peta-core

Peta Core acts as a gateway, vault, policy engine, and audit runtime for MCP-based tool calls. It sits between MCP clients (such as Claude, ChatGPT, Cursor, or other MCP-compatible clients) and downstream MCP servers, routing calls with per-user and per-tool RBAC/ABAC policies, injecting credentials on the server side, and logging detailed audit trails. Use Peta Core to centralize authentication (OAuth2), control which tools users can access, pause and approve high-risk actions, and ensure credentials never leave the vault in plaintext. The REST API adapter lets you expose HTTP endpoints as MCP servers, so you can connect existing HTTP services into the MCP ecosystem without implementing a new MCP server.

Prerequisites:

• Node.js >= 18
• npm or pnpm
• PostgreSQL 15+ for metadata and audit storage

1. Install prerequisites

• Ensure PostgreSQL is up and running and accessible
• Have a Redis instance if you plan to use caching

2. Clone the repository

• git clone https://github.com/dunialabs/peta-core.git
• cd peta-core

3. Install dependencies

• npm install

4. Build the project (if applicable)

• npm run build

5. Configure environment

• Create a .env file (examples below) or set env vars in your deployment environment

Example .env: PORT=3000 NODE_ENV=production DATABASE_URL=postgresql://user:password@host:5432/dbname REDIS_URL=redis://host:6379/0 OAUTH2_CLIENT_ID=your-client-id OAUTH2_CLIENT_SECRET=your-client-secret VAULT_ENCRYPTION_KEY=your-crypto-key

6. Run the server

• npm run start
• or
• node dist/server.js

7. Optional: Deploy with PM2 or Docker (see docs/deployment.md in the repo for details)

Notes:

• The gateway supports OAuth 2.0 for client authorization, token introspection, and revocation. Ensure your OAuth provider is configured and the client IDs/secrets are correctly set in the environment.
• Secrets are only injected server-side; avoid exposing vault credentials in client configurations.
• Audit logs do not include secret payloads; ensure log transport is secured and compliant with your policy.
• If you enable human-in-the-loop approvals, expect approval prompts to appear via the real-time notification channel (Socket.IO) and handle them in your admin UI or workflow.
• For reliability, configure health checks and automatic recovery as described in the deployment docs; downstream timeouts trigger reconnection logic and request retries.
• Use the REST API adapter to quickly expose non-MCP HTTP services as MCP endpoints without implementing a custom MCP server.