Originally published on proxymint.
What an MCP proxy server does: stdio to HTTP bridges, aggregators and gateways, what the 2026-07-28 spec changed for them, security risks and web egress.
TL;DR
- An MCP proxy server speaks MCP on both sides. It acts as a server to the client and as a client to one or more MCP servers, so it can bridge transports, merge servers behind one endpoint and enforce policy on tool calls.
- Three different things share the name. A transport bridge, an aggregator or gateway, and a network proxy under a tool server that fetches the web. Only the last one changes what a website sees.
- The 2026-07-28 MCP revision rewrote the intermediary's job. Sessions are gone, every POST carries an Mcp-Method header, tool calls add Mcp-Name, and a header that disagrees with the body is rejected with error -32020.
- The spec names MCP proxy servers in its threat list. Confused deputy, token passthrough and stdio spawn escalation all apply to a proxy that holds credentials or launches servers.
Key takeaways
- Pick the layer before the project. A stdio-only client needs a bridge, several servers need an aggregator, per-user audit needs a gateway, and a blocked fetch tool needs a network proxy on that server.
- Never forward a client's token downstream. Give each downstream server a credential issued to the proxy, and stop the client's token at the proxy.
- Rewrite headers and body together. Since 2026-07-28 a proxy that renames tools must change Mcp-Name and the body in the same step, or servers reject the call.
- Scope network proxies to the tool server. Set the proxy in that server's flags or env block, keep credentials out of the model's context, and use http:// or socks5:// to the proxy.
- Keep bridges on localhost behind an authenticating reverse proxy. Binding a spawning proxy to 0.0.0.0 hands its tools to anyone who can reach the port.
Read the full guide on proxymint, with the commands, tables and sources.
Top comments (0)