Protect your origin with the origin secret
When you connect a server, MCP Tower gives you an origin secret. MCP Tower adds it to every request
it forwards in the X-MCP-Tower-Origin-Secret header. Your server should reject requests that don’t
carry it, so agents can’t bypass MCP Tower by calling your origin directly. MCP Tower’s health checks
verify that your origin rejects requests without the header.
This page will give a complete configuration for each server below.
How to reject requests without the X-MCP-Tower-Origin-Secret header in an nginx location block.
How to match the header with a Caddy request matcher and respond 403 otherwise.
Express
Section titled “Express”An Express middleware that compares the header with the secret before your MCP routes.
FastAPI
Section titled “FastAPI”A FastAPI dependency or middleware that checks the header before your MCP endpoint.