agent-mcp-mtls-util

corporate-mcp-client

SPIFFE/mTLS MCP client for Claude Desktop.

Fetches short-lived X.509 certificates from your external Cert API — no local SPIRE agent, no Python pre-installed, no cert files on disk.

How it works

Claude Desktop (stdio)
    |
    v
corporate-mcp-client  (spawned by uvx)
    |
    |-- POST /attest -> your Cert API  (gets 1h X.509 cert)
    |-- builds mTLS SSLContext in memory
    |
    v
Your Nginx (validates SPIFFE ID cert)
    |
    v
MCP Gateway -> MCP Server (unmodified)

claude_desktop_config.json

{
  "mcpServers": {
    "corporate-mcp": {
      "command": "uvx",
      "args": ["corporate-mcp-client"],
      "env": {
        "CERT_API_URL":     "https://cert-api.yourcompany.com",
        "ENROLLMENT_TOKEN": "your-enrollment-token-here",
        "MCP_SERVER_URL":   "https://your-mcp-server.com/mcp"
      }
    }
  }
}

Environment variables

Customer setup

# 1. Install uv (once)
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. Add config block to claude_desktop_config.json
# 3. Restart Claude Desktop
# Done — uvx handles everything else automatically