Monitor servers that aren't on the internet.

Plenty of MCP servers never accept a network connection. They run over stdio on a workstation, or inside a private network with no route in from outside. A cloud prober can't reach them — by design, and that's usually the point.

The bridge is a small agent you run next to those servers. It talks to them locally, and reports their health and inventory outbound to MCPatrol. Nothing listens on a public port, nothing is exposed, and no inbound firewall rule is needed.

What you need

• A machine that can reach the servers — your workstation, a jump box, a container in the same network.
• A MCPatrol account with the cloud backend connected in the app.
• Outbound HTTPS from that machine. That's the only network requirement.

Setting it up

1. Get the agent. The bridge ships with the MCPatrol source. If you don't have a copy, email [email protected] with the subject "MCPatrol bridge agent" and you'll get a download link.
2. Get your config from the app. Open MCPatrol → Manage → PC bridges → Copy bridge.json. The app fills in your backend URL and your API key, so there's nothing to look up. Save it as bridge.json next to the agent.
3. List your servers in that file — a name and the command that starts each one (see the shape below).
4. Run it. The machine appears under PC bridges within a minute, and its servers join your estate alongside the hosted ones.

The config

What the app copies, with your own values filled in:

{
  "backendUrl": "https://your-backend...",
  "apiKey": "moc_...",
  "machine": "my-machine",
  "servers": [
    {
      "name": "filesystem-mcp",
      "command": "npx",
      "args": "-y @modelcontextprotocol/server-filesystem /path"
    }
  ]
}

The API key in that file is your account credential — treat the file like a password. Anyone holding it can read and change your monitoring data.

What it sends

• Health state, latency, and the server's tool/resource/prompt inventory — the same things the cloud prober records for a public server.
• Per-request traffic metadata (method name, size, duration) when you run it in shim mode.
• Request and response bodies only if you explicitly turn payload capture on. It's off by default, and payloads are redacted before they leave the machine.

It never opens an inbound port, and it never sends the contents of files or environment variables. Details in the privacy policy.

Questions? Contact.