MCPManager - Secured MCP Server Deployment and MCP Server Discovery with right Security Posture Management

MCPManager is a comprehensive, production-ready platform for deploying, managing, and securing MCP (Model Context Protocol) servers with advanced features including multi-runtime support, observability, and enterprise-grade security.

PyPi Reference: https://pypi.org/project/mcp-deployment/

Key Features

Core Management

Dynamic MCP Server Discovery: Automatically discover and configure MCP servers from registries
Multi-Runtime Support: Deploy to Docker, Podman, and Kubernetes environments
Container-based Isolation: Run MCP servers in secure, isolated containers
Protocol Scheme Support: Direct execution of uvx://, npx://, and go:// schemes
Transport Protocols: Support for stdio, SSE, HTTP proxy, and transparent proxy protocols

Security & Permissions

Advanced Permission Profiles: Fine-grained security controls with built-in templates
Image Verification: Sigstore-based container image verification
CA Certificate Management: Complete certificate lifecycle management
Secrets Management: Secure handling of API keys and credentials with multiple backends
Security Policies: Enterprise-grade security policies with Cedar language support

Operations & Observability

OpenTelemetry Integration: Comprehensive telemetry with metrics, tracing, and logging
Inspector/Debugging: Real-time debugging and introspection capabilities
Health Monitoring: Built-in health checks and monitoring
Audit Logging: Complete audit trail of all operations

Enterprise Features

Kubernetes Operator: Deploy and manage MCP servers in Kubernetes with CRDs
Registry Management: Curated MCP server registry with verification
Client Auto-configuration: Seamless integration with VS Code, Cursor, and other clients
RESTful API: Complete REST API for automation and integration

Prerequisites

MCPMANAGER currently works on macOS and Linux using Docker or Podman.

For client auto-discovery/configuration, a supported client:

VS Code (v1.99.0 or newer) with an active GitHub Copilot subscription Cursor Roo Code (VS Code extension)

Installation

Basic Installation

pip install mcp-deployment

With Optional Features

# With Kubernetes support
pip install mcp-deployment[kubernetes]

# With telemetry support
pip install mcp-deployment[telemetry]

# With authentication support
pip install mcp-deployment[auth]

# Full installation
pip install mcp-deployment[kubernetes,telemetry,auth]

Quick Start

Basic Usage

# Enable client auto-discovery
mcpm config auto-discovery enable

# Run an MCP server from registry
mcpm run fetch

# Run with protocol scheme
mcpm run "uvx://mcp-fetch"

# List running servers
mcpm list

# Stop a server
mcpm stop fetch

# View server logs
mcpm logs fetch

Advanced Configuration

# Set up secrets
mcpm secret set GITHUB_TOKEN

# Create custom permission profile
mcpm permission create my-profile --template restricted

# Run with custom permissions
mcpm run github --permission-profile my-profile

# Set up observability
mcpm config telemetry enable --endpoint http://jaeger:14268/api/traces

Architecture

MCPManager provides a comprehensive platform for MCP server management:

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   Client Apps   │    │   MCPManager     │    │  MCP Servers    │
│  (VS Code,      │◄──►│   (API/Proxy)    │◄──►│  (Containerized)│
│   Cursor, etc.) │    │                  │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘
                              │
                              ▼
                       ┌──────────────────┐
                       │  Runtime Layer   │
                       │ (Docker/K8s/Pod) │
                       └──────────────────┘

Comprehensive CLI Reference

Server Management

# Run servers
mcpm run <server_name>                    # Run from registry
mcpm run <image>                          # Run custom image
mcpm run "uvx://package-name"             # Run Python package
mcpm run "npx://package-name"             # Run Node.js package
mcpm run "go://module@version"            # Run Go module

# Server lifecycle
mcpm stop <server_name>                   # Stop server
mcpm restart <server_name>                # Restart server
mcpm rm <server_name>                     # Remove server
mcpm list                                 # List all servers
mcpm list --running                       # List running servers

# Server inspection
mcpm logs <server_name>                   # View logs
mcpm logs <server_name> --follow          # Follow logs
mcpm inspect <server_name>                # Detailed inspection
mcpm status <server_name>                 # Server status

