Protect your origin with the origin secret
When you connect a server, MCP Tower gives you an origin secret. MCP Tower adds it to every request
it forwards in the X-MCP-Tower-Origin-Secret header. Your server should reject requests that don’t
carry it, so agents can’t bypass MCP Tower by calling your origin directly. A coming check will
verify that your origin rejects requests without the header.
This page will give a complete configuration for each server below.
How to reject requests without the X-MCP-Tower-Origin-Secret header in an nginx location block.
How to match the header with a Caddy request matcher and respond 403 otherwise.
Express
Section titled “Express”An Express middleware that compares the header with the secret before your MCP routes.
FastAPI
Section titled “FastAPI”A FastAPI dependency or middleware that checks the header before your MCP endpoint.
Uptime checks
Section titled “Uptime checks”MCP Tower checks that your server answers by listing its tools on a schedule you choose per server:
off, or every N minutes (every minute by default). These requests carry the origin secret like any
other request from MCP Tower, so your server accepts them, and they are identified by
User-Agent: MCP-Tower-Uptime/1. MCP Tower’s daily scans of your tools send
User-Agent: MCP-Tower-Scanner/1. Filter both out of your own logs by that header.