Support per-server custom CA certificates for HTTP MCP upstreams
Maintainers usually reply within 1 day
Assessment
This issue has not been assessed yet.
Description
Feature request
Support an author-configured custom CA certificate for an individual HTTP MCP upstream. Apply that CA only to the gateway's outbound TLS connections to the configured server, without modifying process-wide or runner-wide trust.
Motivation
HTTP MCP servers using a private or self-signed CA cannot be used without additional trust configuration. Current workarounds, such as changing the runner's trust store or introducing a bridge that drops TLS on a hop, are broader or weaker than necessary.
A per-server setting would let a reviewed workflow trust one named upstream without giving the agent a new runtime capability. This is analogous to per-server OIDC authentication: another author-configured connection property of the same upstream.
Requested behavior
- Expose custom CA configuration on an individual HTTP MCP server entry in the gateway configuration.
- Use the configured CA only for that server's outbound TLS connections; do not change trust for other upstreams or global trust stores.
- Keep TLS certificate and hostname verification enabled; this must not be an insecure-skip-verification option.
- Preserve existing TLS behavior for servers without custom CA configuration.
- Report invalid or unreadable certificate configuration clearly, without logging certificate contents or credentials.
- Document the configuration format and add coverage for private-CA connections, trust isolation between servers, invalid CA configuration, and unchanged default behavior.
The exact configuration field and certificate input format can be defined by the gateway implementation so gh-aw can compile to a supported interface.
Downstream dependency
This is needed for github/gh-aw#68033. The implementation attempt in github/gh-aw#69436 identified that the pinned gateway lacks per-server CA configuration. Once the gateway supports it, gh-aw can expose the setting through workflow schema, compilation, tests, and documentation.
Related per-server OIDC support: github/gh-aw-mcpg#2878.
- Dominant language
- Go
- Stars
- 181
- Forks
- 53
- Avg merge
- 7h 8m
- Merged PRs (30d)
- 215
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/gh-aw-mcpg
-
automation mcp-gateway test
Difficulty 1/5 Under an hour Newbie friendliness 8/100
github/gh-aw-mcpg#15068 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 5/100
github/gh-aw-mcpg#15055 ·
Maintainers usually reply within 1 day
-
Verify hashes for the Serena package installationPossibly taken @lpcox claimed this today. Open
github/gh-aw-mcpg#14993 · 1 reaction · 2 assignees ·
Maintainers usually reply within 1 day
-
automation repo-assist
Difficulty 5/5 Over a week Newbie friendliness 15/100
github/gh-aw-mcpg#14238 ·
Maintainers usually reply within 1 day
-
automation mcp-gateway test
Difficulty 1/5 Under an hour Newbie friendliness 5/100
github/gh-aw-mcpg#6522 ·
Maintainers usually reply within 1 day
All issues in github/gh-aw-mcpg
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
keyxmakerx/Chronicle#1469 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Gentleman-Programming/gentle-ai#5565 · 1 comment ·
Maintainers usually reply within 1 day
-
bug frontend grammar sev-3
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
-
connector docs good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
soma-intelligence/open-health-sync#134 ·
Maintainers usually reply within 1 day
-
bug frontend
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 3 days