Caddy MCP

Documentation — Installation, deployment, usage across the API, agent, and MCP interfaces, and guidance for provisioning the Caddy backing server are maintained in the official documentation.

Caddy Reverse Proxy administrative and configuration orchestrator. Built with the highest architectural standards, incorporating dynamic facades, custom API routing, and FastMCP tool decoration.

Table of Contents

• Overview
• Features
• Installation
• Usage
• Environment Variables
• MCP Tools
• Architecture
• Deployment
• Contributing
• License

---

Overview

Caddy MCP provides a high-performance, model-optimized interface to Caddy capabilities. It isolates the model from underlying API transport complexity, ensuring safe, idempotent, and highly traceable system interactions.

---

Features

• Dynamic Facade Orchestration: Integrates multi-inheritance clients cleanly under a single facade.
• Battle-Tested Resilience: Out-of-the-box credential authentication, connection polling, and request retry strategies.
• FastMCP Declarative Tools: Fast, native schema registration with full inline validation.
• Complete Test Intent Diversity: Deep, automated unit, integration, and mock tests ensuring high code coverage.

---

⚙️ Dynamic Tool Selection & Visibility

This MCP server supports dynamic toolset selection and visibility filtering at runtime. This allows you to restrict the set of exposed tools in order to prevent blowing up the LLM's context window.

You can configure tool filtering via multiple input channels:

• CLI Arguments: Pass --tools or --toolsets (or their disabled counterparts --disabled-tools and --disabled-toolsets) during startup.
• Environment Variables: Define standard environment variables:
  • MCP_ENABLED_TOOLS / MCP_DISABLED_TOOLS
  • MCP_ENABLED_TAGS / MCP_DISABLED_TAGS
• HTTP SSE Request Headers: Pass custom headers during transport initialization:
  • x-mcp-enabled-tools / x-mcp-disabled-tools
  • x-mcp-enabled-tags / x-mcp-disabled-tags
• HTTP SSE Request Query Parameters: Append query parameters directly to your transport connection URL:
  • ?tools=tool1,tool2
  • ?tags=tag1

When query strings or parameters are supplied, an LLM-free Knowledge Graph resolution layer (using DynamicToolOrchestrator) matches query intents against known tool tags, names, or descriptions, with safe fallback and automated 24-hour background cache refreshing.

---

Installation

Pick the extra that matches what you want to run:

Extra	Installs	Use when
caddy-mcp[mcp]	Slim MCP server only (agent-utilities[mcp] — FastMCP/FastAPI)	You only run the MCP server (smallest install / image)
caddy-mcp[agent]	Full agent runtime (agent-utilities[agent,logfire] — Pydantic AI + the epistemic-graph engine)	You run the integrated agent
caddy-mcp[all]	Everything (mcp + agent)	Development / both surfaces

# MCP server only (recommended for tool hosting — slim deps)
uv pip install "caddy-mcp[mcp]"

# Full agent runtime (Pydantic AI + epistemic-graph engine)
uv pip install "caddy-mcp[agent]"

# Everything (development)
uv pip install "caddy-mcp[all]"      # or: python -m pip install "caddy-mcp[all]"

Container images (:mcp vs :agent)

One multi-stage docker/Dockerfile builds two right-sized images, selected by --target:

Image tag	Build target	Contents	Entrypoint
knucklessg1/caddy-mcp:mcp	--target mcp	caddy-mcp[mcp] — slim, no engine/pydantic-ai/dspy/llama-index/tree-sitter	caddy-mcp
knucklessg1/caddy-mcp:latest	--target agent (default)	caddy-mcp[agent] — full agent runtime + epistemic-graph engine	caddy-agent

docker build --target mcp   -t knucklessg1/caddy-mcp:mcp    docker/   # slim MCP server
docker build --target agent -t knucklessg1/caddy-mcp:latest docker/   # full agent

docker/mcp.compose.yml runs the slim :mcp server; docker/agent.compose.yml runs the agent (:latest) with a co-located :mcp sidecar.

