# Envoy Mcp Openapi Processor

> An Envoy external processor that transforms Model Context Protocol (MCP) requests into upstream HTTP API calls based on OpenAPI specifications.

- **Type:** MCP server
- **Install:** `agentstack add mcp-ing-bank-envoy-mcp-openapi-processor`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ing-bank](https://agentstack.voostack.com/s/ing-bank)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ing-bank](https://github.com/ing-bank)
- **Source:** https://github.com/ing-bank/envoy-mcp-openapi-processor

## Install

```sh
agentstack add mcp-ing-bank-envoy-mcp-openapi-processor
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# envoy-mcp-openapi-processor

An [Envoy external processor](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_proc_filter) 
that transforms [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) requests into upstream HTTP API calls 
based on [OpenAPI](https://www.openapis.org/) specifications.

The external processor server communicates only with Envoy over gRPC via a Unix domain socket. Envoy owns all 
downstream client and upstream service connections, while the processor inspects and can mutate request and response 
data relayed by Envoy.

## Installation

```sh
go get github.com/ing-bank/envoy-mcp-openapi-processor
```

## Quick Start

See [`examples/mcp-server`](examples/mcp-server) for a complete working example including Envoy proxy configured to use the
`envoy-mcp-openapi-processor` server.

## OpenTelemetry

To enable export of logs and traces to an OpenTelemetry collector, use one of the options below. If neither is used, the server runs with a no-op tracer provider and a no-op logger.

### Option 1: Use provided initialization functions

```go
package main

import (
	"context"

	mcp_proc "github.com/ing-bank/envoy-mcp-openapi-processor"
)

func main() {
	telemetryConfig := mcp_proc.TelemetryConfig{
		OtelEndpoint:   "otel-collector:4317",
		ServiceName:    "mcp-sidecar",
		ServiceVersion: "1.0.0",
	}
	ctx := context.Background()
	err := mcp_proc.InitLogger(telemetryConfig)
	// ...
	tracerShutdown, err := mcp_proc.InitTracer(ctx, telemetryConfig)
	// ...
	var cfg mcp_proc.Config
	// ...
	mcp_proc.RunServer(ctx, &cfg)
}
```

### Option 2: Bring your own provider

Set the global tracer provider by calling `otel.SetTracerProvider(myTracerProvider)` and the global zap logger by calling `zap.ReplaceGlobals(myLogger)` before starting the server.

## Development

### Tests

To run all tests, execute the following command:

```sh
make test
```

To check the test coverage, execute the following command:

```sh
make coverage-check
```

### E2E tests

To run the end-to-end suite (spins up Envoy, the processor, and a mock upstream via Docker Compose, then exercises MCP  REST translation), execute the following command:

```sh
make e2e
```

Requires Docker. On failure, container logs are captured in `e2e/last-run.log`.

### Fuzz tests

Run server handler fuzz tests one at a time:

```sh
make fuzz-request
```

```sh
make fuzz-response
```

Each command runs until stopped with `Ctrl+C` and reports any issues found.

## DNS Rebinding Protection

The processor validates the `Host`/`:authority` and `Origin` headers of every
request. By default only loopback hostnames are accepted: `localhost`, `127.0.0.1` and
`::1` (any port); anything else is refused with HTTP 403. This protects unauthenticated 
localhost deployments against DNS rebinding attacks where a malicious website's DNS resolves 
to 127.0.0.1 so the victim's browser sends same-origin requests to the local server.

A missing `Host` header is rejected (fail closed). A missing `Origin` header
is accepted (non-browser clients do not send one), but a present `Origin`
must be a URL whose hostname is allowed.

Deployments serving other domains configure them via `Config.AllowedHosts`:

```go
cfg := &mcp_proc.Config{
    // ...
    AllowedHosts: []string{"mcp.example.com"},
}
```

Matching is case-insensitive and ignores ports. A non-empty list **replaces**
the localhost default — include `"localhost"` explicitly if it should remain
allowed.

Each entry is one of:

- `"*"` — match any host. This disables DNS rebinding protection, so use it only
  on trusted networks.
- `"*.example.com"` — match any subdomain at any depth (`foo.example.com`,
  `a.b.example.com`) but **not** the apex `example.com`.
- `"mcp.example.com"` — exact match.

## Security Checklist

Before deploying to production, we advise to verify if the following controls are in place

### Container Security

- [ ] Container runs as non-root user
- [ ] Read-only root filesystem where possible
- [ ] No privileged mode
- [ ] Resource limits (CPU, memory) configured
- [ ] seccomp profile applied
- [ ] AppArmor/SELinux enabled
- [ ] Container image scanned for CVEs
- [ ] Image signed and verified

### Envoy Configuration

- [ ] TLS configured for downstream connections
- [ ] TLS configured for upstream connections
- [ ] Buffer limits set (≤32KB for edge deployments)
- [ ] Connection limits configured
- [ ] Stream limits configured (≤100 concurrent for HTTP/2)
- [ ] Timeouts configured (connection, stream, request)
- [ ] Overload manager enabled
- [ ] Admin endpoint restricted to localhost
- [ ] `use_remote_address: true` for edge deployments
- [ ] Path normalization enabled
- [ ] `headers_with_underscores_action: REJECT_REQUEST`

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ing-bank](https://github.com/ing-bank)
- **Source:** [ing-bank/envoy-mcp-openapi-processor](https://github.com/ing-bank/envoy-mcp-openapi-processor)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-ing-bank-envoy-mcp-openapi-processor
- Seller: https://agentstack.voostack.com/s/ing-bank
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.