{"id":"4c65796a-5481-4b50-8f5b-5f130b777cab","slug":"nexus-mcp-enterprise-gateway","kind":"mcp","name":"nexus-mcp-enterprise-gateway","summary":"Enterprise Model Context Protocol (MCP) server mesh, execution sandbox & observability gateway.","owner":"JayNabasu","repoUrl":"https://github.com/JayNabasu/nexus-mcp-enterprise-gateway","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-09-23T08:06:27.000Z","addedAt":"2026-10-21T06:50:02.420Z","logoUrl":"https://avatars.githubusercontent.com/u/20784870?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","memory-knowledge"],"tags":["agentic-ai","dlp","fastapi","opentelemetry","python","rbac"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-22T19:09:09.606Z","sample":false,"url":"https://conduits.dev/tools/nexus-mcp-enterprise-gateway","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<div align=\"center\">\n\n# 🌐 Nexus MCP Enterprise Gateway\n### Enterprise Model Context Protocol (MCP) Server Mesh, Execution Sandbox & Observability Gateway\n\n[![MCP Spec](https://img.shields.io/badge/MCP_Spec-2024--11--05-blueviolet?style=for-the-badge&logo=anthropic)](https://modelcontextprotocol.io/)\n[![Python](https://img.shields.io/badge/Python-3.11%20%7C%203.14-blue?style=for-the-badge&logo=python)](https://python.org)\n[![FastAPI](https://img.shields.io/badge/FastAPI-0.110%2B-009688?style=for-the-badge&logo=fastapi)](https://fastapi.tiangolo.com)\n[![Pytest](https://img.shields.io/badge/Tests-21%2F21%20Passed%20(100%25)-brightgreen?style=for-the-badge&logo=pytest)](https://pytest.org)\n[![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)](LICENSE)\n[![Author](https://img.shields.io/badge/Author-Jerry%20Nabasu-0077B5?style=for-the-badge&logo=linkedin)](https://linkedin.com/in/jerrynabasu/)\n\n<br/>\n\n[![Live Demo](https://img.shields.io/badge/Live_Demo-Launch_MCP_Studio_Online-06b6d4?style=for-the-badge&logo=googlechrome)](https://jaynabasu.github.io/nexus-mcp-enterprise-gateway/)\n\n<p align=\"center\">\n  <em>A hardened, production-grade Model Context Protocol (MCP) gateway bridging enterprise data backends (SQL, Financial Ledgers, SCADA telemetry, SOP documents) to autonomous LLM agents with Role-Based Access Control (RBAC), automated Data Loss Prevention (DLP), Human-In-The-Loop (HITL) gates, and OpenTelemetry distributed tracing.</em>\n</p>\n\n</div>\n\n---\n\n## 🏛️ Executive Summary\n\nWhile Anthropic's **Model Context Protocol (MCP)** has become the universal standard connecting LLMs to external systems, standard reference implementations lack enterprise-grade controls. In production environments across regulated industries (energy, banking, healthcare), connecting autonomous agents directly to internal tools exposes organizations to:\n1. **Unchecked Data Egress**: Unmasked PII, credentials, or proprietary concession identifiers leaking into LLM context windows.\n2. **Unauthorized Destructive Executions**: LLMs generating unintended `DROP`, `DELETE`, or state-altering commands without operator clearance.\n3. **Observability Blindspots**: Lack of token attribution, latency tracking, and audit traces for compliance verification.\n\n**Nexus MCP Enterprise Gateway** resolves these operational challenges by introducing a hardened intermediary layer that implements the standard **MCP JSON-RPC 2.0 specification** (2024-11-05) alongside enterprise controls:\n- **Hierarchical RBAC Enforcement**: Automatically filters registered tools, resources, and prompt templates based on caller identity (`ANALYST`, `AUDITOR`, `ADMIN`, `SUPERUSER`).\n- **Real-Time DLP & PII Sanitizer**: High-precision regex scrubbers intercepting emails, credit card numbers, national identification numbers (BVN/NIN/SSN), and connection strings across both tool inputs and LLM outputs.\n- **Human-In-The-Loop (HITL) Cryptographic Approval Gates**: Intercepts high-risk operations (e.g., status changes, resource mutations) and generates HMAC-SHA256 approval tickets requiring explicit administrator clearance.