Minibridge

What is Minibridge?

Minibridge is a backend-to-frontend bridge that streamlines and secures communication between Agents and MCP servers. It safely exposes MCP servers to the internet and integrates with generic policing services (Policers) for agent authentication, content analysis, and transformation. It also supports SBOM (Software Bill of Materials) generation and real-time validation to ensure MCP server integrity.

How to use Minibridge?

Minibridge can run in all-in-one mode (minibridge aio), backend mode (minibridge backend), or frontend mode (minibridge frontend). The all-in-one command starts a single gateway in front of a stdio-based MCP server. Backend mode exposes an MCP server over WebSocket, while frontend mode exposes a local stdio, HTTP+SSE, or HTTP+STREAM interface that forwards to a backend. TLS can be configured in all modes.

Key features of Minibridge

• Acts as a secure gateway for MCP servers to the internet
• Supports all-in-one, backend, and frontend deployment modes
• Integrates with HTTP or Rego-based Policers for authentication and content control
• Generates and validates SBOMs for MCP server integrity
• Provides strong client authentication via TLS client certificates
• Supports bidirectional communication via WebSocket, HTTP+SSE, and stdio

Use cases of Minibridge

• Exposing a local stdio MCP server to remote agents over HTTP+SSE or WebSocket
• Enforcing agent authentication and request analysis via an external Policer
• Ensuring an MCP server has not been tampered with using SBOM checks
• Providing a secure, TLS-encrypted gateway for MCP communication
• Offloading policy decisions to a remote HTTP service or local OPA Rego file

FAQ from Minibridge

What transport protocols does Minibridge support?

Minibridge supports stdio, HTTP+SSE, HTTP+STREAM (coming soon), and WebSocket between frontend and backend.

How can I secure Minibridge connections?

You can enable HTTPS with TLS server certificates and optionally require client certificates using the --tls-server-client-ca flag in all modes.

What is a Policer and how does it work?

A Policer is a service that authenticates agents and analyzes MCP requests/responses. It can be implemented via an HTTP endpoint or a local OPA Rego policy file. The Policer returns a deny list or allows the call to proceed.

Can I check the integrity of an MCP server with Minibridge?

Yes. Minibridge can generate an SBOM file containing hashes of tools and prompts, and then validate that the server has not changed, either offline (minibridge scan check) or online (by passing the SBOM to the backend).

Does Minibridge support agent authentication?

Yes. Agent authentication can be done globally using a single token or forwarded from the frontend to the backend, and can be enforced by a Policer.