Knowledge-graph database (epistemic-graph)

The full agent ([agent] / :latest) embeds the epistemic-graph engine (pulled in transitively via agent-utilities[agent]). For production — or to share one knowledge graph across multiple agents — run epistemic-graph as its own database container and point the agent at it instead of embedding it. Deployment recipes (single-node + Raft HA), connection config, and the full database architecture (with diagrams) are documented in the epistemic-graph deployment guide. The slim [mcp] server does not require the database.

---

Usage

You can launch the FastMCP server in stdio mode via Python module execution:

import asyncio
from caddy_mcp.mcp_server import get_mcp_instance

async def main():
    mcp = get_mcp_instance()
    # Execute stdio loop or launch server
    print("MCP Server ready.")

if __name__ == "__main__":
    asyncio.run(main())

For direct shell launch, execute:

python -m caddy_mcp.mcp_server

---

Environment Variables

Package environment variables

Variable	Example	Description
CADDY_URL	http://localhost:2019	Caddy Administration API URL endpoint
CADDY_TOKEN	your_secure_bearer_token	Optional bearer token if API is secured
CADDY_MCP_BASE_URL	http://localhost:2019	Alternate Caddy Admin API URL (fallback when CADDY_URL is unset)
CADDY_MCP_USERNAME	—	Basic-auth username for the Caddy Admin API
CADDY_MCP_PASSWORD	—	Basic-auth password for the Caddy Admin API
CADDY_MCP_SSL_VERIFY	true	Verify TLS certificates when calling the Caddy Admin API
CONFIGTOOL	true	Toggle the Caddy config / debug / PKI / reverse-proxy tools

Inherited agent-utilities variables (apply to every connector)

Variable	Example	Description
TRANSPORT	stdio	MCP transport: stdio
HOST	0.0.0.0	Bind host (HTTP transports)
PORT	8000	Bind port (HTTP transports)
MCP_TOOL_MODE	condensed	Tool surface: condensed
MCP_ENABLED_TOOLS	—	Comma-separated tool allow-list
MCP_DISABLED_TOOLS	—	Comma-separated tool deny-list
MCP_ENABLED_TAGS	—	Comma-separated tag allow-list
MCP_DISABLED_TAGS	—	Comma-separated tag deny-list
EUNOMIA_TYPE	none	Authorization mode: none
EUNOMIA_POLICY_FILE	mcp_policies.json	Embedded Eunomia policy file
EUNOMIA_REMOTE_URL	—	Remote Eunomia authorization server URL
ENABLE_OTEL	False	Enable OpenTelemetry export
OTEL_EXPORTER_OTLP_ENDPOINT	—	OTLP collector endpoint
MCP_CLIENT_AUTH	—	Outbound MCP auth (oidc-client-credentials for fleet calls)
OIDC_CLIENT_ID	—	OIDC client id (service-account auth)
OIDC_CLIENT_SECRET	—	OIDC client secret (service-account auth)
DEBUG	False	Verbose logging
PYTHONUNBUFFERED	1	Unbuffered stdout (recommended in containers)
MCP_URL	http://localhost:8000/mcp	URL of the MCP server the agent connects to
PROVIDER	openai	LLM provider for the agent
MODEL_ID	gpt-4o	Model id for the agent
ENABLE_WEB_UI	True	Serve the AG-UI web interface

7 package + 22 inherited variable(s). Auto-generated from .env.example + the shared agent-utilities set — do not edit.

Every variable the server reads, grouped by purpose. A local template is supplied inside .env.example — copy it as .env and fill out your specific service endpoint parameters before starting execution.

