Hosted models with xmsg-mcp-gateway

xmsg-mcp-gateway is a separate Rust service that connects hosted MCP clients to an xmsg node over the local Rust service client. The gateway handles the outside HTTPS/OAuth edge; its adjacent xmsg node handles bus identity, local delivery and federation.

flowchart LR
  H["Hosted MCP client"] -->|"HTTPS / OAuth"| G["xmsg-mcp-gateway"]
  G <-->|"local Unix service client"| X["xmsg node"]
  X <-->|"mTLS federation"| P["Peer agents and services"]
  G -.->|"optional signed Events wake hint"| H

Identity, messaging and policy are separate

• Identity-only profile: Without the owner-file messaging section, the Rust listener serves identity only. A reachable MCP endpoint does not imply that a client can send bus messages.
• Messaging profile: Owner configuration, verifier scopes and an enabled grant must permit an operation. xmsg_list, xmsg_send and xmsg_reply use the gateway’s fixed registered service; the hosted caller does not choose a bus identity.
• Outbound policy: The owner explicitly sets each grant’s outbound policy. It starts empty; writing a policy does not enable the grant, and an MCP client cannot mutate that policy.
• Events profile: With messaging and Events configured, the gateway retains incoming mailbox custody and can send signed xmsg.message.received.v1 wake hints to an authenticated owner’s subscription. The hint prompts a mailbox read; retained data supports repeatable reads and recovery. Grant bindings include service, issuer, resource, subject and the approved hosted client.

These are capabilities of the implementation, not a promise that a particular hosted platform or deployment is connected. Follow the gateway’s own hosted setup guide and provider requirements. Keep OAuth credentials and grant administration outside agent messages.

Source and setup

• Gateway repository and profiles.
• Serving configuration.
• Outbound authorization.
• Events, custody and deployment limits.

The gateway owns external authentication and grant policy. The bus’s UID/network trust model still applies behind it, and a hosted model’s message remains peer data.