Switchboard: one curated MCP endpoint for agents

Every useful self-hosted service eventually grows an MCP interface, and every agent client then needs its own URL, credential, and trust decision for each one. That scales badly, and it tends to hand agents far more tools than a given job needs. Switchboard is a capability gateway: one identity-aware endpoint in front of a curated set of upstream services.

Composition, not a second source of truth

Capabilities are declared in manifests: REST APIs, remote MCP servers, or small local modules. Profiles group them, and exact tool policies decide which tools a caller can see; anything not named is denied. Agents can discover the approved catalog and activate capabilities as they need them instead of loading every schema up front.

Switchboard deliberately does not take over the upstream applications' jobs. A DNS change, a publication, or a destructive operation still goes through that service's own plan, confirmation, and rollback workflow, and each service remains authoritative for its data, authorization, and audit records. Switchboard authenticates the caller, selects the permitted tools, and forwards the call.

Identity and egress boundaries

The session endpoint authenticates people through OAuth/OIDC or Cloudflare Access, mapping verified subjects and groups to profiles and policies. Workload identities, such as unattended agents, get their own exact policy subjects and cannot inherit a human group's access. Sessions fail closed when no policy matches, and a permissions command reports, lints, explains, and diffs effective access without changing it.

Outbound traffic is constrained by a mandatory egress policy of exact destinations and CIDRs. Switchboard validates resolved addresses and dials them directly to resist DNS rebinding, and TLS verification cannot be disabled for upstream MCP connections. Upstream credentials come from the process environment, never from manifests, and audit events record who called which tool without storing arguments, results, or error text.

It is the front door for the rest of the agent tooling: Wayminder, Rendercase, Taskboard, and Dockgate each keep their own security model, and an agent session reaches whichever of them it is allowed to through a single connection.

Source and documentation: github.com/kilo666mj/switchboard.