You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We currently have multiple MCP servers that use different authorization methods.
In this scenario, we have two MCP servers — let’s call them MCP-A and MCP-B.
Each server uses its own token, which we configure in the headers as X-MCPA and X-MCPB.
In the gateway, I can use Header Passthrough to forward the token (e.g., X-WHATEVER) from the client to the corresponding server.
The issue arises when I try to distribute this setup to all users. Ideally, they should be able to use the MCP Gateway as a proxy, without needing to configure each MCP server individually.
However, when I try to run the Gateway with AUTH_REQUIRED = False and remove BASIC_AUTH_USER and BASIC_AUTH_PASS, nothing changes — the gateway still expects at least one type of authentication.
Is it possible to delegate the security handling to the MCP servers themselves?
I understand this isn’t the most secure setup, but it would only be a temporary solution until we have everything properly configured.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
We currently have multiple MCP servers that use different authorization methods.
In this scenario, we have two MCP servers — let’s call them MCP-A and MCP-B.
Each server uses its own token, which we configure in the headers as X-MCPA and X-MCPB.
In the gateway, I can use Header Passthrough to forward the token (e.g., X-WHATEVER) from the client to the corresponding server.
The issue arises when I try to distribute this setup to all users. Ideally, they should be able to use the MCP Gateway as a proxy, without needing to configure each MCP server individually.
However, when I try to run the Gateway with AUTH_REQUIRED = False and remove BASIC_AUTH_USER and BASIC_AUTH_PASS, nothing changes — the gateway still expects at least one type of authentication.
Is it possible to delegate the security handling to the MCP servers themselves?
I understand this isn’t the most secure setup, but it would only be a temporary solution until we have everything properly configured.
Thanks in advance for your help!
Beta Was this translation helpful? Give feedback.
All reactions