Driving It From An Agent

Driving it from an agent

The repository ships an optional Model Context Protocol server under mcp/, which exposes the management API as tools. An assistant can then answer questions like "what are my top egressing domains" or "is anything reaching AI APIs", and act on the answer.

Running it

SPM_URL=http://localhost:5001 SPM_USERNAME=admin SPM_PASSWORD=... uvx spm-mcp

Variable	Default	Meaning
SPM_URL	http://localhost:5001	Backend API base URL
SPM_USERNAME	admin	Admin user, Basic auth
SPM_PASSWORD	none	Admin password
SPM_VERIFY	true	Set to false only to skip TLS verification against the self-signed certificate

In an MCP client such as Claude Desktop:

{
  "mcpServers": {
    "secure-proxy-manager": {
      "command": "uvx",
      "args": ["spm-mcp"],
      "env": {
        "SPM_URL": "http://localhost:5001",
        "SPM_USERNAME": "admin",
        "SPM_PASSWORD": "your-password"
      }
    }
  }
}

Note that the backend listens on 127.0.0.1:5001, so the MCP server has to run on the same host, or reach it through a tunnel.

The tools, and which ones change things

Read only:

Tool	What it returns
spm_status, spm_dashboard	Health and summary totals
spm_top_domains, spm_shadow_it, spm_user_agents	Analytics, including shadow IT and agent egress
spm_recent_logs	Recent proxy access-log rows
spm_security_score	Posture score
spm_waf_categories, spm_list_domain_blocklist	Current WAF and list state

Mutating, these change live proxy behaviour:

Tool	Effect
spm_block_domain, spm_unblock_domain	Edit the domain blocklist
spm_toggle_waf_category	Enable or disable a WAF category at runtime
spm_allow_egress	Add an entry to the egress allowlist
spm_reload_config	Apply pending changes

The mutating tools are named with an explicit verb so they are recognisable in an approval prompt. Approve them deliberately: spm_toggle_waf_category disabling a category, or spm_unblock_domain, changes what your gateway lets through for every client behind it, immediately.

What you are handing over

The credentials in that configuration are admin credentials for your web gateway. An agent holding them can read your traffic analytics, which include the domains your users reach, and can change what is blocked.

Two sensible precautions: keep the password out of files that get shared or committed, and prefer read-only use unless you specifically want the agent to act. There is no separate read-only credential today, so the boundary is which tool calls you approve.

The full tool list and client configuration are in mcp/README.md.