IBM ContextForge MCP Gateway - Consensus

ContextForge (mcp-context-forge) is IBM’s open-source MCP gateway and registry. Register Consensus from the Admin UI’s Gateways/MCP Servers tab or with the REST API.

Shared API key

curl -s -X POST "$GATEWAY/gateways" \
  -H "Authorization: Bearer $MCPGATEWAY_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "consensus",
    "url": "https://mcp.consensus.app/mcp",
    "transport": "STREAMABLEHTTP",
    "auth_type": "bearer",
    "auth_token": "ak_live_..."
  }'

MCPGATEWAY_BEARER_TOKEN is your ContextForge admin JWT, not the Consensus key.

Per-user OAuth

ContextForge implements Dynamic Client Registration and enables PKCE automatically for authorization-code flows:

{
  "name": "consensus",
  "url": "https://mcp.consensus.app/mcp",
  "transport": "STREAMABLEHTTP",
  "auth_type": "oauth",
  "oauth_config": {
    "grant_type": "authorization_code",
    "authorization_url": "https://consensus.app/oauth/authorize/",
    "token_url": "https://consensus.app/oauth/token/",
    "redirect_uri": "https://<your-gateway>/oauth/callback",
    "scopes": ["search"]
  }
}

Supply client_id and client_secret only if you’ve obtained a confidential client from Consensus; otherwise let the gateway register itself.

Notes

Callers can pass their own Consensus token in X-Upstream-Authorization; forwarding the plain Authorization header requires ENABLE_SENSITIVE_HEADER_PASSTHROUGH.
The transport value is case-insensitive in recent builds; check your instance’s /docs OpenAPI if STREAMABLEHTTP is rejected.

IBM docs: ContextForge on GitHub · OAuth guide