\n- **OpenTelemetry Distributed Tracing**: Emits microsecond-resolution execution spans (`trace_id`, `span_id`, duration, token consumption, status codes) compatible with modern observability platforms.\n\n---\n\n## 🏗️ Architecture Overview\n\n```mermaid\ngraph TD\n    subgraph ClientLayer [Agent & Client Layer]\n        A[Claude Desktop / Cursor / Web Studio]\n    end\n\n    subgraph GatewayLayer [Nexus MCP Enterprise Gateway]\n        B[JSON-RPC 2.0 Protocol Dispatcher]\n        C[Sliding-Window Rate Limiter & Token Budget]\n        D[Hierarchical RBAC Policy Engine]\n        E[HITL Cryptographic Approval Gate]\n        F[Execution Sandbox & JSON Schema Validator]\n        G[PII & Sensitive Data Redaction Filter]\n        H[OpenTelemetry Trace Collector]\n    end\n\n    subgraph EnterpriseBackends [Enterprise Data Adapters]\n        I[(SQLite / SQL Production Assets)]\n        J[Financial & Cash-Call Reconciler]\n        K[Host SCADA / OS Telemetry]\n        L[Enterprise SOP & Policy Store]\n    end\n\n    A -->|JSON-RPC Request| B\n    B --> C\n    C --> D\n    D --> E\n    E --> F\n    F --> I & J & K & L\n    I & J & K & L --> G\n    G --> H\n    H -->|JSON-RPC Response| A\n```\n\n---\n\n## 🛡️ Enterprise Security & DLP Specifications\n\n### 1. Role-Based Access Control (RBAC) Matrix\n\n| Persona | Level | Permitted Operations | Restricted Capabilities |\n| :--- | :---: | :--- | :--- |\n| **ANALYST** | 10 | `sql_query` (Read-Only), `reconcile_cash_call`, `search_enterprise_docs` | Cannot execute destructive SQL, cannot access admin tools |\n| **AUDITOR** | 20 | All Analyst capabilities + Full trace telemetry inspection (`nexus/traces`) | Cannot approve HITL tickets |\n| **ADMIN** | 30 | All Analyst & Auditor capabilities + SQL mutations + `update_concession_status` | Must approve high-risk tickets |\n| **SUPERUSER** | 40 | System-level runtime configurations and gateway policy overrides | None |\n\n### 2. High-Precision DLP Redaction Engine\n\nAll inputs and responses pass through the `PIISanitizer` to enforce zero secret and identity leakage:\n\n| Target Category | Detection Method | Replacement Token |\n| :--- | :--- | :--- |\n| **Corporate Email Addresses** | RFC 5322 Regex Scan | `[REDACTED_EMAIL]` |\n| **Payment Cards (Visa/Mastercard)** | 16-digit bounded formatting | `[REDACTED_PAYMENT_CARD]` |\n| **National IDs & Banking Tokens** | 11-digit BVN/NIN & 9-digit SSN | `[REDACTED_NATIONAL_ID]` |\n| **Database Connection Strings** | Protocol schema patterns (`postgres://`, etc.) | `[REDACTED_CONNECTION_STRING]` |\n| **Bearer Tokens & API Keys** | Key entropy & assignment patterns | `[REDACTED_SECRET]` |\n\n---\n\n## ⚡ Algorithmic Complexity & Performance Metrics\n\n| Component | Algorithm / Mechanism | Time Complexity | Space Complexity |\n| :--- | :--- | :---: | :---: |\n| **Rate Limiter** | Sliding-Window deque eviction | $O(1)$ amortized | $O(W)$ per client |\n| **RBAC Evaluator** | Integer level hierarchy lookup | $O(1)$ | $O(1)$ |\n| **Approval Tickets** | HMAC-SHA256 digest hashing | $O(N)$ on params | $O(1)$ |\n| **DLP Sanitizer** | Precompiled DFA regular expressions | $O(M)$ on text length | $O(M)$ |\n| **Sandbox Execution** | Async timeout wrapping via `asyncio.wait_for` | $O(1)$ overhead | $O(1)$ |\n\n---\n\n## 🚀 Step-by-Step Setup & Execution\n\n### Prerequisites\n- Python 3.11+ (Fully verified on Python 3.14 on Windows & Linux)\n- Git\n\n### 1. Clone & Install Dependencies\n\n```powershell\n# Clone repository\ngit clone https://github.com/JayNabasu/nexus-mcp-enterprise-gateway.git\ncd nexus-mcp-enterprise-gateway\n\n# Install dependencies\npip install -r requirements.txt\n```\n\n### 2. Execute Automated Verification Suite\n\n```powershell\n# Run the complete test suite (21 unit & integration tests)\npython -m pytest tests/ -v\n```\n\n**Verified Test Output**:\n```text\n============================= test session starts =============================\nplatform win32 -- Python 3.14.4, pytest-9.1.0, pluggy-1.6.0\nrootdir: C:\\...