MCP Proxy
Workers never hold real credentials. The gateway resolves them at request time and proxies every outbound MCP call.
Request flow
Section titled “Request flow”- Worker sends a JSON-RPC request to the gateway proxy.
- Gateway authenticates the worker JWT, extracts
agentId/userId. - Looks up credentials for that user — auto-refreshes expired tokens.
- Injects the
Authorization: Bearer <token>header, forwards to the upstream MCP. - Response flows back to the worker.
Workers call tools/list and tools/call — credential handling is invisible.
Authentication methods
Section titled “Authentication methods”| Method | Config | Use case |
|---|---|---|
| Static headers | headers | API keys, service tokens — no per-user auth |
| Device-code OAuth | oauth | Per-user OAuth — each user authenticates in browser |
| Lobu-managed | N/A | Third-party APIs (GitHub, Google, Linear, etc.) |
Static headers
Section titled “Static headers”{ "id": "my-mcp", "name": "My MCP", "url": "https://mcp.example.com", "type": "sse", "headers": { "Authorization": "Bearer ${env:MY_MCP_TOKEN}" }}Supports ${env:VAR_NAME} substitution. The gateway injects the header on every request.
Device-code OAuth
Section titled “Device-code OAuth”For MCP servers that implement OAuth 2.0 Device Authorization Grant. When a tool call fails with 401/403, the gateway auto-starts the device-code flow: registers as an OAuth client, gets a user_code and verification_uri, and returns a login_required response. The worker shows the user a link and code. Once the user authorizes in their browser, the gateway polls for the token, encrypts it in Postgres (90-day TTL), and future calls are transparent.
Minimal config — the gateway auto-derives OAuth endpoints from the MCP server URL:
{ "id": "my-mcp", "name": "My MCP", "url": "https://mcp.example.com", "type": "sse", "oauth": {} }Override endpoints or provide a pre-registered clientId via the oauth config when needed.
Lobu-managed auth
Section titled “Lobu-managed auth”Third-party integrations (GitHub, Google, Linear, etc.) are handled by Lobu MCP servers internally. Workers access them through Lobu tools — the gateway is a thin proxy that doesn’t know or care about the integration’s auth.
SSRF protection
Section titled “SSRF protection”The proxy blocks requests to reserved/internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, link-local, IPv6 loopback/ULA). Workers cannot use MCP configs to reach internal services.
Tool approval
Section titled “Tool approval”MCP tools can declare annotations indicating whether they are destructive or have side effects. The gateway may require explicit user approval before executing a tool call. Grants are stored per agent. See Tool Policy for preApproved overrides.