{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_r2ady6dqukqy","handle":"iap-mcp-proxy","url":"https://wellknown.network/agents/iap-mcp-proxy","links":{"self":"https://wellknown.network/agents/iap-mcp-proxy/record.json","html":"https://wellknown.network/agents/iap-mcp-proxy","markdown":"https://wellknown.network/agents/iap-mcp-proxy/record.md","api":"https://wellknown.network/api/v1/agents/iap-mcp-proxy","status":"https://wellknown.network/api/v1/agents/iap-mcp-proxy/status","claim":"https://wellknown.network/agents/iap-mcp-proxy/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/iap-mcp-proxy/claim.json","badge":"https://wellknown.network/agents/iap-mcp-proxy/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/iap-mcp-proxy/history","tools":"https://wellknown.network/api/v1/agents/iap-mcp-proxy/tools"},"ard":{"identifier":"urn:air::server:iap-mcp-proxy","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"iap-mcp-proxy","summary":"Local stdio bridge for MCP clients connecting to IAP-protected remote MCP servers","description":"# iap-mcp-proxy\n\nA client-side bridge that lets generic MCP clients (Claude Desktop, Claude Code, Cursor, ...) connect to remote MCP servers protected by **Google Cloud Identity-Aware Proxy (IAP)**.\n\nThis is a Python port of [knwoop/iap-mcp-proxy](https://github.com/knwoop/iap-mcp-proxy).\n\n```\n┌──────────────┐        stdio          ┌───────────────┐   HTTPS + ID token   ┌─────┐      ┌────────────┐\n│  MCP client  │ ────────────────────► │ iap-mcp-proxy │ ───────────────────► │ IAP │ ───► │ MCP server │\n│ (Claude etc.)│                       │  (this tool)  │  Proxy-Authorization │     │      │ (Cloud Run)│\n└──────────────┘                       └───────────────┘                      └─────┘      └────────────┘\n```\n\nIAP expects a Google-issued OIDC ID token (or, for managed Cloud Run IAP, a self-signed service-account JWT). The MCP spec's OAuth 2.1 flow cannot produce these tokens, so generic clients get a 401/redirect and stop. This proxy runs locally, obtains and refreshes Google credentials, attaches them as `Proxy-Authorization` (IAP consumes and strips this header), and forwards MCP traffic (Streamable HTTP) upstream.\n\n## Install\n\nFrom [PyPI](https://pypi.org/project/iap-mcp-proxy/):\n\n```bash\npip install iap-mcp-proxy\n# or\nuv pip install iap-mcp-proxy\n```\n\nExtensibilityAI also publishes the same versions to the private Artifact Registry PyPI index for internal consumers.\n\nOr install from source with [uv](https://docs.astral.sh/uv/):\n\n```bash\ngit clone https://github.com/ExtensibilityAI/iap-mcp-proxy.git\ncd iap-mcp-proxy\nuv sync\nuv run iap-mcp-proxy --version\n```\n\n## Quick start\n\n1. Make sure you have credentials IAP will accept (see [Credentials](#credentials)):\n\n   ```bash\n   gcloud auth application-default login\n   ```\n\n2. Add the proxy to your MCP client config. Cursor / Claude Desktop:\n\n   ```json\n   {\n     \"mcpServers\": {\n       \"internal-tools\": {\n         \"command\": \"iap-mcp-proxy\",\n         \"args\": [\n           \"--audience\", \"1234567890-abc.apps.googleus…","publisher":null,"homepage":null,"repository":null,"version":"0.4.3","license":null,"protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:iap-mcp-proxy","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","summary":"pypi","version":"pypi","description":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"derived"},{"slug":"dev.version-control","name":"Version Control","confidence":0.745,"provenance":"derived"}],"categories":["dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"iap-mcp-proxy","registry":"pypi","observedAt":"2026-09-15T16:22:23.693Z","publishedAt":"2026-08-31T18:09:28.914184Z","latestVersion":"0.4.3"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"iap-mcp-proxy","url":"https://pypi.org/project/iap-mcp-proxy/","firstSeenAt":"2026-09-09T17:21:50.459Z","fetchedAt":"2026-09-15T16:21:27.055Z","normalizedAt":"2026-09-15T16:21:27.055Z"}]},"firstSeenAt":"2026-09-09T17:21:50.459Z","updatedAt":"2026-09-15T16:22:23.693Z"}