Feature hasn't been suggested before.
Describe the enhancement you want to request
Add support for client-side certificates (mutual TLS, mTLS) for remote MCP connections.
Details
- Allow configuration of client certificates, private key, and CA for remote MCP implementations.
- Expose new options in the MCP remote config schema (e.g., cert/key/ca file paths or PEM content).
- Certificate fields should be optional and only applied to connections where the remote MCP endpoint requires mTLS.
- Update the HTTP transport layer to instantiate an
https.Agent (Node.js/Bun) with these credentials and use it for remote MCP requests.
- Document how to configure and use mTLS with MCP servers.
Benefits
- Allows secure authentication/authorization against remote MCP servers that require client certificates
- Increases deployment flexibility for enterprises or regulated environments
- Closes a security gap for users who need fine-grained client authentication
Background/Reasoning
Currently, remote MCP connections support OAuth and custom headers but do not offer any TLS client certificate option. This limits integration with servers that require mutual TLS for client authentication (common in private clouds and regulated industry APIs). Since Node.js and Bun both support passing certificates via https.Agent, it should be feasible with configuration and some changes to the HTTP client logic.
If certificate support is not possible in browser targets, please scope the feature for supported server-side (Node.js/Bun) hosting environments only.
Feature hasn't been suggested before.
Describe the enhancement you want to request
Add support for client-side certificates (mutual TLS, mTLS) for remote MCP connections.
Details
https.Agent(Node.js/Bun) with these credentials and use it for remote MCP requests.Benefits
Background/Reasoning
Currently, remote MCP connections support OAuth and custom headers but do not offer any TLS client certificate option. This limits integration with servers that require mutual TLS for client authentication (common in private clouds and regulated industry APIs). Since Node.js and Bun both support passing certificates via
https.Agent, it should be feasible with configuration and some changes to the HTTP client logic.If certificate support is not possible in browser targets, please scope the feature for supported server-side (Node.js/Bun) hosting environments only.