Help us improve
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
By jmagar
SWAG reverse proxy configuration management via MCP. Create, edit, view, and manage nginx proxy configurations with auth integration.
npx claudepluginhub jmagar/claude-homelab --plugin swag-mcpThis plugin requires configuration values that are prompted when the plugin is enabled. Sensitive values are stored in your system keychain.
swag_mcp_urlPublic HTTP MCP endpoint including /mcp, e.g. https://swag.example.com/mcp.
${user_config.swag_mcp_url}swag_mcp_hostHost interface the MCP server binds to. Docker deployments normally use 0.0.0.0.
Share bugs, ideas, or general feedback.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
${user_config.swag_mcp_host}swag_mcp_portPublished host port for the HTTP MCP server.
${user_config.swag_mcp_port}swag_mcp_tokenBearer token used to authenticate HTTP MCP requests.
${user_config.swag_mcp_token}swag_mcp_log_levelServer log level: DEBUG, INFO, WARNING, ERROR, or CRITICAL.
${user_config.swag_mcp_log_level}fastmcp_server_authOptional FastMCP auth provider class, e.g. fastmcp.server.auth.providers.google.GoogleProvider.
${user_config.fastmcp_server_auth}swag_mcp_log_directoryDirectory for SWAG MCP server logs.
${user_config.swag_mcp_log_directory}swag_mcp_rate_limit_rpsRequests per second limit when rate limiting is enabled.
${user_config.swag_mcp_rate_limit_rps}swag_mcp_proxy_confs_uriOptional local path or SSH URI for SWAG proxy configs. Overrides SWAG_MCP_PROXY_CONFS_PATH when set.
${user_config.swag_mcp_proxy_confs_uri}swag_mcp_proxy_confs_pathContainer/local path where SWAG proxy configurations are mounted, e.g. /proxy-confs.
${user_config.swag_mcp_proxy_confs_path}swag_mcp_rate_limit_burstBurst capacity above the configured requests-per-second limit.
${user_config.swag_mcp_rate_limit_burst}swag_mcp_rate_limit_enabledWhether request rate limiting middleware is enabled.
${user_config.swag_mcp_rate_limit_enabled}swag_mcp_swag_log_base_pathBase path for SWAG log files on the SWAG host or container.
${user_config.swag_mcp_swag_log_base_path}swag_mcp_default_quic_enabledWhether generated SWAG configs enable QUIC by default.
${user_config.swag_mcp_default_quic_enabled}swag_mcp_backup_retention_daysNumber of days to retain generated config backup files.
${user_config.swag_mcp_backup_retention_days}swag_mcp_health_check_insecureDisable TLS verification for health checks. Use only for development/internal networks.
${user_config.swag_mcp_health_check_insecure}swag_mcp_default_web_auth_methodDefault SWAG/nginx auth method for generated web endpoints. This is not MCP server authentication.
${user_config.swag_mcp_default_web_auth_method}fastmcp_server_auth_google_base_urlPublic OAuth/MCP endpoint, including /mcp for path-mounted deployments.
${user_config.fastmcp_server_auth_google_base_url}fastmcp_server_auth_google_client_idGoogle OAuth client ID for FastMCP authentication.
${user_config.fastmcp_server_auth_google_client_id}fastmcp_server_auth_resource_base_urlPublic resource origin used for protected resource metadata.
${user_config.fastmcp_server_auth_resource_base_url}fastmcp_server_auth_google_client_secretGoogle OAuth client secret for FastMCP authentication.
${user_config.fastmcp_server_auth_google_client_secret}fastmcp_server_auth_google_redirect_pathRedirect callback path for FastMCP Google OAuth.
${user_config.fastmcp_server_auth_google_redirect_path}fastmcp_server_auth_google_required_scopesComma-separated OAuth scopes required by FastMCP Google authentication.
${user_config.fastmcp_server_auth_google_required_scopes}DevsForge Nginx configuration generator with reverse proxy, SSL/TLS, load balancing, caching, rate limiting, and security headers
Configure load balancers (ALB, NLB, Nginx, HAProxy)
Agent-native proxy node management with Hysteria2 & Xray/Trojan deployment guides
MikroTik router management and network automation
UniFi Network MCP server — manage network devices, clients, firewall, VPN, and more
The most comprehensive Claude Code plugin — 14+ agents, 56+ skills, 33+ commands, and production-ready hooks for TDD, security scanning, code review, and continuous learning
Query, monitor, and manage Unraid servers via GraphQL API through MCP tools. Supports system info, Docker, VMs, array/parity, notifications, plugins, rclone, and live telemetry.
