MCP API

A scalable HTTP API for Model Context Protocol (MCP) servers with secure secret management.

Overview

MCP API addresses a critical limitation in the current MCP server ecosystem: most MCP servers are designed for single-user usage, with secrets (API keys, passwords) stored directly in environment variables. This project enhances security and scalability by:

1. Exposing MCP servers via a unified HTTP API
2. Abstracting secret handling through secure encryption
3. Supporting multi-user access to the same MCP server instances
4. Providing package management for easy installation and configuration of MCP servers

Instead of embedding sensitive credentials in environment variables, MCP API stores them encrypted in MongoDB and retrieves/decrypts them as needed for specific tool operations.

Features

• Multi-user Support: Multiple users can access the same MCP server instances with their own credentials
• Secure Secret Management: All sensitive information is stored encrypted in MongoDB
• User-specific Secret Storage: Each user's secrets are isolated and encrypted separately
• Package Management: Simplified installation and configuration of MCP server packages
• HTTP API: Simple REST API for accessing MCP tools and managing secrets
• Streamable HTTP Transport: First-class support for streamable_http MCP servers with optional SSE fallback
• Session Persistence: HTTP session IDs are persisted and resumed across process restarts
• OAuth Token Refresh: Streamable HTTP servers can refresh OAuth tokens automatically via stored refresh tokens
• Containerized Deployment: Docker and Docker Compose support for easy deployment

Architecture

MCP API acts as a proxy between clients and MCP servers:

1. Client Requests: Applications send requests to the HTTP API
2. Secret Management: The API retrieves and decrypts user-specific secrets as needed
3. Package Management: The API handles installation, configuration, and lifecycle of MCP server packages
4. Transport Selection: Each server uses either stdio or Streamable HTTP transport based on configuration
5. MCP Server Communication: The API communicates with MCP servers using the Model Context Protocol
6. Response Handling: Results from MCP servers are returned to clients

The system uses AES-256-GCM encryption for all stored secrets, with a separate encryption key for each deployment.

Installation

Prerequisites

• Node.js 20 or higher
• MongoDB
• MCP server implementations you wish to expose

Setup

1. Clone the repository:

   git clone https://github.com/missionsquad/mcp-api.git
   cd mcp-api
   

2. Install dependencies:

   yarn install
   

3. Create a .env file based on the example:

   cp example.env .env
   

4. Configure your environment variables:

   PORT=8080
   MONGO_USER=username
   MONGO_PASS=password
   MONGO_HOST=localhost:27017
   MONGO_DBNAME=mcp
   SECRETS_KEY=your-random-key
   SECRETS_DBNAME=secrets
   PYTHON_BIN=/usr/bin/python3
   PYTHON_VENV_DIR=packages/python
   PIP_INDEX_URL=
   PIP_EXTRA_INDEX_URL=
   

   The optional Comms Management service-HMAC profile uses one additional environment variable:

   MSQ_COMMS_MCP_HMAC_KEY_FILE=/absolute/path/to/a/mounted/keyring.json