Cluster Route Mapping for Custom Reverse Proxies

If you don't use AtScale's pre-configured nginx and want to route MCP traffic through your own reverse proxy (such as HAProxy, Traefik, a different nginx, Kubernetes Ingress, etc.), you need to forward four path prefixes to the MCP Server on port 3003.

Required routes

Set up forwarding for the following prefixes as described in the table.

Prefix	Forward to
/mcp	atscale-mcp-server:3003
/authorize	atscale-mcp-server:3003
/token	atscale-mcp-server:3003
/.well-known	atscale-mcp-server:3003

Rules

When configuring the routes listed above, be sure to do the following:

• Preserve the prefix. Do not strip /mcp, /authorize, /token, or /.well-known from the path before proxying.

  Note

  A common mistake is rewriting /mcp to / when forwarding. This strips the prefix, resulting in the backend returning 404 for every request.

• Use path-prefix matching, not exact match.

• Forward the Authorization header unchanged to preserve OAuth bearer tokens.

• Use HTTP/1.1 upstream and set long timeouts (for example, 21600s), as the /mcp endpoint streams responses.

Route validation

After setting up the routes listed above, you can verify them by checking the following:

• GET /.well-known/oauth-authorization-server returns JSON, and not 404.
• GET /mcp returns 401 if unauthenticated. A 404 means the prefix is being stripped.