CR
CloudSecurity

CreateveAI Nexus MCP Server for Azure and On-Prem

**Crafting a concise action statement**

View on GitHub

Overview

CreateveAI Nexus MCP Server implements the Model Context Protocol (MCP) as a self-hostable service that exposes tools and resources for large language models (LLMs). It provides a standardized HTTP surface for publishing a manifest of available tools, handling tool invocation requests, and enforcing access controls — useful when you need to connect cloud LLMs or local agents to your internal systems without embedding credentials directly in model prompts.

The server is designed to run both in Azure and on-premises environments. That flexibility helps teams preserve data residency and compliance requirements while still enabling model-driven workflows. Typical deployments put the MCP server behind TLS and an identity layer (for example Azure AD) so that only permitted models or clients can discover and invoke tools.

Features

  • MCP-compliant HTTP endpoints: manifest publication and invocation handling
  • Runs in cloud (Azure) or on-premises with the same codebase
  • Configurable authentication and authorization hooks (token-based / OAuth)
  • Docker-friendly: container images and example compose files for quick startup
  • Pluggable resource adapters for file stores, HTTP fetchers, and custom tools
  • TLS and network controls recommended for secure deployments
  • Audit logging of invocations for traceability

Installation / Configuration

Prerequisites: Docker (or a build environment), optionally an Azure account and CLI for cloud deployments.

Clone the repo and build/run locally:

git clone https://github.com/spgoodman/createveai-nexus-server.git
cd createveai-nexus-server

# build a local image (if no prebuilt image is available)
docker build -t nexus-mcp-server .

# run with environment configuration
docker run -p 8080:8080 \
  -e MCP_BIND_ADDR=0.0.0.0:8080 \
  -e MCP_AUTH_MODE=token \
  -e MCP_AUTH_TOKEN=replace-with-secure-token \
  nexus-mcp-server

Example .env (for docker-compose):

MCP_BIND_ADDR=0.0.0.0:8080
MCP_AUTH_MODE=oauth2       # "token" or "oauth2"
MCP_AUTH_TOKEN=supersecret # only used for token mode
MCP_MANIFEST_PATH=/config/manifest.json
MCP_LOG_LEVEL=info

Example docker-compose snippet:

version: "3.8"
services:
  nexus:
    image: createveai/nexus-mcp-server:latest
    ports:
      - "8080:8080"
    env_file:
      - .env
    volumes:
      - ./config:/config

Azure deployment notes:

  • For Azure App Service, use the container image and configure app settings with the same env vars.
  • For Kubernetes (AKS), deploy as a Deployment with a Service and configure an Ingress or Application Gateway to terminate TLS.
  • Integrate with Azure AD for OAuth2 authentication and set MCP_AUTH_MODE=oauth2.

Available Tools / Resources

CreateveAI Nexus exposes resources as MCP tools. Typical adapters you may find or implement:

  • File storage adapter (local disk, Azure Blob): upload/download files for model access
  • HTTP fetcher: safe outbound HTTP calls with allow-listing and rate limits
  • Command/worker adapter: run predefined commands or jobs in a sandbox (use with caution)
  • Identity adapter: introspect client identity when OAuth2 is enabled

Note: The exact set of adapters depends on your fork or configuration. Check the /config/manifest.json file in your deployment to see the live tool list.

Use Cases

  1. Hybrid data access for cloud LLMs

    • Scenario: A cloud-hosted LLM needs to read internal documents stored on-prem.
    • How: Deploy the MCP server on-prem, expose a file storage adapter only to authorized model tokens. The LLM fetches document content via MCP invocation instead of copying data to the cloud.

  2. Controlled web browsing or API access

    • Scenario: An assistant must call external APIs but you want to limit endpoints and log requests.
    • How: Use the HTTP fetcher adapter with an allow-list and audit logging, so model-initiated requests are mediated and recorded.

  3. Secure automation from prompts

    • Scenario: Convert a user’s natural-language intent into a safe operational task (e.g., generate a report).
    • How: Publish a limited set of job adapters (report-generation tasks) via MCP; each invocation requires a token and is logged for compliance.

Security and Operational Considerations

  • Always terminate TLS at the edge. Do not expose the MCP server over plain HTTP on untrusted networks.
  • Use OAuth2 (Azure AD) for production authentication and avoid static tokens where possible.
  • Principle of least privilege: publish only the minimal set of tools required to the manifest.
  • Enable audit logging and integrate logs with your SIEM for forensic traceability.
  • Run sensitive adapters (shell/command) in strong sandboxes or avoid them entirely in production.

References

  • Repository: https://github.com/spgoodman/createveai-nexus-server
  • Check the repo’s config/manifest.json and examples directory for concrete adapter implementations and sample manifests.
Tags:cloudsecurity