MCP Transport Bridge

Run and manage MCP child processes, expose them over authenticated HTTP, and replace their environment without dropping healthy requests. The mcp-transport-bridge package also connects an HTTP or explicitly selected legacy SSE MCP server to a stdio-only client.

Requires Node.js 22 or later. Version 0.2 uses the MCP TypeScript SDK 2 and supports the 2026-07-28 protocol plus explicit legacy compatibility. This is a single-owner administration service: every holder of its token can execute configured commands and intentionally shares the same downstream servers. It is not a multi-tenant gateway or an OAuth authorization server.

Start the HTTP service

npm install mcp-transport-bridge
export MCP_BRIDGE_TOKEN="$(node -e "process.stdout.write(require('crypto').randomBytes(32).toString('hex'))")"
npx mcp-transport-bridge --host 127.0.0.1 --port 3000

Use an environment variable or your secret manager for the token. It must contain 32–4096 characters and is required on every route, including health checks and MCP requests. The default listener binds to loopback. HOST and PORT can replace the command-line options. --port 0 selects an available port; the ready message goes to stderr.

curl -H "Authorization: Bearer $MCP_BRIDGE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"My MCP server","transport":"stdio","command":"node","args":["/absolute/path/server.js"],"env":{"API_KEY":"replace-me"}}' \
  http://127.0.0.1:3000/api/servers

Use the returned server ID:

curl -H "Authorization: Bearer $MCP_BRIDGE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"serverId":"SERVER_UUID","transport":"http"}' \
  http://127.0.0.1:3000/api/connections

The response includes an immutable mcpPath, such as /mcp/CONNECTION_UUID. Connect an MCP HTTP client to that URL with the same bearer header. Each HTTP request is handled by the SDK with its own upstream context; client request IDs are never copied into the shared child.

The service accepts exact local Host headers. Behind a reverse proxy, set MCP_BRIDGE_ALLOWED_HOSTS=bridge.example.com and use TLS at that proxy. Browser Origins must also match an exact allowed origin; MCP_BRIDGE_ALLOWED_ORIGINS=https://console.example.com adds one. Lists are comma-separated. There are no wildcard origins or permissive CORS responses.

HTTP or legacy SSE to stdio

Configure your stdio MCP client with:

{
  "mcpServers": {
    "bridge": {
      "command": "mcp-transport-bridge",
      "args": ["--url", "http://127.0.0.1:3000/mcp/CONNECTION_UUID"],
      "env": { "MCP_BRIDGE_TOKEN": "YOUR_ADMIN_TOKEN" }
    }
  }
}

The installed executable works through npm’s bin symlink and keeps stdout exclusively for MCP. It negotiates modern or legacy stdio clients. For a legacy SSE remote server, add "--transport", "sse" and use its SSE URL. SSE is never selected by guessing after an HTTP error.