MCP Gateway behind Traefik proxy - anyone got it working?

[sammcj]

I've been trying to get MCP Gateway running behind my Traefik v3 reverse proxy and am a bit stuck - when the client (Cline) tries to connect it sits there for a long time then eventually thinks the server timed out or closed the connection.

On the server side it see the connection and thinks its fine, then errors

{"level":"debug","time":"2025-05-29 11:38:30","caller":"core/middleware.go:42","msg":"request details","method":"GET","path":"/sam/fetch/sse","remote_addr":"127.0.0.1:44762","user_agent":"node","query":"","headers":{"Accept":"text/event-stream","Accept-Encoding":"br, gzip, deflate","Accept-Language":"*","Cache-Control":"no-cache","Connection":"close","Content-Type":"application/json","Mcp-Session-Id":"{header.Mcp-Session-Id}","Pragma":"no-cache","Sec-Fetch-Mode":"cors","User-Agent":"node","X-Forwarded-For":"{remoteip}, 192.168.0.75, 172.22.0.49","X-Forwarded-Host":"{host}","X-Forwarded-Port":"443","X-Forwarded-Proto":"http","X-Forwarded-Server":"a6024b4e714a","X-Real-Ip":"172.22.0.49"}}
{"level":"info","time":"2025-05-29 11:38:30","caller":"core/middleware.go:49","msg":"request started","method":"GET","path":"/sam/fetch/sse","remote_addr":"127.0.0.1:44762","user_agent":"node"}
{"level":"debug","time":"2025-05-29 11:38:30","caller":"core/server.go:104","msg":"routing request","path":"/sam/fetch/sse","prefix":"/sam/fetch","endpoint":"sse","remote_addr":"127.0.0.1:44762"}
{"level":"debug","time":"2025-05-29 11:38:30","caller":"core/server.go:112","msg":"applying CORS middleware","prefix":"/sam/fetch"}
{"level":"debug","time":"2025-05-29 11:38:30","caller":"core/server.go:135","msg":"handling SSE endpoint","prefix":"/sam/fetch"}
{"level":"info","time":"2025-05-29 11:38:30","caller":"core/sse.go:68","msg":"establishing SSE connection","session_id":"51db089c-5670-42c8-ba99-33847fdf2bee","prefix":"/sam/fetch","remote_addr":"127.0.0.1:44762","user_agent":"node"}
{"level":"debug","time":"2025-05-29 11:38:30","caller":"core/sse.go:87","msg":"SSE session registered successfully","session_id":"51db089c-5670-42c8-ba99-33847fdf2bee","prefix":"/sam/fetch"}
{"level":"debug","time":"2025-05-29 11:38:30","caller":"core/sse.go:94","msg":"sending initial endpoint event","session_id":"51db089c-5670-42c8-ba99-33847fdf2bee","endpoint_url":"/sam/fetch/message?sessionId=51db089c-5670-42c8-ba99-33847fdf2bee"}
{"level":"info","time":"2025-05-29 11:38:30","caller":"core/sse.go:111","msg":"SSE connection ready","session_id":"51db089c-5670-42c8-ba99-33847fdf2bee","prefix":"/sam/fetch","remote_addr":"127.0.0.1:44762"}
2025/05/29 11:39:30 [error] 77#77: *1 upstream timed out (110: Unknown error) while reading upstream, client: 172.22.0.49, server: localhost, request: "GET /mcp/sam/fetch/sse HTTP/1.1", upstream: "http://127.0.0.1:5235/sam/fetch/sse", host: "mcpgateway.my.domain"
172.22.0.49 - - [29/May/2025:11:39:30 +1000] "GET /mcp/sam/fetch/sse HTTP/1.1" 200 0 "-" "node" "{remoteip}, 192.168.0.75"
{"level":"info","time":"2025-05-29 11:39:30","caller":"core/sse.go:155","msg":"SSE client disconnected","session_id":"51db089c-5670-42c8-ba99-33847fdf2bee","remote_addr":"127.0.0.1:44762"}
{"level":"info","time":"2025-05-29 11:39:30","caller":"core/middleware.go:79","msg":"request completed successfully","method":"GET","path":"/sam/fetch/sse","remote_addr":"127.0.0.1:44762","user_agent":"node","status":200,"size":89,"latency":60.044156508,"client_ip":"172.22.0.49"}
[GIN] 2025/05/29 - 11:39:30 | 200 |          1m0s |     172.22.0.49 | GET      "/sam/fetch/sse"

I think I've tried just about every traefik label under the sun to make it work but no success:

    labels:
      traefik.enable: true
      traefik.docker.network: traefik-servicenet

      traefik.http.routers.mcpgateway.rule: Host(`mcpgateway.my.domain`)
      traefik.http.routers.mcpgateway.tls.certresolver: le
      traefik.http.routers.mcpgateway.entrypoints: websecure
      traefik.http.routers.mcpgateway.tls.domains[0].main: "*.my.domain"
      traefik.http.routers.mcpgateway.service: mcpgateway-service
      traefik.http.services.mcpgateway-service.loadbalancer.server.port: 80
      traefik.http.services.mcpgateway-service.loadbalancer.passhostheader: true

