Add a Local Server
For servers not in the public registry (internal tools, custom builds, private packages), you can add them manually.
From the Discover page
Section titled “From the Discover page”Click Add Local Server and choose the transport type:
stdio server
Section titled “stdio server”Provide the command to launch the server and any arguments. For example:
- Command:
npx - Args:
-y @my-org/my-mcp-server
Optionally add environment variables. You can reference vault secrets using $MCPFW_SECRET:secret_name so credentials stay encrypted.
HTTP server
Section titled “HTTP server”Provide the server URL (like http://localhost:3000/mcp). The gateway connects to this endpoint for MCP protocol communication.
Give the server a name, then click Install. The server is registered with the gateway and written to all connected AI client configurations.
Restart your AI client to pick up the new server. New MCP servers are loaded at client startup and will not appear until you restart.
From an AI client config
Section titled “From an AI client config”If you already have MCP servers configured in your AI client, MCPFirewall discovers them automatically. Go to the MCP Hub page. Servers that are connected directly (not through the gateway) appear under “Discovered, Not Protected.”
Click Protect on any discovered server to rewrite the client config so it routes through the gateway. Or use Protect All to batch-protect every discovered server at once. A preview shows exactly which config files will change before you confirm.
Removing a server
Section titled “Removing a server”On the MCP Hub page, click the delete icon on the server card and confirm. This removes the server from the gateway and from all AI client configs. Vault secrets associated with the server are kept in case you want to reinstall later.