Install an MCP server

An MCP server is one container that runs on any host the platform can reach. You install it from the deploy/ directory of the server’s repository. The platform is not touched. Adding the address to the platform and approving it is a separate task: Servers.

Servers

Server	Environment file	Variables to fill in	Details
GitLab	`mcp-gitlab.env`	`MCP_GATEWAY_JWKS_URI`, `MCP_CONNECT_URL`, `MCP_GITLAB_URL`	deploy/README
Jira Data Center	`mcp-jira.env`	`MCP_GATEWAY_JWKS_URI`, `MCP_CONNECT_URL`, `MCP_JIRA_URL`	deploy/README
Confluence Data Center	`mcp-confluence.env`	`MCP_GATEWAY_JWKS_URI`, `MCP_CONNECT_URL`, `MCP_CONFLUENCE_URL`	deploy/README
OpenSearch	`mcp-opensearch.env`	`MCP_GATEWAY_JWKS_URI`, `MCP_CONNECT_URL`, `MCP_OPENSEARCH_URL`, `MCP_OPENSEARCH_INDEX_PREFIXES`	deploy/README
Service desk	`mcp-servicedesk.env`	`MCP_GATEWAY_JWKS_URI`, `MCP_CONNECT_URL`, `MCP_SERVICEDESK_URL`	deploy/README
REST adapter	`mcp-adapter.env`	`MCP_SERVER_ID`, `MCP_GATEWAY_JWKS_URI`, `MCP_CONNECT_URL`, `MCP_FOREIGN_URL`	deploy/README

Server-specific steps stay in the linked README:

OpenSearch needs a role in the cluster’s Security plugin that accepts the user’s token. The server refuses to start without index prefixes.
The service desk server needs a servicedesk.api file for products other than the reference layout, and the platform’s service account key in OpenBao (secret/mcp/service-accounts/servicedesk, written with bao kv put).
The adapter needs the address of the third-party MCP server on a network that only the adapter shares with it.

Requirements

Docker Engine with Compose v2.20 or newer, 1 GiB of memory.
The domain of the platform. The host must reach https://<platform> on port 443.
The platform host must reach this host on port 8443.
The address (https) of the backend system.

Install

The example uses the GitLab server. Replace names for another server from the table.

Get the deploy/ directory:

git clone https://github.com/aiwcorpo/mcp-server-gitlab.git
cd mcp-server-gitlab/deploy

Fill in the empty values of the environment file:
Terminal window
```
MCP_GATEWAY_JWKS_URI=https://<platform>/.well-known/mcp-jwks.json
MCP_CONNECT_URL=https://<platform>/connections?system={system}
MCP_GITLAB_URL=https://<gitlab>
```
The file holds no credential of the backend. The gateway sends each user’s own credential with every call.
If the platform certificate is signed by a company CA, add that CA to a trust store:
Terminal window
```
keytool -importcert -noprompt -alias company-ca -file company-ca.crt \
  -keystore certs/truststore.p12 -storetype PKCS12 -storepass changeit
chmod 644 certs/truststore.p12
```
Then uncomment the JAVA_TOOL_OPTIONS line in the environment file. If the backend system uses a CA that the JVM does not know, import that CA into the same file.
Start the server:
Terminal window
```
docker compose up -d
```
The server refuses to start with an incomplete file and says what is missing.
Read the certificate fingerprint:
Terminal window
```
docker compose logs mcp-gitlab | grep event=tls_certificate
```
Expected: event=tls_certificate source=generated fingerprint=sha256:.... Without a certificate of its own, the server generates a self-signed one on its first start and keeps it in the state volume.
Send the platform operator the address https://<this host>:8443/mcp and the fingerprint.

Check that it works

curl -fsSk https://localhost:8443/actuator/health

Expected: {"status":"UP"...}. Every other path answers 401 without a token from the gateway.

Your own certificate

Put a PEM pair or a PKCS12 keystore in certs/ and set MCP_TLS_CERT and MCP_TLS_KEY, or MCP_TLS_KEYSTORE and MCP_TLS_STORE_PASSWORD, in the environment file. A certificate from a CA that the gateway trusts, for the host name in the address, is trusted without pinning, and a renewal needs no new approval. See MCP_SERVER_TRUSTED_CAS_FILE in Configure.

Keep the state volume

The state volume keeps the generated certificate. If it is recreated (docker compose down -v), the server generates a new certificate, its status in the portal becomes certificate_changed, and the operator must approve the new fingerprint.

Several instances

Instances behind one address need the same values in the environment file:

Setting	Why
`MCP_REDIS_HOST` and the other `MCP_REDIS_*`	One-time token ids shared between instances
`MCP_PAGING_CURSOR_KEY` (`openssl rand -base64 32`)	A cursor from one instance works on another
`MCP_TLS_CERT` and `MCP_TLS_KEY`	The gateway sees one fingerprint

Closed network

Set MCP_REGISTRY in a .env file next to compose.yaml, or load the images from the offline package:

MCP_REGISTRY=<your-registry>/mcp

Upgrade from 1.x

See Upgrade.

When it fails

See Troubleshooting.