التشغيل خلف وكيل عكسي

A reverse proxy sits in front of your server, taking requests from the internet and quietly forwarding them to your MCP process. 🔀

Your MCP server should focus on logic, not the messy public edge. A proxy handles TLS, routing, and shielding so your code stays simple.

The proxy decrypts incoming HTTPS and speaks plain HTTP to your server inside. This TLS termination keeps certificates in one place.

Nginx is a popular, battle-tested reverse proxy. A small config block is enough to route public traffic to your MCP container.

The key directive is proxy_pass, which points the proxy at your server's internal address and port.

Forward headers like Host and the client's real IP so your server sees accurate request info, not just the proxy itself.

MCP can stream replies, so disable response buffering for the endpoint. Otherwise the proxy holds events back until the call ends.

One proxy can serve many apps. Match on a path like /mcp or a hostname to send each request to the right backend.

With a proxy, clients only ever see port 443. Your real server port stays private on the internal network, never exposed directly.

The proxy is a natural spot for rate limits and request size caps, giving your MCP server a first line of defense. 🛡️

Edge concerns live in the proxy; business logic lives in your server. That separation makes both far easier to reason about and change.

What is the main job of TLS termination at the reverse proxy?

A reverse proxy like Nginx fronts your server: it terminates TLS, forwards requests with proxy_pass, and keeps your backend port private. 🔒