What is an MCP Proxy?

The Model Context Protocol is JSON-RPC over a transport (stdio or Streamable HTTP), which makes it straightforward to interpose: a proxy presents itself as a server to the client and as a client to the upstream server, relaying messages in between. Because every tool invocation flows through it as a structured tools/call request, the proxy is a natural enforcement and observation point.

Both classic proxy patterns appear in MCP deployments. A forward proxy sits on the client side — for example, a local process declared in the client's MCP configuration that relays to the real server, governing what that client may do. A reverse proxy sits in front of a server, terminating inbound connections and applying controls before traffic reaches it.

What a proxy can enforce or add, since it sees the full message stream:

• Policy — allow, deny or require approval per tool, argument or caller.
• Logging and audit — capture requests, responses and decisions into an audit trail.
• Credential injection — hold upstream secrets itself and attach them per request, so clients never see raw API keys.
• Transport bridging — expose a local stdio interface for a remote Streamable HTTP server, or vice versa.
• Filtering — hide specific tools from tools/list responses.

A proxy fronting many upstream servers with shared auth, policy and audit is usually called an MCP gateway.

PolicyLayer's gateway is a reverse-proxy data plane for MCP traffic. Clients route their MCP connections through it; the gateway evaluates each tools/call against the team's deterministic policies before forwarding it upstream, injects the right upstream credentials, and records every decision for audit.