Skip to content

Network & Transports

Guidance for securing MCP transports and webhooks when running Faxbot in production.

MCP Transports

  • HTTP (Node MCP)
  • Port: 3001 (default)
  • Protect with MCP_HTTP_API_KEY; set strict MCP_HTTP_CORS_ORIGIN (no * when credentials).

  • Run behind TLS via reverse proxy; add IP allowlists and rate limits where appropriate.

  • SSE (Node/Python MCP)

  • Ports: 3002 (Node), 3003 (Python)
  • Require OAuth2/JWT in production. Configure OAUTH_ISSUER, OAUTH_AUDIENCE, and (optionally) OAUTH_JWKS_URL.

  • Run behind TLS; validate tokens against your IdP; set short TTLs.

  • WebSocket (Node MCP)

  • Port: 3004 (default)
  • Protect with MCP_WS_API_KEY (or reuse API_KEY) and run behind TLS or an authenticated proxy.
  • Use only for trusted clients or internal networks.

Webhooks & Callbacks

  • Phaxio (outbound status)
  • Endpoint: POST /phaxio-callback
  • Signature: X-Phaxio-Signature (HMAC-SHA256 of raw body using PHAXIO_API_SECRET)

  • Always use HTTPS public URLs; avoid exposing staging/test endpoints publicly.

  • Phaxio (inbound)

  • Endpoint: POST /phaxio-inbound

  • Signature: X-Phaxio-Signature (HMAC-SHA256)

  • Sinch (inbound)

  • Endpoint: POST /sinch-inbound
  • Basic auth: SINCH_INBOUND_BASIC_USER/PASS

  • HMAC: X-Sinch-Signature with SINCH_INBOUND_HMAC_SECRET

  • SIP/Asterisk (inbound)

  • Endpoint: POST /_internal/asterisk/inbound
  • Header: X-Internal-Secret: <ASTERISK_INBOUND_SECRET>
  • Only accessible over private networks; do not expose publicly.

Reverse Proxy Recommendations

  • Enforce TLS; redirect HTTP→HTTPS.
  • Set security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy).
  • Limit request sizes; apply rate limits and IP restrictions as needed.
  • Do not log PHI; log IDs and generic metadata only.