      # prevent timeouts
      traefik.http.routers.mcpgateway.middlewares: mcp-sse-buffering
      traefik.http.middlewares.mcp-sse-buffering.buffering.maxResponseBodyBytes: 0
      traefik.http.middlewares.mcp-sse-buffering.buffering.maxRequestBodyBytes: 0
      traefik.http.middlewares.mcp-sse-buffering.buffering.memRequestBodyBytes: 0
      traefik.http.middlewares.mcp-sse-buffering.buffering.memResponseBodyBytes: 0

Config:

name: my-mcp-servers
tenant: default
routers:

    - server: fetch-url
      prefix: /sam/fetch
      cors:
        allowOrigins:
            - '*'
        allowMethods:
            - GET
            - OPTIONS
            - POST
        allowHeaders:
            - Content-Type
            - Authorization
            - Mcp-Session-Id
            - remote_addr
            - Remote-Addr
            - Host
            - X-Real-Ip
        exposeHeaders:
            - Mcp-Session-Id
            - remote_addr
            - Remote-Addr
        allowCredentials: true

mcpServers:
    - type: stdio
      name: fetch-url
      command: uvx
      args:
        - mcp-server-fetch
      policy: onStart
      preinstalled: true

[iFurySt]

Can you confirm whether it works correctly without Traefik, by accessing the MCP Gateway directly

[sammcj]

Hey, sorry I should have said - yes it does work without Traefik in the mix.

This is what's leading me to think there's a header or SSE specific traefik rule that might be required?

[sammcj]

The closest to working that I've got this so far is if I completely bypass the internal nginx service, but still have some client issues where the clients error when connecting with SSE error: TypeError: fetch failed: connect ECONNREFUSED 192.168.0.22:5235 - where that IP is actually the host the containers are running on, which makes me wonder if there's a header missing that should be hinting to the domain/url to connect with.

    labels:
      # Static files router (port 80) - lowest priority, catches everything else
      traefik.enable: true
      traefik.http.routers.mcpgateway.rule: Host(`mcpgateway.my.internal.domain`)
      traefik.http.routers.mcpgateway.priority: 1
      traefik.http.routers.mcpgateway.entrypoints: websecure
      traefik.http.routers.mcpgateway.tls.certresolver: le
      traefik.http.routers.mcpgateway.service: mcpgateway
      traefik.http.services.mcpgateway.loadbalancer.server.port: 80

      # API router (port 5234) - excludes websocket paths
      traefik.http.routers.mcpgateway-api.rule: Host(`mcpgateway.my.internal.domain`) && PathPrefix(`/api`) && !PathPrefix(`/api/ws`)
      traefik.http.routers.mcpgateway-api.priority: 3
      traefik.http.routers.mcpgateway-api.entrypoints: websecure
      traefik.http.routers.mcpgateway-api.tls.certresolver: le
      traefik.http.routers.mcpgateway-api.service: mcpgateway-api
      traefik.http.services.mcpgateway-api.loadbalancer.server.port: 5234

      # WebSocket router (port 5234) - handles /api/ws paths
      traefik.http.routers.mcpgateway-ws.rule: Host(`mcpgateway.my.internal.domain`) && PathPrefix(`/api/ws`)
      traefik.http.routers.mcpgateway-ws.priority: 4
      traefik.http.routers.mcpgateway-ws.entrypoints: websecure
      traefik.http.routers.mcpgateway-ws.tls.certresolver: le
      traefik.http.routers.mcpgateway-ws.service: mcpgateway-ws
      traefik.http.routers.mcpgateway-ws.middlewares: websocket-headers
      traefik.http.services.mcpgateway-ws.loadbalancer.server.port: 5234

      # MCP router (port 5235) - strips /mcp prefix
      traefik.http.routers.mcpgateway-mcp.rule: Host(`mcpgateway.my.internal.domain`) && PathPrefix(`/mcp`)
      traefik.http.routers.mcpgateway-mcp.priority: 2
      traefik.http.routers.mcpgateway-mcp.entrypoints: websecure
      traefik.http.routers.mcpgateway-mcp.tls.certresolver: le
      traefik.http.routers.mcpgateway-mcp.service: mcpgateway-mcp
      traefik.http.routers.mcpgateway-mcp.middlewares: mcp-stripprefix
      traefik.http.services.mcpgateway-mcp.loadbalancer.server.port: 5235

      # Middlewares
      traefik.http.middlewares.mcp-stripprefix.stripprefix.prefixes: /mcp
      traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Connection: upgrade
      traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Upgrade: websocket