Originally published on proxymint.

What an MCP proxy server does: stdio to HTTP bridges, aggregators and gateways, what the 2026-07-28 spec changed for them, security risks and web egress.

TL;DR

  • An MCP proxy server speaks MCP on both sides. It acts as a server to the client and as a client to one or more MCP servers, so it can bridge transports, merge servers behind one endpoint and enforce policy on tool calls.
  • Three different things share the name. A transport bridge, an aggregator or gateway, and a network proxy under a tool server that fetches the web. Only the last one changes what a website sees.
  • The 2026-07-28 MCP revision rewrote the intermediary's job. Sessions are gone, every POST carries an Mcp-Method header, tool calls add Mcp-Name, and a header that disagrees with the body is rejected with error -32020.
  • The spec names MCP proxy servers in its threat list. Confused deputy, token passthrough and stdio spawn escalation all apply to a proxy that holds credentials or launches servers.

Key takeaways

  • Pick the layer before the project. A stdio-only client needs a bridge, several servers need an aggregator, per-user audit needs a gateway, and a blocked fetch tool needs a network proxy on that server.
  • Never forward a client's token downstream. Give each downstream server a credential issued to the proxy, and stop the client's token at the proxy.
  • Rewrite headers and body together. Since 2026-07-28 a proxy that renames tools must change Mcp-Name and the body in the same step, or servers reject the call.
  • Scope network proxies to the tool server. Set the proxy in that server's flags or env block, keep credentials out of the model's context, and use http:// or socks5:// to the proxy.
  • Keep bridges on localhost behind an authenticating reverse proxy. Binding a spawning proxy to 0.0.0.0 hands its tools to anyone who can reach the port.

Read the full guide on proxymint, with the commands, tables and sources.