Operating an MCP Proxy at Scale

I share practical lessons from operating an MCP proxy across many users, clients, and remote servers, focusing on authentication reliability, request efficiency, and visibility into server behavior. The discussion centers on implementation concerns and does not attempt to provide a full walkthrough of OAuth authorization.

■ Authentication and token management
- Refresh-token acquisition, concurrent refresh requests, and recovery from authorization errors
■ Request efficiency and observability
- MCP session and tool-list caching, contextual errors, structured logs, and server health
■ Implementation considerations
- Authentication metadata and endpoint overrides, plus caching discovery results

This is aimed at developers building MCP proxies or servers and teams integrating OAuth providers. I outline areas to plan for and checks to consider, including distributed locking, caching, and clear error reporting.