Self-hosted MCP aggregator

1 endpoint.
Every tool.
Every call governed.

Orcorus puts all of your Model Context Protocol servers behind a single gateway your agents, IDEs, and chat clients can connect to. Each tool runs in an isolated Docker container, every call passes deny-first policies and per-group budgets, and credentials never leave the vault.

Deploy in 5 minutes View the source

JSON-RPC · REST · SSE Deny-first policy engine Vault-backed secrets Docker isolation

POST /mcp · tools/call

Gateway online

01Authenticate callerwait
02Resolve identity & groupswait
03Evaluate policies (deny-first)wait
04Check quotas & budgetwait
05Resolve secrets from Vaultwait
06Launch isolated containerwait
07Execute & record costwait

group network-ops policy allow · $0.0004

The problem with MCP sprawl

10 servers, 10 configs, 0 visibility.

MCP made it easy to give models tools. It did nothing to help a team manage them. Orcorus replaces per-user server sprawl with a single governed hub that is shared, observed, and enforced.

Before

Credentials live in client configs

API keys and SSH secrets get pasted into every developer's local MCP config, then forgotten.

Secrets stay in HashiCorp Vault and are injected into the container only at execution time.

Before

Any tool, any time, for anyone

Once a server is running, every model call can invoke every tool. There is no policy layer.

Deny-first policies scoped by user, group, integration, tool, time, and IP gate every call.

Before

Nobody knows what it costs

Tool calls burn compute and third-party quotas with no attribution and no ceiling.

Per-invocation and per-second cost models roll up to daily, weekly, and monthly group budgets.

Architecture

A gateway in front, containers behind, nothing in between.

Clients speak MCP to Orcorus. Orcorus discovers every tool a user can reach, namespaces it as integration/tool_name, and routes the call to the right backend after policy, quota, and budget checks pass.

Platform

Everything a production MCP gateway needs, in 1 container.

Discovery, execution, governance, and a marketplace, shipped as a single FastAPI service you own.

Unified MCP gateway

Aggregates a user's own integrations and group-shared integrations into 1 tool list, namespaced and routed to the right backend.

POST /mcp · GET /mcp/tools · GET /sse

Docker-backed integrations

Each template declares an image, tool manifest, environment schema, and transport. Containers launch with memory and CPU limits and network isolation.

stdio · HTTP · SSE

Policy engine

JSON policies evaluated by priority with deny-first semantics. Target users or groups, integrations or tools, with time and IP conditions.

effect · subjects · resources · conditions

Governance & quotas

Rate limits, daily invocation caps, concurrency ceilings, and spend budgets applied per group and checked on every call.

daily · weekly · monthly budgets

Vault-backed secrets

Credentials live in HashiCorp Vault KV v2. The database stores only the path. Values are resolved and injected at execution time, then gone.

HashiCorp Vault KV v2

Groups & RBAC

Groups are the unit of control. Member and admin roles, shared integrations, budgets, and quotas all attach to the group.

member · admin · shared integrations

Marketplace

Browse integration templates, inspect tool manifests, and connect with 1 click. Admins publish and manage templates for the whole org.

template-driven onboarding

Cost ledger

Every execution records its cost against a per-invocation plus per-second pricing model, so budgets reflect real usage.

per-invocation + per-second

Admin web UI

A built-in dashboard for integrations, marketplace, groups, policies, secrets, governance, and administration. No extra frontend to deploy.

Jinja2 + Tailwind

Connect

3 transports. 1 tool catalog.

Point any MCP client at the gateway and it sees every tool you are allowed to use. Automation that does not speak MCP can use the REST wrapper instead.

JSON-RPC 2.0

MCP streamable HTTP

The native protocol: initialize, tools/list, tools/call.

POST /mcp

REST

Simplified wrapper

List and call tools from scripts, CI jobs, and webhooks.

GET /mcp/tools · POST /mcp/tools/call

SSE

Server-Sent Events

Legacy transport with keep-alive for older clients.

GET /sse

// Claude Desktop, Claude Code, Cursor, or any MCP client
{
  "mcpServers": {
    "orcorus": {
      "url": "https://orcorus.internal/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>"
      }
    }
  }
}

// Every tool you can reach shows up namespaced:
//   ssh/run_command   ping/ping   whois/lookup   ...

# List every tool the caller is allowed to use
$ curl -s https://orcorus.internal/mcp/tools \
    -H "Authorization: Bearer $ORCORUS_TOKEN"

# Call one. Policy, quota, budget and Vault all run first.
$ curl -s -X POST https://orcorus.internal/mcp/tools/call \
    -H "Authorization: Bearer $ORCORUS_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"name":"whois/lookup","arguments":{"query":"example.com"}}'

// POST /mcp  (MCP streamable HTTP)
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "ping/ping",
    "arguments": { "host": "10.0.0.1", "count": 3 }
  }
}

// Also supported: initialize, tools/list

// Deny-first. Higher priority wins. Conditions are extensible.
{
  "name": "contractors-no-ssh-after-hours",
  "effect": "deny",
  "priority": 100,
  "subjects":  { "groups": ["contractors"] },
  "resources": { "integrations": ["ssh"] },
  "conditions": {
    "time_range": { "start": "18:00", "end": "08:00" }
  }
}

Execution pipeline

11 steps between a request and a result.

