Configure Rate Limiting

Throttle MCP traffic with per-user, per-server, and global rate limits to prevent abuse and protect upstreams.

Golf Gateway rate limits MCP traffic using a Redis-backed sliding window. Limits are enforced in layers — per-user, per-server, and system-wide — so you can protect individual upstreams and the gateway as a whole from abuse or runaway clients.

Prerequisites

• Golf Gateway deployed and running
• Redis configured

How it works

Each request is checked against the limits in order, from most specific to most general:

1. Per-user — requests per window for a single authenticated user. Anonymous requests fall back to a per-IP limit using the same threshold.
2. Per-server — requests per window for a single user against a specific MCP server.
3. Global — system-wide requests per window across all users.

The first limit that is exceeded stops the request. Each layer uses the same sliding-window algorithm over the configured window_seconds.

Rate limiting fails open: if Redis is unavailable, requests are allowed through rather than blocked, so a cache outage never takes down your gateway.

Configure the per-user limit

The per-user limit is the only limit configurable via environment variables or YAML. Set it with the GOLF_RATE_LIMIT_ variables:

GOLF_RATE_LIMIT_ENABLED=true
GOLF_RATE_LIMIT_REQUESTS_PER_MINUTE=1000   # per-user limit, range 1-5000
GOLF_RATE_LIMIT_WINDOW_SECONDS=60          # sliding window, range 10-300

Or in YAML (Distributed mode), under the security section:

golf-gateway.yaml

security:
  rate_limiting:
    enabled: true
    requests_per_minute: 1000
    window_seconds: 60

Setting	Env Variable	Default	Range	Description
enabled	GOLF_RATE_LIMIT_ENABLED	true	-	Enable rate limiting
requests_per_minute	GOLF_RATE_LIMIT_REQUESTS_PER_MINUTE	1000	1-5000	Per-user (and per-IP fallback) limit
window_seconds	GOLF_RATE_LIMIT_WINDOW_SECONDS	60	10-300	Sliding window duration

Global and per-server limits

System-wide (global) and per-server limits are managed through the Control Plane in Centralized mode — they are not configurable via environment variables or YAML. Their defaults are:

Limit	Default	Configured via
Per-user	1000 req/window	Env var, YAML, or Control Plane
Per-server	500 req/window	Control Plane only
Global	1000 req/window	Control Plane only

All three limits share the same window_seconds. The window is always read from the environment and is not overridden by Control Plane configuration.

Related guides

• Set Up Metrics and Monitoring - Monitor gateway health
• Set Up Alerting - Alert on anomalies
• Environment Variables - Full configuration reference
• YAML Config Schema - Distributed mode configuration