MCP Server Proxy Setup: Giving Your Model Tools A Clean Exit

What an MCP server does to your IP

Model Context Protocol servers expose tools — fetch a URL, run a search, read a page — that a model can call. Every one of those calls leaves from wherever the MCP server runs. Usually that is a cloud host, which means one datacenter IP making a stream of odd requests to whatever the model decided to look at. Sites block it quickly, and once they do, every tool call from that deployment fails.

Route tool calls through a proxy

Any MCP server built on standard HTTP libraries can be pointed at a proxy. The usual shapes:

Environment variables — HTTP_PROXY and HTTPS_PROXY set on the process cover most Node and Python HTTP clients without a code change.

Per-client configuration — pass the proxy URL when constructing the fetch client, which lets you use different exits for different tools.

Per-session credentials — encode the session ID in the proxy username so each conversation, or each tool, gets its own sticky IP.

A typical endpoint looks like http://user-session-abc123:password@gateway:port, where changing the session segment gives you a new exit and keeping it holds the same one.

Give each tool the exit it deserves

A documentation fetcher can live on datacenter IPs. A tool that reads product pages, checks local search results or opens a consumer site should use residential exits in the right country. Splitting them keeps costs sane and success rates high.

Guard against the model's enthusiasm

Models retry. Without limits, a failing tool becomes a loop that burns hundreds of requests and a lot of bandwidth in seconds. Put a hard cap on retries inside the tool, return a clear error to the model instead of retrying silently, and rate-limit per host.

Checklist

• Proxy configured at the HTTP client, not just documented
• Session ID per conversation for sticky behaviour
• Separate credentials for datacenter and residential tools
• Images and media blocked in any browser-based tool
• Retry cap and per-host rate limit inside the tool implementation