No tool call skips the line. Each step in the orchestrated pipeline can stop the call, and every completed call leaves a cost record behind.

AuthenticateVerify the caller's token.
Resolve identityLoad the user and their group memberships.
Resolve templateFind the integration behind the namespaced tool.
Evaluate policiesDeny-first, priority ordered.
Check quotasRate, daily cap, concurrency.
Check budgetDaily, weekly, or monthly spend.
Resolve secretsFetch values from Vault by path.
Launch containerOr connect to a remote HTTP endpoint.
Execute tool callProxy the MCP request and stream the result.
Record costPer-invocation plus per-second pricing.
CleanupTear the container down. Nothing lingers.

Governance

Limits that hold, set per group.

4 independent controls are enforced on every call. Set them once on a group and every member inherits them.

RateWINDOW

Rate limits

Concurrent and short-window limits smooth bursts before they reach a backend.

DailyCAP

Daily invocations

A hard ceiling on calls per group per day. Resets automatically.

MaxCONCURRENT

Concurrency

Bound the number of containers a group can have running at once.

SpendD / W / M

Budgets

Daily, weekly, or monthly spend limits checked against the cost model before execution.

Integrations

Batteries included. Bring the rest.

3 integrations ship with the platform. Any MCP server that can run in a container, or is reachable over HTTP, can be added as a template.

ssh

bundled

Execute commands on remote hosts over SSH, with keys resolved from Vault.

orcorus-ssh:latest

ping

bundled

Check network connectivity and latency to any host from an isolated container.

orcorus-ping:latest

whois

bundled

Look up WHOIS records for domains and IP addresses.

orcorus-whois:latest

your-server

template

Declare an image, tools manifest, env schema, and transport. Publish it to the marketplace.

stdio · http · sse

Quick start

Up in 1 compose command.

Orcorus ships with a Docker Compose file that brings up the gateway, its database, and Vault. Everything is configured through environment variables prefixed with ORCORUS_.

Clone and start
Docker and Docker Compose are the only prerequisites.
Sign in
Open the dashboard on port 8000 with the admin credentials from your compose file.
Connect a tool
Pick an integration in the marketplace, add its secret to Vault, click Connect.
Point your client at /mcp
Create a group, set a budget, and share the integration with your team.

$ git clone https://github.com/ceilingduster/orcorus.git
$ cd orcorus
$ docker compose up --build -d

# run migrations
$ docker compose run --rm -e PYTHONPATH=/app orcorus \
    alembic upgrade head

# dashboard
→ http://localhost:8000

Variable	Purpose
`ORCORUS_DATABASE_URL`	Async DB URL. SQLite for dev, PostgreSQL for prod.
`ORCORUS_VAULT_ADDR` / `_TOKEN`	Where secrets live.
`ORCORUS_CONTAINER_TIMEOUT`	Execution timeout per call. Default 300s.
`ORCORUS_CONTAINER_MEMORY_LIMIT`	Per-container memory cap. Default 256m.
`ORCORUS_CONTAINER_CPU_LIMIT`	Per-container CPU cap. Default 0.5.
`ORCORUS_DOCKER_NETWORK`	Isolated network for tool containers.

Built on

Boring, well-understood infrastructure.

Python 3.12FastAPIUvicornSQLAlchemy 2.0 asyncAlembic PostgreSQLSQLiteHashiCorp VaultDocker SDKJinja2Tailwind CSS

Get Orcorus

Own the gateway your agents run through.

Self-hosted, source available, and free for personal, educational, and non-commercial use. Commercial licenses are available from the author.

Get it on GitHub Read the quick start

1 endpoint.Every tool.Every call governed.

10 servers, 10 configs, 0 visibility.

Credentials live in client configs

Any tool, any time, for anyone

Nobody knows what it costs

A gateway in front, containers behind, nothing in between.

Everything a production MCP gateway needs, in 1 container.

Unified MCP gateway

Docker-backed integrations

Policy engine

Governance & quotas

Vault-backed secrets

Groups & RBAC

Marketplace

Cost ledger

Admin web UI

3 transports. 1 tool catalog.

MCP streamable HTTP

Simplified wrapper

Server-Sent Events

11 steps between a request and a result.

Limits that hold, set per group.

Rate limits

Daily invocations

Concurrency

Budgets

Batteries included. Bring the rest.

ssh

ping

whois

your-server

Up in 1 compose command.

Clone and start

Sign in

Connect a tool

Point your client at /mcp

Boring, well-understood infrastructure.

Own the gateway your agents run through.

1 endpoint.
Every tool.
Every call governed.