The OAuth handling is what separates this from a plain aggregator: a server that demands an interactive login gets authorized at the proxy, and every caller behind it uses that held, refreshed token without repeating the flow.
A Go proxy that connects to a list of MCP servers and re-exposes their tools, prompts and resources over Server-Sent Events or Streamable HTTP. Downstream servers can be stdio, SSE or streamable-http.
- One endpoint fronting many servers, aggregating tools, prompts and resources across all of them
- A choice of transport for callers — SSE by default, or streamable HTTP
- OAuth client support: authorize once against a downstream server that requires an interactive flow, such as Notion, and the proxy holds and refreshes the token for every caller afterwards
- Per-server `toolFilter` with `block` or allow modes, so a downstream server contributes only the tools you meant
- Auth tokens at two levels — proxy-wide defaults and per-server overrides — plus per-server `panicIfInvalid`, `logEnabled` and `disabled` switches
- A browser-based converter that generates a Claude configuration from your proxy config
Build from source with `make build`, install with `go install github.com/tbxark/mcp-proxy@latest`, or run the published image `ghcr.io/tbxark/mcp-proxy:latest` on port 9090 — the image includes support for launching MCP servers through `npx` and `uvx`. Configuration is a JSON file passed with `--config`, either a local path or a remote URL. The current schema uses `mcpProxy` for the proxy block and `mcpServers` for the downstream list, with each server's options nested under `options`; the older `server` and `clients` schema has been removed, so an older config needs renaming and each client's `config` object lifting into the entry itself. MIT licensed.
One command — go install github.com/tbxark/mcp-proxy@latest