Configuration Management

# Client auto-discovery
mcpm config auto-discovery enable         # Enable auto-discovery
mcpm config auto-discovery disable        # Disable auto-discovery
mcpm config auto-discovery status         # Check status

# Registry management
mcpm config registry set <url>            # Set registry URL
mcpm config registry get                  # Get current registry
mcpm config registry list                 # List registry entries

# Certificate management
mcpm config ca-cert set <path>            # Set CA certificate
mcpm config ca-cert get                   # Get CA certificate info
mcpm config ca-cert unset                 # Remove CA certificate

Secrets Management

# Secret operations
mcpm secret set <name> [value]            # Set secret (prompts if no value)
mcpm secret get <name>                    # Get secret
mcpm secret list                          # List secrets
mcpm secret delete <name>                 # Delete secret

# Secret providers
mcpm secret provider 1password            # Use 1Password
mcpm secret provider encrypted            # Use encrypted storage
mcpm secret provider none                 # No encryption

# Keyring management
mcpm secret reset-keyring                 # Reset keyring

Permission Management

# Permission profiles
mcpm permission list                      # List profiles
mcpm permission create <name>             # Create profile
mcpm permission create <name> --template <template>  # From template
mcpm permission delete <name>             # Delete profile
mcpm permission validate <name>           # Validate profile

# Available templates: minimal, restricted, standard, privileged

Registry Operations

# Registry browsing
mcpm registry list                        # List available servers
mcpm registry search <query>              # Search servers
mcpm registry info <server>               # Server information

# Server search
mcpm search <query>                       # Search for servers

Proxy Management

# HTTP proxy
mcpm proxy start --port 8080              # Start HTTP proxy
mcpm proxy stop                           # Stop proxy
mcpm proxy status                         # Proxy status

Development & Debugging

# Inspector
mcpm inspector                            # Start inspector interface
mcpm inspector --port 8081               # Custom port

# Version information
mcpm version                              # Show version
mcpm version --detailed                   # Detailed version info

Configuration

Configuration File

MCPManager uses a YAML configuration file located at ~/.mcpmanager/config.yaml:

# Auto-discovery settings
auto_discovery:
  enabled: true
  registry_url: "https://registry.mcpmanager.io"

# Security settings
security:
  verify_images: true
  default_permission_profile: "restricted"
  ca_certificate_path: "/path/to/ca.pem"

# Telemetry settings
telemetry:
  enabled: true
  endpoint: "http://localhost:14268/api/traces"
  service_name: "mcpmanager"
  metrics_port: 9090

# Runtime settings
runtime:
  default: "docker"
  docker:
    socket: "/var/run/docker.sock"
  kubernetes:
    namespace: "mcpmanager"
    context: "default"

# Secrets settings
secrets:
  provider: "encrypted"  # Options: none, encrypted, 1password
  encryption_key_path: "~/.mcpmanager/secrets.key"

Environment Variables

# Runtime configuration
export MCPM_RUNTIME=docker                # Default runtime
export MCPM_CONFIG_DIR=~/.mcpmanager      # Config directory

# Docker settings
export DOCKER_HOST=unix:///var/run/docker.sock

# Kubernetes settings
export KUBECONFIG=~/.kube/config
export MCPM_K8S_NAMESPACE=mcpmanager

# Telemetry settings
export MCPM_TELEMETRY_ENABLED=true
export MCPM_OTEL_ENDPOINT=http://localhost:14268/api/traces

# Registry settings
export MCPM_REGISTRY_URL=https://registry.mcpmanager.io
export MCPM_VERIFY_IMAGES=true

Security Features

Permission Profiles

MCPManager includes built-in permission profiles:

minimal: Bare minimum permissions for basic functionality
restricted: Limited permissions for untrusted servers
standard: Balanced permissions for most use cases
privileged: Extended permissions for trusted servers

Image Verification

Automatic verification of container images using Sigstore:

# Enable image verification
mcpm config verify-images enable

# Verify specific image
mcpm verify <image>

Certificate Management

Complete certificate lifecycle management:

# Certificate operations
mcpm cert import <path>                   # Import certificate
mcpm cert list                           # List certificates
mcpm cert validate <name>                 # Validate certificate
mcpm cert export <name> <path>            # Export certificate
mcpm cert remove <name>                   # Remove certificate