Connection & Credentials

Variable	Description	Default
CADDY_URL	Caddy Administration API URL endpoint	http://localhost:2019
CADDY_TOKEN	Optional bearer token if the Admin API is secured	—

MCP server / transport

Variable	Description	Default
TRANSPORT	stdio, streamable-http, or sse	stdio
HOST	Bind host (HTTP transports)	0.0.0.0
PORT	Bind port (HTTP transports)	8000
MCP_TOOL_MODE	Tool surface: condensed, verbose, or both	condensed
MCP_ENABLED_TOOLS / MCP_DISABLED_TOOLS	Comma-separated tool allow/deny list	—
MCP_ENABLED_TAGS / MCP_DISABLED_TAGS	Comma-separated tag allow/deny list	—
DEBUG	Verbose logging	False
PYTHONUNBUFFERED	Unbuffered stdout (recommended in containers)	1

Tool toggles

Each action-routed tool can be disabled individually via its toggle env var (set to false). See the MCP Tools table above for the authoritative names.

Variable	Description	Default
CONFIGTOOL	Toggle the Caddy config / debug / PKI / reverse-proxy tools	True

Telemetry & governance

Variable	Description	Default
ENABLE_OTEL	Enable OpenTelemetry export	True
OTEL_EXPORTER_OTLP_ENDPOINT	OTLP collector endpoint	—
OTEL_EXPORTER_OTLP_PUBLIC_KEY / OTEL_EXPORTER_OTLP_SECRET_KEY	OTLP auth keys	—
OTEL_EXPORTER_OTLP_PROTOCOL	OTLP protocol (e.g. http/protobuf)	—
EUNOMIA_TYPE	Authorization mode: none, embedded, remote	none
EUNOMIA_POLICY_FILE	Embedded policy file	mcp_policies.json
EUNOMIA_REMOTE_URL	Remote Eunomia server URL	—

Agent CLI (full [agent] runtime only)

Variable	Description	Default
MCP_URL	URL of the MCP server the agent connects to	http://localhost:8000/mcp
PROVIDER	LLM provider (e.g. openai)	openai
MODEL_ID	Model id (e.g. gpt-4o)	gpt-4o
ENABLE_WEB_UI	Serve the AG-UI web interface	True

---

MCP Tools

The table below is auto-generated from the live server — do not edit by hand.

Condensed action-routed tools (default — MCP_TOOL_MODE=condensed)

MCP Tool	Toggle Env Var	Description
caddy_mcp_config	CONFIGTOOL	Manage Caddy configuration and server control.
caddy_mcp_debug	CONFIGTOOL	Inspect Caddy observability and profiling endpoints (metrics, expvar, pprof).
caddy_mcp_pki	CONFIGTOOL	Manage Caddy PKI app CAs and certificates.
caddy_mcp_reverse_proxy	CONFIGTOOL	Query Caddy reverse proxy upstream health and status.

Verbose 1:1 API-mapped tools (MCP_TOOL_MODE=verbose or both)

21 per-operation tools — one per public API method (click to expand)

MCP Tool	Toggle Env Var	Description
caddy_adapt_config	APITOOL	Adapts a configuration to Caddy JSON without loading or running it.
caddy_delete_config	APITOOL	Deletes the value at the named path.
caddy_delete_id	APITOOL	DELETE config via @id tag.
caddy_get_config	APITOOL	Exports Caddy's current configuration at the named path.
caddy_get_debug_pprof	APITOOL	Fetches a Go pprof profile from the admin endpoint (GET /debug/pprof/).
caddy_get_debug_vars	APITOOL	Returns the Go expvar variables published on the admin endpoint (GET /debug/vars).
caddy_get_id	APITOOL	GET config via @id tag. E.g. id_path='my_proxy/upstreams'
caddy_get_metrics	APITOOL	Scrapes Caddy's Prometheus metrics from the admin endpoint (GET /metrics).
caddy_get_pki_ca	APITOOL	Returns information about a particular PKI app CA.
caddy_get_pki_ca_certificates	APITOOL	Returns the certificate chain of a particular PKI app CA.
caddy_get_reverse_proxy_upstreams	APITOOL	Returns the current status of the configured reverse proxy upstreams.
caddy_get_routes	APITOOL	Retrieve Caddy route mappings.
caddy_load_config	APITOOL	Sets Caddy's configuration, overriding any previous configuration.
caddy_patch_config	APITOOL	Replaces an existing object or array element at the named path.
caddy_patch_id	APITOOL	PATCH config via @id tag.
caddy_post_config	APITOOL	Sets or replaces object, or appends to array at the named path.
caddy_post_id	APITOOL	POST config via @id tag.
caddy_put_config	APITOOL	Creates new object or inserts into array at the named path.
caddy_put_id	APITOOL	PUT config via @id tag.
caddy_set_config	APITOOL	Alias for post_config.
caddy_stop_server	APITOOL	Gracefully shuts down the server and exits the process.

