Local stdio bridge for MCP clients connecting to IAP-protected remote MCP servers
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"iap-mcp-proxy","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# iap-mcp-proxy A client-side bridge that lets generic MCP clients (Claude Desktop, Claude Code, Cursor, ...) connect to remote MCP servers protected by **Google Cloud Identity-Aware Proxy (IAP)**. This is a Python port of [knwoop/iap-mcp-proxy](https://github.com/knwoop/iap-mcp-proxy). ``` ┌──────────────┐ stdio ┌───────────────┐ HTTPS + ID token ┌─────┐ ┌────────────┐ │ MCP client │ ────────────────────► │ iap-mcp-proxy │ ───────────────────► │ IAP │ ───► │ MCP server │ │ (Claude etc.)│ │ (this tool) │ Proxy-Authorization │ │ │ (Cloud Run)│ └──────────────┘ └───────────────┘ └─────┘ └────────────┘ ``` IAP expects a Google-issued OIDC ID token (or, for managed Cloud Run IAP, a self-signed service-account JWT). The MCP spec's OAuth 2.1 flow cannot produce these tokens, so generic clients get a 401/redirect and stop. This proxy runs locally, obtains and refreshes Google credentials, attaches them as `Proxy-Authorization` (IAP consumes and strips this header), and forwards MCP traffic (Streamable HTTP) upstream. ## Install From [PyPI](https://pypi.org/project/iap-mcp-proxy/): ```bash pip install iap-mcp-proxy # or uv pip install iap-mcp-proxy ``` ExtensibilityAI also publishes the same versions to the private Artifact Registry PyPI index for internal consumers. Or install from source with [uv](https://docs.astral.sh/uv/): ```bash git clone https://github.com/ExtensibilityAI/iap-mcp-proxy.git cd iap-mcp-proxy uv sync uv run iap-mcp-proxy --version ``` ## Quick start 1. Make sure you have credentials IAP will accept (see [Credentials](#credentials)): ```bash gcloud auth application-default login ``` 2. Add the proxy to your MCP client config. Cursor / Claude Desktop: ```json { "mcpServers": { "internal-tools": { "command": "iap-mcp-proxy", "args": [ "--audience", "1234567890-abc.apps.googleus…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.