[Question] How to set-up a https mcp-server?

[Colvin-Y]

Enhancement Description

When I set the server to bearer auth mode, the default communication mode is HTTP, which transmits the JWT in plain text and is not secure. I expect to enable an HTTPS server address. What should I do?

Use Case

No response

Proposed Implementation

[dacamposol]

The Streamable HTTP protocol starts a Uvicorn server using the default host, port, and path, unless explicitly configured otherwise.

In typical deployments, Uvicorn runs behind a reverse proxy (like Nginx) or a cloud CDN, which terminates TLS and forwards plain HTTP traffic to the internal server. In these setups, the Uvicorn instance is not exposed directly to the internet.

However, if you need to run Uvicorn with HTTPS (e.g., when exposing it directly, or to enable mTLS between your reverse proxy and the app without using a sidecar) this is entirely supported. Just note that HTTPS setup is part of Uvicorn’s configuration and not specific to FastMCP.

• Running Uvicorn behind Nginx
• Running Uvicorn behind a CDN
• Running Uvicorn with HTTPS

[Colvin-Y]

The Streamable HTTP protocol starts a Uvicorn server using the default host, port, and path, unless explicitly configured otherwise.

Hi @dacamposol ,
real thanks for your advice.

I've tried it by uvicorn.run(app, host=host, port=port,ssl_keyfile="./private.key",ssl_certfile="./certificate.crt") to set-up my mcp-proxy-server. However, it seems that this server is not functioning properly. I encountered the error "server gave HTTP response to HTTPS client" when accessing it. Do we have any configuration examples for the fastMCP server? I only saw the tutorial at https://gofastmcp.com/integrations/starlette#running-the-server.

[dacamposol]

@Colvin-Y can you share your whole snippet on how you're starting and accessing the server?

I don't think there are any configuration examples, since it's not a common use-case, but something like:

mcp = FastMCP("MyServer")
app = mcp.http_app()

if __name__ == "__main__":
    uvicorn.run(
        app,
        host=host,
        port=port,
        ssl_keyfile="./private.pem",
        ssl_certfile="./certificate.pem"
    )

Should work without issues.

If it's not within the initialization of the web server, maybe check that the format of the files is correct. uvicorn uses SSLContext::load_cert_chain in the background, so take a look at requirements and caveats while using self-signed certificates: https://docs.python.org/3/library/ssl.html#self-signed-certificates

[Colvin-Y]

It do works, all the errors are due to my incorrect setup on the client side.
Thanks! :)