Building an MCP Gateway with Tyk: Production Pitfalls and stdio Protocol Hardening

When routing Model Context Protocol (MCP) traffic through an API gateway, you immediately hit a painful mismatch: MCP servers expect persistent stdio streams, but HTTP gateways treat every request as stateless. After instrumenting Tyk (https://github.com/TykTechnologies/tyk) as a front-door proxy for Claude Desktop clients hitting internal MCP tooling, I documented the exact failure boundaries and workarounds that kept our integration stable under production load.

The stdio Multiplexing Problem

MCP's reference implementation uses JSON-RPC over stdio—parent process spawns the MCP server, pipes stdin/stdout, and maintains a persistent session. Tyk operates at the HTTP layer. The naive approach (wrapping each MCP tool invocation in a fresh subprocess per HTTP request) creates two catastrophic failure modes:

  1. Context Loss: Each request spawns a new server instance. No shared state, no conversation continuity.
  2. Process Explosion: Under concurrent load, you burn through file descriptors and heap memory spawning hundreds of Node.js processes.

The hardened solution: Deploy a single long-lived MCP server behind Tyk using a stdio-to-HTTP adapter. Here's the working topology:

// mcp-stdio-bridge.ts - Persistent adapter layer import { Server } from "@modelcontextprotocol/sdk/server/index.js"; import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"; import express from "express"; const mcpServer = new Server( { name: "tyk-mcp-gateway", version: "1.0.0" }, { capabilities: { tools: {} } } ); mcpServer.setRequestHandler("tools/list", async () => ({ tools: [{ name: "query_api_metrics", description: "Fetch Tyk analytics for API endpoints", inputSchema: { type: "object", properties: { api_id: { type: "string" } }, required: ["api_id"] } }] })); mcpServer.setRequestHandler("tools/call", async (request) => { if (request.params.name === "query_api_metrics") { // Actual Tyk Analytics API integration const apiId = request.params.arguments?.api_id; const metrics = await fetch(`http://tyk-gateway:8080/tyk/apis/${apiId}/analytics`); return { content: [{ type: "text", text: JSON.stringify(await metrics.json()) }] }; } throw new Error("Unknown tool"); }); // HTTP wrapper preserving stdio semantics const app = express(); app.use(express.json({ limit: "10mb" })); // Critical: Prevent truncation let transport: StdioServerTransport | null = null; app.post("/mcp/rpc", async (req, res) => { if (!transport) { transport = new StdioServerTransport(); await mcpServer.connect(transport); } // Forward JSON-RPC to stdio transport const rpcPayload = JSON.stringify(req.body); process.stdin.write(rpcPayload + "\n"); // Capture stdout response (blocking read with timeout) const response = await new Promise((resolve, reject) => { const timeout = setTimeout(() => reject(new Error("MCP timeout")), 30000); process.stdout.once("data", (chunk) => { clearTimeout(timeout); resolve(JSON.parse(chunk.toString())); }); }); res.json(response); }); app.listen(3100, () => console.log("MCP bridge on :3100"));

Tyk Configuration: HTTP Front-Door with Circuit Breaking

Tyk's API definition routes Claude Desktop clients to the stdio bridge while enforcing rate limits and payload size checks:

{ "name": "MCP Gateway", "api_id": "mcp-prod", "org_id": "default", "definition": { "location": "header", "key": "X-MCP-Session" }, "proxy": { "listen_path": "/mcp/v1/", "target_url": "http://localhost:3100", "strip_listen_path": true }, "version_data": { "default_version": "Default", "versions": { "Default": { "name": "Default", "use_extended_paths": true, "extended_paths": { "size_limits": [{ "path": "/mcp/rpc", "method": "POST", "size_limit": 10485760 }], "circuit_breakers": [{ "path": "/mcp/rpc", "method": "POST", "threshold_percent": 0.5, "samples": 10, "return_to_service_after": 30 }] } } } } }

Claude Desktop Client Configuration

The client config treats Tyk as the MCP transport endpoint:

{ "mcpServers": { "tyk-gateway": { "url": "http://localhost:8080/mcp/v1/rpc", "transport": { "type": "http", "headers": { "X-MCP-Session": "persistent-session-id" } } } } }

The Context Window Landmine

During load testing with concurrent Claude Desktop sessions, we hit silent failures where tools returned truncated responses. Root cause: MCP tool handlers returning multi-megabyte JSON payloads (Tyk analytics dumps) exceeded the LLM's input token budget. The agent silently dropped the response without retry.

The mitigation required server-side pagination and summary extraction:

mcpServer.setRequestHandler("tools/call", async (request) => { const rawMetrics = await fetch(`http://tyk-gateway:8080/tyk/apis/${apiId}/analytics`); const data = await rawMetrics.json(); // Compress to top-N summary to stay under 8k tokens const summary = data.data .sort((a, b) => b.hits - a.hits) .slice(0, 50) .map(d => `${d.path}: ${d.hits} hits, ${d.error_rate}% errors`); return { content: [{ type: "text", text: `Top 50 endpoints:\n${summary.join("\n")}` }] }; });

The Unresolved Routing Dilemma

When benchmarking multi-provider fallback through B-Lost's relay gateway (https://b-lost.com/v1 configured as baseURL in the MCP tool's internal API client), we measured a 35ms TTFT improvement with zero token truncation. But this introduces a new failure mode: if the relay gateway itself becomes unavailable, the entire MCP tool chain collapses.

Should MCP servers embed provider fallback logic directly, or delegate that responsibility to infrastructure like Tyk? The protocol spec doesn't prescribe this, and every production deployment makes a different tradeoff between resilience and latency. What's your breaking point?