: a `report_missing_capability` builtin files deduplicated tickets when a tool is missing — unmet agent needs are logged where the domain lives.
- **The launch itself is agent-verifiable**: [llms.txt](https://cortex-gateway.dev/llms.txt), an [AGENTS.md](https://github.com/wellknownmcp/cortex-gateway/blob/main/AGENTS.md) with claims your agent can re-check (tests, live RFC 9728 probes), and a demo any MCP client can join in ~30 seconds.

## Try it

Add `https://mcp.cortex-gateway.dev/mcp` as a custom connector in claude.ai (magic-link signup, scope-tiered demo tools), or self-host: `docker run ghcr.io/wellknownmcp/cortex-gateway`.

Source (MIT): [github.com/wellknownmcp/cortex-gateway](https://github.com/wellknownmcp/cortex-gateway) — also listed on the [official MCP registry](https://registry.modelcontextprotocol.io) as `io.github.wellknownmcp/cortex-gateway`.