MCPProxy
smart-mcp-proxyLABSCO SUMMARY
Authorize the downstream server once, then let everything reach it.
The OAuth handling is what separates this from a plain aggregator: a server that demands an interactive login gets authorized at the proxy, and every caller behind it uses that held, refreshed token without repeating the flow.
What it is
A Go proxy that connects to a list of MCP servers and re-exposes their tools, prompts and resources over Server-Sent Events or Streamable HTTP. Downstream servers can be stdio, SSE or streamable-http.
What you get
- One endpoint fronting many servers, aggregating tools, prompts and resources across all of them
- A choice of transport for callers — SSE by default, or streamable HTTP
- OAuth client support: authorize once against a downstream server that requires an interactive flow, such as Notion, and the proxy holds and refreshes the token for every caller afterwards
- Per-server
toolFilterwithblockor allow modes, so a downstream server contributes only the tools you meant - Auth tokens at two levels — proxy-wide defaults and per-server overrides — plus per-server
panicIfInvalid,logEnabledanddisabledswitches - A browser-based converter that generates a Claude configuration from your proxy config
Requirements
Build from source with make build, install with go install github.com/tbxark/mcp-proxy@latest, or run the published image ghcr.io/tbxark/mcp-proxy:latest on port 9090 — the image includes support for launching MCP servers through npx and uvx. Configuration is a JSON file passed with --config, either a local path or a remote URL. The current schema uses mcpProxy for the proxy block and mcpServers for the downstream list, with each server's options nested under options; the older server and clients schema has been removed, so an older config needs renaming and each client's config object lifting into the entry itself. MIT licensed.
Setup effort
Follow the published steps — go install github.com/tbxark/mcp-proxy@latest
USE CASES
01
Giving several clients the same set of servers
Point them all at one endpoint instead of duplicating a server list in every client configuration.
02
Reaching a server that requires interactive OAuth
Authorize once at the proxy; the token is held and refreshed, so clients that could not run the flow themselves still get through.
03
Removing a dangerous tool from a server you did not write
Set a block-mode tool filter naming it, and it is not aggregated into the endpoint at all.
04
Running stdio servers somewhere other than the client machine
The Docker image can launch npx and uvx servers itself, so the client only ever speaks HTTP.
05
Scoping access per server
Give one downstream server its own auth token distinct from the proxy default, so a caller with the general token cannot reach it.
BEFORE YOU INSTALL
What to know first
Requires
Go (for go install)
INSTALLATION
Connect your client
Server setup
TERMINAL
go install github.com/tbxark/mcp-proxy@latestWrite a config.json: an mcpProxy block (baseURL, addr ":9090", type "sse" or "streamable-http") and, under mcpServers, the servers to aggregate, each written the way a client config writes it. The full reference is docs/CONFIGURATION.md.
TERMINAL
mcp-proxy --config <YOUR_PATH_TO_CONFIG>Point your client at the proxy's URL for each server: with mcpProxy.baseURL <YOUR_SERVER_URL> and a server key fetch, that is <YOUR_SERVER_URL>/fetch/sse (type sse) or <YOUR_SERVER_URL>/fetch/mcp (type streamable-http). The project's configuration converter builds a Claude configuration from your proxy config.