# Certificate search and filtering
mcpm cert search <query>                  # Search certificates
mcpm cert expiring --days 30             # Find expiring certificates
mcpm cert expired                        # Find expired certificates

Observability

OpenTelemetry Integration

MCPManager provides comprehensive observability:

Tracing: Distributed tracing of all operations
Metrics: Performance and operational metrics
Logging: Structured logging with correlation IDs

Metrics Available

Server creation/destruction rates
Request/response times
Error rates and types
Resource utilization
Container lifecycle events

Health Monitoring

# Health checks
mcpm health                               # Overall system health
mcpm health <server_name>                 # Specific server health

⚡ Protocol Schemes

MCPManager supports direct execution of protocol schemes:

Python (uvx://)

mcpm run "uvx://mcp-fetch"                # Run Python package
mcpm run "uvx://mcp-github@latest"        # Specific version

Node.js (npx://)

mcpm run "npx://@mcp/server-fetch"        # Run npm package
mcpm run "npx://@mcp/server-github@1.0.0" # Specific version

Go (go://)

mcpm run "go://github.com/user/mcp-server@latest"  # Run Go module
mcpm run "go://github.com/user/mcp-server@v1.2.3"  # Specific version

Kubernetes Deployment

Using Helm Charts

# Add MCPManager Helm repository
helm repo add mcpmanager https://charts.mcpmanager.io
helm repo update

# Install MCPManager operator
helm install mcpmanager mcpmanager/mcpmanager-operator

# Install CRDs
helm install mcpmanager-crds mcpmanager/mcpmanager-crds

Manual Deployment

# Apply CRDs
kubectl apply -f https://raw.githubusercontent.com/mcpmanager/mcp-deployment/main/deploy/crds/

# Deploy operator
kubectl apply -f https://raw.githubusercontent.com/mcpmanager/mcp-deployment/main/deploy/operator/

MCP Server CRD Example

apiVersion: mcpmanager.io/v1alpha1
kind: MCPServer
metadata:
  name: fetch-server
spec:
  image: mcpmanager/fetch:latest
  transport: sse
  port: 8080
  permissionProfile: restricted
  secrets:
    - name: api-key
      target: API_KEY
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
      cpu: "200m"

REST API

MCPManager provides a comprehensive REST API:

Server Management

# List servers
GET /api/v1/servers

# Create server
POST /api/v1/servers
{
  "name": "my-server",
  "image": "mcpmanager/fetch:latest",
  "transport": "sse"
}

# Get server details
GET /api/v1/servers/{name}

# Stop server
DELETE /api/v1/servers/{name}

Registry Operations

# Search registry
GET /api/v1/registry/search?q=fetch

# Get server info
GET /api/v1/registry/servers/{name}

Health and Metrics

# Health check
GET /api/v1/health

# Metrics endpoint
GET /metrics

Development

Building from Source

# Clone repository
git clone https://github.com/mcpmanager/mcp-deployment.git
cd mcp-deployment

# Install in development mode
pip install -e .[dev]

# Run tests
pytest

# Run linting
black . && isort . && flake8

Contributing

Fork the repository
Create a feature branch
Make your changes
Add tests
Submit a pull request

Production Deployment

System Requirements

CPU: 2+ cores recommended
Memory: 4GB+ RAM recommended
Storage: 10GB+ for images and data
Network: Outbound internet access for registries

High Availability Setup

# Example HA configuration
replicas: 3
persistence:
  enabled: true
  storageClass: "fast-ssd"
monitoring:
  enabled: true
  prometheus: true
  grafana: true
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10

Performance Tuning

# Performance configuration
runtime:
  docker:
    concurrent_limit: 50
    timeout: 300
cache:
  enabled: true
  ttl: 3600
  max_size: 1000
telemetry:
  sampling_rate: 0.1  # 10% sampling

Examples

Example: GitHub MCP Server

# Set up GitHub token
mcpm secret set GITHUB_TOKEN ghp_xxxxxxxxxxxx

# Run GitHub server with custom permissions
mcpm run github --permission-profile standard --transport sse

# Check server status
mcpm status github

# View logs
mcpm logs github --follow

Example: Multi-Server Setup

# Run multiple servers
mcpm run fetch --transport sse --port 8080
mcpm run github --transport sse --port 8081
mcpm run memory --transport stdio

