Product

MCP Proxy

A small proxy you run on your laptop or in your VPC. Your MCP tools stay on your network; Lexicor Cloud holds policy, config, and usage evidence.

What it is

Many agent setups talk to Model Context Protocol (MCP) servers for CRM, calendars, or internal tools. The Lexicor MCP Proxy sits in front of those servers:

Tool calls and tool data never leave your network
Results can be mediated (policy-checked) before they return to the agent
Decisions land in your Cloud ledger with boundary_id = mcp-proxy

Who needs it

Teams that use MCP servers with private data and want Lexicor mediation + audit without sending tool traffic to Lexicor’s network.

Entitlement

Requires the mcp_proxy add-on ($129/mo on Standard or Pro). Included on Enterprise. Without it, MCP Proxy API routes return 403. For request sync without tools, see Lexicor Edge ($79/mo). Tier availability and other limits: Plans & pricing.

Get the add-on

Sign in at console.lexicor.io on a Standard or Pro plan (or upgrade from trial first — see Upgrade).
Open Add-ons → MCP Proxy in the console, or ask support to enable the entitlement.
Confirm you can open the MCP Proxy page without a 403 error.

Configure upstreams

In the console: Add-ons → MCP Proxy — add your MCP servers (URL or local command). Or via API:

config

curl -X PUT https://api.lexicor.io/v1/governance/mcp-proxy/config \
  -H "X-API-Key: $LEXICOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "upstream_servers": [
      {"name": "crm", "url": "http://10.0.0.5:3001/mcp"},
      {"name": "calendar", "command": "npx calendar-mcp-server"}
    ],
    "mediation": {"normalize_results": true}
  }'

Upstream addresses are resolved by the proxy on your side — Cloud never connects to them.

Run the proxy

run proxy

pip install 'lexicor[mcp]'
export LEXICOR_API_URL=https://api.lexicor.io
export LEXICOR_API_KEY=lx-...   # from console Settings
lexicor-mcp-proxy --transport http --port 8101

On start, the proxy pulls config from your tenant. About every five minutes it reports tool-call usage back to Cloud (failures never take the proxy down).

Point MCP clients at it

Configure Claude Desktop, your IDE, or any MCP client to use http://localhost:8101 (or stdio mode). Clients talk to the proxy; the proxy talks to your upstreams.

Verify usage

usage

curl https://api.lexicor.io/v1/governance/mcp-proxy/usage \
  -H "X-API-Key: $LEXICOR_API_KEY"

You should also see mediated decisions in Evidence → Audit Log in the console.