\\nexus-mcp-enterprise-gateway\ncollected 21 items\n\ntests/test_adapters.py::test_sql_adapter_select PASSED                   [  4%]\ntests/test_adapters.py::test_sql_adapter_blocks_destructive_query PASSED [  9%]\ntests/test_adapters.py::test_sql_adapter_allows_admin_mutation PASSED    [ 14%]\ntests/test_adapters.py::test_financial_reconciliation_math PASSED        [ 19%]\ntests/test_adapters.py::test_system_telemetry PASSED                     [ 23%]\ntests/test_adapters.py::test_doc_adapter_search PASSED                   [ 28%]\ntests/test_protocol.py::test_jsonrpc_request_serialization PASSED        [ 33%]\ntests/test_protocol.py::test_jsonrpc_response_success PASSED             [ 38%]\ntests/test_protocol.py::test_jsonrpc_response_error PASSED               [ 42%]\ntests/test_protocol.py::test_tool_definition_model PASSED                [ 47%]\ntests/test_sandbox.py::test_sandbox_timeout PASSED                       [ 52%]\ntests/test_sandbox.py::test_sandbox_schema_validation PASSED             [ 57%]\ntests/test_security.py::test_rbac_hierarchy PASSED                       [ 61%]\ntests/test_security.py::test_pii_sanitization PASSED                     [ 66%]\ntests/test_security.py::test_pii_nested_dict_sanitization PASSED         [ 71%]\ntests/test_security.py::test_hitl_approval_gate_workflow PASSED          [ 76%]\ntests/test_server.py::test_server_initialize PASSED                      [ 80%]\ntests/test_server.py::test_tools_list_role_filtering PASSED              [ 85%]\ntests/test_server.py::test_tools_call_sql_query PASSED                   [ 90%]\ntests/test_server.py::test_tools_call_financial_reconciliation PASSED    [ 95%]\ntests/test_server.py::test_resources_and_prompts PASSED                  [100%]\n\n============================= 21 passed in 0.54s ==============================\n```\n\n### 3. Launch HTTP & Web Studio Mode\n\n```powershell\npython server_cli.py --mode http --port 8000\n```\nOpen `http://localhost:8000` in any browser to access the interactive **MCP Studio**.\n\n### 4. Launch STDIO Mode (For Claude Desktop / IDE Agents)\n\nConfigure in Claude Desktop or Antigravity configuration:\n```json\n{\n  \"mcpServers\": {\n    \"nexus-gateway\": {\n      \"command\": \"python\",\n      \"args\": [\"C:/path/to/nexus-mcp-enterprise-gateway/server_cli.py\", \"--mode\", \"stdio\"]\n    }\n  }\n}\n```\n\n---\n\n## 📡 MCP Protocol Reference Examples\n\n### `tools/call` Request Frame\n```json\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 101,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"reconcile_cash_call\",\n    \"arguments\": {\n      \"transaction_id\": \"INV-2026-042\",\n      \"gross_amount\": 1500000.0,\n      \"currency\": \"USD\",\n      \"vat_rate\": 7.5,\n      \"wht_rate\": 5.0\n    }\n  }\n}\n```\n\n### Response Frame with Cryptographic Audit Signature\n```json\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 101,\n  \"result\": {\n    \"content\": [\n      {\n        \"type\": \"text\",\n        \"text\": \"{\\n  \\\"transaction_id\\\": \\\"INV-2026-042\\\",\\n  \\\"gross_amount\\\": 1500000.0,\\n  \\\"computed_vat\\\": 112500.0,\\n  \\\"computed_wht\\\": 75000.0,\\n  \\\"net_payable\\\": 1537500.0,\\n  \\\"reconciliation_status\\\": \\\"BALANCED\\\"\\n}\"\n      }\n    ],\n    \"isError\": false,\n    \"metadata\": {\n      \"tool\": \"reconcile_cash_call\",\n      \"tokens\": 42\n    }\n  }\n}\n```\n\n---\n\n## 👨‍💻 Author & Engineering Standards\n\n- **Engineer**: [Jerry Nabasu](https://github.com/JayNabasu) (`jerrynabasu@gmail.com`)\n- **Standards**: Zero-Mock Policy, 100% automated test coverage, strict privacy anonymization.\n- **License**: MIT\n"}