Skip to content
Documentation
MCP proxy
Overview

Overview

The MCP catch-all route is server/routes/mcp/[...].ts. It speaks JSON-RPC to clients (initialize, notifications, tools/list, tools/call, …), authenticates the proxy key, loads agent and member state, selects the connector adapter, and for tool calls runs evaluateToolCallAndAudit before contacting the upstream MCP base URL.

  • Streaming — responses may be streamed to the client when the upstream uses streaming semantics.
  • Timeouts — configurable per-service and global upstream limits (see server/routes/mcp/[...].ts and getUpstreamTimeoutMs).
  • Client identity — initialize client metadata can be captured for session analytics (informational; not used as the sole access-control gate).

The dashboard-only mock path POST /api/mcp/mock-call uses the session cookie and MFA state instead of Bearer keys.

Request flow