Remote MCP access (mobile/LAN) via SSE + HTTPS

[BrewingCoder]

Summary

Enable Claude iOS (and other remote MCP clients) to connect to the Outpost MCP server over the network via SSE transport behind a reverse proxy with TLS termination.

Requirements

1. --host flag on outpost mcp serve

• Add --host option (default 127.0.0.1 for stdio safety, 0.0.0.0 recommended for SSE)
• Allows the SSE server to bind to a LAN-accessible interface

2. API key authentication

• Auto-generate a secure bearer token during outpost setup (or on first remote serve)
• Save the token in config.json under mcp_api_key
• Display the token to the user once so they can paste it into their Claude connector config
• outpost mcp serve --transport sse enforces bearer token check on every incoming request
• Reject unauthenticated requests with 401

3. outpost mcp key subcommand

• outpost mcp key — display the current API key
• outpost mcp key --regenerate — generate a new key and save it

4. Documentation

• README section on remote/mobile access setup
• Example HAProxy (or generic reverse proxy) backend config
• Instructions for registering as a Claude custom connector at claude.ai > Settings > Connectors

Architecture

Claude iOS/Web --> HTTPS --> Reverse proxy (HAProxy/Caddy/nginx) --> HTTP --> outpost mcp serve --transport sse --host 0.0.0.0 --port 8080

• TLS termination handled by the user's existing reverse proxy
• Outpost validates the bearer token on each SSE connection
• User registers the HTTPS URL as a custom connector at claude.ai

Future considerations

• Streamable HTTP transport — Anthropic is deprecating SSE in favor of Streamable HTTP. FastMCP may already support it. Should be added as a transport option.
• OAuth flow — Claude connectors support OAuth for multi-user scenarios. Not needed for single-user LAN use but relevant if Outpost is ever shared.

Acceptance criteria

• --host flag on outpost mcp serve
• API key auto-generated on setup, stored in config
• Bearer token enforced on SSE transport requests
• outpost mcp key and outpost mcp key --regenerate commands
• Tests for auth enforcement (reject without token, accept with token)
• README documentation for remote setup

[github-actions]

Triage Summary

Priority: 🟠 high
Component: mcp

Feature request to enable remote MCP client access (iOS/mobile) via SSE transport with bearer token authentication and reverse proxy support. This is a significant capability gap for mobile/LAN access that requires multiple coordinated changes: --host flag, API key management, auth enforcement, and documentation.

---

Classified automatically by AI triage