ContextForge MCP Gateway - Hardened MCP Proxy

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## ContextForge MCP Gateway - Secure, Self-Hosted MCP Proxy

Stop wiring each AI assistant to each MCP server by hand. ContextForge MCP Gateway federates your entire Model Context Protocol tool estate behind a single authenticated endpoint, giving your agents one controlled front door to every tool they need. This pre-hardened AMI delivers the gateway fully installed and secured in your own AWS account, exposed over TLS through a browser-based admin UI you run and control.

This is a repackaged open source software product (IBM's ContextForge MCP Gateway) with additional charges for cloudimg support services.

## Why This AMI vs a Manual Install

A manual deployment requires building a Python virtual environment, pinning dependencies, authoring a systemd unit, configuring a TLS reverse proxy, and rotating every default secret by hand. Upstream ships known default credentials and a known default signing secret, leaving a hand-rolled deployment exposed until every secret is manually rotated.

This AMI completes every build and hardening step at image creation time:

• Generates a unique administrator password, JWT signing secret, and encryption secret on each instance's first boot
• Mints a per-instance TLS certificate so no shared private key is baked into the image
• Binds the gateway and datastore exclusively to loopback
• Fronts the UI with an nginx TLS reverse proxy on port 443
• Bundles the official MCP time server, federated automatically, so a working proxied tool call is available the moment the instance is up

## Application Stack

The gateway is installed from the official upstream release (pip mcp-contextforge-gateway, pinned) into a Python virtual environment at /opt/mcpgateway, running as an unprivileged system user under a hardened systemd unit bound to 127.0.0.1:4444. Nginx terminates TLS on port 443 and forwards to the gateway; port 80 redirects to 443. The registry, tools, virtual servers, users, and tokens are held in a local SQLite datastore - no external database required. systemd starts the gateway, the bundled server, and nginx on boot and restarts them on failure.

## Security Hardening

• No default or shared credentials: random administrator password, JWT signing secret, and encryption secret generated per instance at first boot
• Authentication required: admin UI and gateway API refuse unauthenticated requests
• Network isolation: gateway and bundled MCP server bind exclusively to loopback; only nginx is exposed
• Per-instance TLS: each instance mints its own certificate on first boot
• Least privilege: gateway runs as an unprivileged system user with SSRF protection enabled

## Concrete Use Cases

• One front door for an agent's tools: Point every AI assistant at a single authenticated gateway instead of wiring each one to each MCP server, and control which tools are exposed from one admin console
• Governed MCP tool estate: Keep your Model Context Protocol servers and their auth entirely inside your own AWS account, behind one controlled endpoint with a registry and per-instance credentials
• Virtual servers for a use case: Compose a virtual MCP server from a curated set of tools drawn across several backend servers, and hand that single endpoint to a downstream agent

## AWS Integration

Deploy on any EC2 instance type. Front the gateway with your own DNS name and certificate by replacing the per-instance self-signed one. Restrict the security group so port 443 is reachable only from the agents and clients that need it. Back up the SQLite datastore with EBS snapshots of the OS volume or integrate with AWS Backup.

## Getting Started

1. Launch the AMI and wait for first-boot initialization to complete

2. Read your unique admin credential from the root-only file on the instance

3. Open the admin UI over HTTPS and sign in as the administrator

4. Explore the bundled reference MCP server and its federated tools

5. Register your own MCP servers, compose virtual servers, and mint API tokens for your agents

For a guided deployment walkthrough or to request a federation demo, contact cloudimg support at any time.

## Support

24/7 technical support by email and live chat from cloudimg. Help with deployment, TLS termination with your own domain, federating your own MCP servers, and backup planning for your gateway datastore.