RavensPort is a reverse proxy tool designed to manage OAuth2 authentication and API key handling for upstream services, enabling developers to create filtered MCP endpoints for AI agents. It allows users to compose multiple upstreams into per-agent toolsets while securely managing credentials in a password manager.
Key Features:
OAuth2 and API Key Management: Attach credentials to requests via headers or request bodies, with automatic token refresh.
MCP Funneling: Combine multiple MCP servers into one endpoint, exposing only selected tools, resources, and prompts per agent.
API-to-MCP Bridging: Convert APIs into MCP endpoints using JSON manifests, enabling models to interact with non-MCP services.
Password Manager Integration: Store all secrets in 1Password or Proton Pass, with no local cache, ensuring security and ease of use.
Per-Endpoint Proxy Keys: Assign unique keys with individual expiries to each route and funnel for enhanced security.
Target Audience and Benefits:
Ideal for developers and IT professionals managing AI agents and API access. RavensPort simplifies secure authentication, provides granular control over toolsets, and integrates seamlessly with existing tools like 1Password and Proton Pass. It supports both OAuth2 and static API keys while ensuring no credentials are stored locally.
Available via Winget, making deployment straightforward for organizations focused on security and scalability.
README
RavensPort
Give each AI agent its own MCP endpoint — pooling the servers you choose, exposing only the
tools you allow, with OAuth handled for you.
winget and the installer give you the full app. The Store build has no Proton Pass and no
mTLS — why.
A tray-resident Windows app that runs a local reverse proxy on 127.0.0.1. It owns the OAuth2
flow and token lifecycle for upstream APIs and MCP servers, then lets you compose those servers
into filtered, per-agent MCP endpoints.
What it does
MCP Funnel — per-agent endpoints pooling several MCP servers, with per-tool filtering
API to MCP — turn an API you already proxy into an MCP endpoint from a JSON manifest, or
import an OpenAPI document and pick which of its operations become tools
OAuth2, handled — Google, GitHub, Nextcloud or any custom provider; device-code sign-in;
client-credentials and Google service accounts for logins with nobody at the keyboard; static
API keys for the services that never offered OAuth. Tokens refresh in the background
Secrets stay in your password manager — 1Password or Proton Pass holds every credential,
and nothing is written to this PC
A proxy key per endpoint — every route, funnel and bridge has its own, so a key leaked from
one client cannot reach the rest. Optionally require a client certificate as well
Install
winget install RavensPort
Or take the installer from Releases, or the
Microsoft Store. Windows 10/11. Full
instructions, including building from source, are in
Installation.
MIT — see LICENSE. Third-party dependencies (all MIT or Apache-2.0) are listed in
THIRD-PARTY-NOTICES.md, which also covers what redistributing the
published exe requires.