# List all running servers
mcpm list --running

# Stop all servers
mcpm stop --all

Example: Custom Container

# Run custom MCP server
mcpm run my-registry.com/my-mcp-server:latest \\
  --permission-profile custom \\
  --env MY_CONFIG=value \\
  --port 8082

# With secrets
mcpm run my-server \\
  --secret API_KEY=my-api-key \\
  --secret DB_PASSWORD=my-db-password

Troubleshooting

Common Issues

Docker Connection Issues

# Check Docker status
docker version

# Verify permissions
sudo usermod -aG docker $USER
newgrp docker

Registry Connection Issues

# Test registry connectivity
mcpm registry list

# Check CA certificate
mcpm config ca-cert get

Permission Errors

# Validate permission profile
mcpm permission validate my-profile

# Use more permissive profile
mcpm run my-server --permission-profile standard

Debug Mode

# Enable debug logging
export MCPM_LOG_LEVEL=DEBUG
mcpm run my-server

# Use inspector for real-time debugging
mcpm inspector

Getting Help

# Built-in help
mcpm --help
mcpm run --help

# Check system status
mcpm health --verbose

# View configuration
mcpm config list

📝 License

MCPManager is contributed as an Initial Open Source Project under the Apache License, Version 2.0. See LICENSE for details.

For enterprise-class features, commercial licensing, and support agreements, please contact the maintainer and author of this project:

Akram Sheriff

Email: sheriff.akram.usa@gmail.com
Enterprise Inquiries: For commercial licensing, support contracts, and enterprise features

Open Source vs Enterprise Features

Open Source (Apache 2.0):

Core MCP server management
Basic security and permissions
Docker and Podman runtime support
Standard CLI and API functionality
Community support

Enterprise Features (Commercial License Available):

Advanced Kubernetes operator with CRDs
Enterprise-grade security policies
Commercial support and SLA
Professional services and consulting
Custom feature development

🤝 Community

GitHub: https://github.com/akramIOT/mcpmanager
Issues: https://github.com/akramIOT/mcpmanager/issues
Discussions: https://github.com/akramIOT/mcpmanager/discussions

🙏 Acknowledgments

MCPManager is built on top of excellent open-source projects:

Made with ❤️ by the MCPManager team

Name		Name	Last commit message	Last commit date
Latest commit History 16 Commits
.github /workflows		.github /workflows
examples		examples
src/mcpmanager		src/mcpmanager
tests		tests
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
Dockerfile		Dockerfile
LICENSE		LICENSE
MANIFEST.in		MANIFEST.in
Makefile		Makefile
README.md		README.md
pyproject.toml		pyproject.toml

License

akramIOT/mcpmanager

Folders and files

Latest commit

History

Repository files navigation

MCPManager - Secured MCP Server Deployment and MCP Server Discovery with right Security Posture Management

Key Features

Core Management

Security & Permissions

Operations & Observability

Enterprise Features

Prerequisites

Installation

Basic Installation

With Optional Features

Quick Start

Basic Usage

Advanced Configuration

Architecture

Comprehensive CLI Reference

Server Management

Configuration Management

Secrets Management

Permission Management

Registry Operations

Proxy Management

Development & Debugging

Configuration

Configuration File

Environment Variables

Security Features

Permission Profiles

Image Verification

Certificate Management

Observability

OpenTelemetry Integration

Metrics Available

Health Monitoring

⚡ Protocol Schemes

Python (uvx://)

Node.js (npx://)

Go (go://)

Kubernetes Deployment

Using Helm Charts

Manual Deployment

MCP Server CRD Example

REST API

Server Management

Registry Operations

Health and Metrics

Development

Building from Source

Contributing

Production Deployment

System Requirements

High Availability Setup

Performance Tuning

Examples

Example: GitHub MCP Server

Example: Multi-Server Setup

Example: Custom Container

Troubleshooting

Common Issues

Docker Connection Issues

Registry Connection Issues

Permission Errors

Debug Mode

Getting Help

📝 License

Open Source vs Enterprise Features

🤝 Community

🙏 Acknowledgments

About

Topics

Resources

License

Contributing

Uh oh!

Stars

Packages