Run Behind a Reverse Proxy
Terminate TLS and route HTTP to your server.
Run Behind a Reverse Proxy is a free MCP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MCP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What a Reverse Proxy Is
A reverse proxy sits in front of your server, taking requests from the internet and quietly forwarding them to your MCP process. 🔀
Why Put One in Front
Your MCP server should focus on logic, not the messy public edge. A proxy handles TLS, routing, and shielding so your code stays simple.
Terminate TLS at the Edge
The proxy decrypts incoming HTTPS and speaks plain HTTP to your server inside. This TLS termination keeps certificates in one place.
Nginx Is a Common Choice
Nginx is a popular, battle-tested reverse proxy. A small config block is enough to route public traffic to your MCP container.
Forward to Your Server
The key directive is proxy_pass, which points the proxy at your server's internal address and port.
location /mcp {
proxy_pass http://127.0.0.1:8000;
}Pass Through the Right Headers
Forward headers like Host and the client's real IP so your server sees accurate request info, not just the proxy itself.
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;Keep Streaming Alive
MCP can stream replies, so disable response buffering for the endpoint. Otherwise the proxy holds events back until the call ends.
proxy_buffering off;Route by Path or Host
One proxy can serve many apps. Match on a path like /mcp or a hostname to send each request to the right backend.
Hide Your Backend Port
With a proxy, clients only ever see port 443. Your real server port stays private on the internal network, never exposed directly.
Add a Layer of Safety
The proxy is a natural spot for rate limits and request size caps, giving your MCP server a first line of defense. 🛡️
A Clean Separation
Edge concerns live in the proxy; business logic lives in your server. That separation makes both far easier to reason about and change.
Quick Check
What is the main job of TLS termination at the reverse proxy?
Recap: Reverse Proxy
A reverse proxy like Nginx fronts your server: it terminates TLS, forwards requests with proxy_pass, and keeps your backend port private. 🔒
Frequently asked questions
Is the “Run Behind a Reverse Proxy” lesson free?
Yes — the full text of “Run Behind a Reverse Proxy” is free to read here on the web, and the MCP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MCP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Run Behind a Reverse Proxy”?
Terminate TLS and route HTTP to your server. You practise MCP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MCP Academy?
No prior experience is required. MCP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Run Behind a Reverse Proxy” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MCP Academy lesson?
Yes. Every MCP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Package the Server in Docker
- Run Behind a Reverse Proxy
- Health Checks & Restarts
- Connect Remote Clients