4 action-routed tool(s) (default) · 21 verbose 1:1 tool(s). Each is enabled unless its <DOMAIN>TOOL toggle is set false; MCP_TOOL_MODE selects the surface (condensed default · verbose 1:1 · both). Auto-generated — do not edit.

See docs/overview.md or docs/concepts.md for deeper operational examples.

---

Architecture

This package uses the standardized Agent-Utilities dynamic facade architecture:

graph TD
    User([User Agent]) --> Server[FastMCP Server]
    Server --> Facade[Api Dynamic Facade]
    Facade --> ClientBase[ApiClientBase]
    Facade --> Auth[Credentials Auth Handler]
    ClientBase --> Service([External Service API])

---

Deployment

Bare-Metal (Standard pip)

1. Set up your Python virtual environment (>= 3.10).
2. Install the package: pip install .[all]
3. Export credentials:

   export CADDY_URL="http://localhost:2019"
   

4. Run: python -m caddy_mcp.mcp_server

Container (Docker Compose)

A standard compose structure is provided inside the docker/ folder. Build and deploy:

docker compose -f docker/compose.yml up --build -d

---

Additional Deployment Options

caddy-mcp can also run as a local container (Docker / Podman / uv) or be consumed from a remote deployment. The Deployment guide has full, copy-paste mcp_config.json for all four transports — stdio, streamable-http, local container / uv, and remote URL:

• Local container / uv — launch the server from mcp_config.json via uvx, docker run, or podman run, or point at a local streamable-http container by url.
• Remote URL — connect to a server deployed behind Caddy at http://caddy-mcp.arpa/mcp using the "url" key.

Contributing

Please audit all code changes against ecosystem guidelines in CONTRIBUTING.md if available, and run:

pre-commit run --all-files

---

Documentation

The complete documentation is published as the official documentation site and is the recommended reference for installation, deployment, and day-to-day operation.

Page	Contents
Installation	pip, source, extras, prebuilt Docker image
Deployment	run the MCP and agent servers, Compose, Caddy + Technitium, env config
Usage	the MCP tools, the Api client, the agent
Backing Platform	deploy Caddy with Docker and connect the Admin API
Overview	integration architecture and tool surface
Concepts	concept registry (CONCEPT:CADDY-*)

AGENTS.md is the canonical contributor/agent guidance.

License

This project is licensed under the MIT License. See the LICENSE file for complete details.

Deploy with agent-os-genesis

This package can be provisioned for you — skill-guided — by the agent-os-genesis universal skill (its single-package deploy mode): it picks your install method, seeds secrets to OpenBao/Vault (or .env), trusts your enterprise CA, registers the MCP server, and verifies it — the same machinery that stands up the whole Agent OS, narrowed to just this package. Ask your agent to "deploy caddy-mcp with agent-os-genesis".

Install mode	Command
Bare-metal, prod (PyPI)	uvx caddy-mcp · or uv tool install caddy-mcp
Bare-metal, dev (editable)	uv pip install -e ".[all]" · or pip install -e ".[all]"
Container, prod	deploy knucklessg1/caddy-mcp:latest via docker-compose / swarm / podman / podman-compose / kubernetes
Container, dev (editable)	deploy docker/compose.dev.yml (source-mounted at /src; edits live on restart)

Secrets are read-existing + seeded via vault_sync — you are only prompted for what's missing.