Running behind a Reverse Proxy

MCP Express does not terminate TLS or serve custom domains itself. Put a reverse proxy in front of it to serve AI applications over HTTPS.

Note

These examples assume MCP Express is running on port 3000.

Nginx

Replace mcp.example.com with your domain:

server {
    server_name mcp.example.com;

    # Code zips are capped at 20 MB by the app; leave headroom.
    client_max_body_size 25m;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;

        # MCP Express builds endpoint URLs and redirects from these headers.
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header Connection        "";

        # MCP streams responses (server-sent events): disable buffering
        # and keep long-lived connections open.
        proxy_buffering    off;
        proxy_cache        off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

Caution

Keep the X-Forwarded-* headers and proxy_buffering off. Without them, MCP Express generates incorrect URLs and streaming responses stall.

For HTTPS, add a TLS certificate (for example with Certbot). See the Nginx guide for general setup.