关于higress在MCP网关这块能力演进方面的问题请教 || I would like to ask for advice on the evolution of higress' capabilities in the MCP gateway.

[hudiehule]

1、https://higress.cn/plugin/?spm=36971b57.2ef5001f.0.0.2a932c1fNYpbY2官方的插件列表里面并没有看到mcp-server这个插件，请问下未来这个插件的未来演进规划，比如到后端restful api服务是否考虑支持更多的认证类型，或者支持自定义认证；
2、我现在有很多存量的MCP server，这些MCP SERVER本身是需要带认证信息才能访问的，higress是否支持在网关层面配置认证信息，并且在请求到来时，先去处理认证鉴权，然后再去调用实际MCP server的请求，这样ai agent调用方就无需配置这些认证，直接通过网关访问就行了

---

1. https://higress.cn/plugin/?spm=36971b57.2ef5001f.0.0.2a932c1fNYpbY2 does not see the mcp-server plug-in in the official plug-in list. Could you please tell me about the future evolution plan of this plug-in, such as whether the back-end restful api service will consider supporting more authentication types or supporting custom authentication;
2. I now have a lot of MCP servers in stock. These MCP SERVERs themselves need authentication information to access. Does higress support configuring authentication information at the gateway level, and when the request comes, it will first process the authentication and then call the actual MCP server request. In this way, the ai agent caller does not need to configure these authentications and can access directly through the gateway.

[CH3CHO]

mcp-server 插件的文档看这里：https://higress.cn/ai/mcp-server/?spm=36971b57.7beea2de.0.0.d85f20a9HUCWlt

higress是否支持在网关层面配置认证信息，并且在请求到来时，先去处理认证鉴权，然后再去调用实际MCP server的请求

支持的。直接配置认证插件即可。

---

The documentation of the mcp-server plug-in is here: https://higress.cn/ai/mcp-server/?spm=36971b57.7beea2de.0.0.d85f20a9HUCWlt

Whether higress supports configuring authentication information at the gateway level, and when a request comes, it will first process the authentication and then call the actual MCP server request

Supported. Just configure the authentication plug-in directly.

[CH3CHO]

我详细看了下mcp-server 插件，这个插件是专门为OpenAPI类型的后端提供的吧

说的对

如果后端服务已经是MCP SERVER了，还能走这个插件进行配置么

不需要

如果要配置到后端MCP SERVER的认证，应该怎么配置呢？

路由自带的请求认证配置能满足需求吗？

---

I looked at the mcp-server plug-in in detail. This plug-in is specially provided for OpenAPI type backends.

That's right

If the backend service is already MCP SERVER, can I still use this plug-in for configuration?

No need

If you want to configure authentication to the back-end MCP SERVER, how should you configure it?

Can the request authentication configuration provided by the router meet the requirements?

[hudiehule]

貌似无法满足，我想要的是agent（MCP client）直接不带任何认证信息通过higress网关就能调用后端需要认证的MCP SERVER的工具，所以是希望网关这里能直接支持到后端MCP Server的认证

---

It seems unsatisfactory. What I want is that the agent (MCP client) can directly call the back-end MCP SERVER tool that requires authentication through the higress gateway without any authentication information, so I hope that the gateway can directly support the authentication of the back-end MCP Server

[CH3CHO]

看下这个文档：https://higress.cn/ai/mcp-server/?spm=36971b57.6ca97059.0.0.6bc771c9OUuj42#%E8%AE%A4%E8%AF%81%E4%B8%8E%E5%AE%89%E5%85%A8

---

Take a look at this document: https://higress.cn/ai/mcp-server/?spm=36971b57.6ca97059.0.0.6bc771c9OUuj42#%E8%AE%A4%E8%AF%81%E4%B8%8E%E5%AE%89%E5%85%A8

[hudiehule]

这个文档还是针对的后端是OPENAPI类型的，如果后端是需要直接路由的MCP Server服务，貌似没有办法配置认证，因为路由自带的认证插件应该是用于客户端到网关这个环节的认证，而不是网关直接路由到MCP SERVER的

---

This document is still aimed at the backend of the OPENAPI type. If the backend is an MCP Server service that requires direct routing, it seems that there is no way to configure authentication, because the authentication plug-in that comes with the routing should be used for authentication from the client to the gateway, rather than the gateway directly routing to the MCP SERVER

[CH3CHO]

这个文档还是针对的后端是OPENAPI类型的，如果后端是需要直接路由的MCP Server服务，貌似没有办法配置认证，因为路由自带的认证插件应该是用于客户端到网关这个环节的认证，而不是网关直接路由到MCP SERVER的

This document is still aimed at the backend of the OPENAPI type. If the backend is an MCP Server service that requires direct routing, it seems that there is no way to configure authentication, because the authentication plug-in that comes with the routing should be used for authentication from the client to the gateway, rather than the gateway directly routing to the MCP SERVER

哦，我理解错了。那你应该什么都不需要做，不需要配这个插件。认证信息就会被直接发给 MCP Server。

[olivercode]

直接路由下的mcp不支持认证，感觉是没考虑这个功能

---

MCP under direct routing does not support authentication. I feel that this function has not been considered

[CH3CHO]

请 @lexburner @Thomas-Eliot 看一下

[Thomas-Eliot]

你们当前存量的后端 mcp-server ,是简单的 api-key 认证吗？还是需要更加复杂的第三方鉴权？

---

Is your current backend mcp-server a simple api-key authentication? Or is more complex third-party authentication required?

[hudiehule]

都有，简单的就是api-key，复杂的就有jwt，oauth2.1等

---

There are all, the simple one is api-key, the complex one is jwt, oauth2.1, etc.