Core homelab agents, commands, and setup/health skills for self-hosted service management. Includes interactive credential setup wizard and unified service health dashboard.
UniFi network management via MCP tools. Monitor devices, clients, network health, firewall rules, and perform management operations.
Gotify push notifications and management via MCP tools with HTTP fallback. Sends alerts for long-running tasks, plan completions, and blocked states.
Agents, commands, skills, and scripts for scaffolding, reviewing, aligning, and deploying homelab MCP server plugins. Includes canonical Python, TypeScript, and Rust server templates.
MCP server for managing SWAG reverse-proxy configuration files, backups, logs, and health checks. Uses a single swag action router backed by local filesystem or SSH-accessible SWAG config storage.
SWAG MCP generates and manages nginx subdomain proxy configurations for SWAG (Secure Web Application Gateway). Every generated config includes MCP-compatible security headers unconditionally, making configs suitable for both standard web services and MCP/AI services.
swag_mcp/: server, config, middleware, models, services, tools, and templatesconfig/: local config and test assetsdocs/: template notes, test commands, and design records.claude-plugin/, .codex-plugin/, gemini-extension.json: client manifestsdocker-compose.yaml, Dockerfile, entrypoint.sh: container deployment| Tool | Purpose |
|---|---|
swag | Unified action router for config, logs, backups, and health checks |
swag_help | Return help for the SWAG MCP server — lists all available actions and sub-actions |
| Action | Purpose | Required params |
|---|---|---|
list | List config files | none |
create | Create a new reverse-proxy config | config_name, server_name, upstream_app, upstream_port |
view | View config contents | config_name |
edit | Replace config contents | config_name, new_content |
update | Update a specific field | config_name, update_field, update_value |
remove | Remove a config | config_name |
logs | Read SWAG logs | none |
backups | List or clean up backup files | backup_action |
health_check | Probe a service endpoint | domain |
| URI | Type | Description |
|---|---|---|
swag:// | Directory | All active .conf files (excluding .sample) |
swag://configs/live | Stream | Real-time config change events |
swag://health/stream | Stream | Real-time health status for monitored services |
swag://logs/stream | Stream | Live nginx error log tail |
Install as a Claude Code plugin. You will be prompted for:
The plugin connects to the server's native streamable-HTTP endpoint.
/plugin marketplace add jmagar/claude-homelab
/plugin install swag-mcp @jmagar-claude-homelab
The plugin uses native HTTP transport and appends /mcp to the configured server URL.
cp .env.example .env
chmod 600 .env
# Edit .env with your paths and token
docker compose up -d
The container always runs on internal port 8000. Compose publishes it on
127.0.0.1:49152 by default; set SWAG_MCP_PORT to control the host port and
SWAG_MCP_BIND_ADDRESS only when you intentionally expose it beyond loopback.
just setup # copies .env.example and runs uv sync
just dev # starts the server
Two deployment paths are supported:
| Path | Transport | Credentials | Auth |
|---|---|---|---|
| Plugin (HTTP) | http | userConfig in plugin settings | Bearer token |
| Docker (HTTP) | http | .env file | Bearer token |
See docs/CONFIG.md for full variable reference. All variables use the SWAG_MCP_ prefix.
| Variable | Required | Default | Description |
|---|---|---|---|
SWAG_MCP_PROXY_CONFS_PATH | no | /swag/nginx/proxy-confs | Local path to SWAG proxy confs directory |
SWAG_MCP_PROXY_CONFS_URI | no | `` | Overrides PROXY_CONFS_PATH when set. Accepts a local path or SSH URI. |
SWAG_MCP_SWAG_LOG_BASE_PATH | no | /swag/log | Base path for SWAG log files (local or remote) |
SWAG_MCP_TEMPLATE_PATH | no | templates | Path to Jinja2 templates directory |
| Variable | Required | Default | Description |
|---|---|---|---|
SWAG_MCP_HOST | no | 127.0.0.1 | Bind address for the MCP server |
SWAG_MCP_BIND_ADDRESS | no | 127.0.0.1 | Docker host bind address for the published MCP port |
SWAG_MCP_PORT | no | 49152 | Host-side port (Docker only; container always uses 8000) |
SWAG_MCP_TOKEN | recommended | `` | Bearer token enforced by FastMCP for direct MCP server access |
SWAG_MCP_NO_AUTH | no | false | Set true only for loopback/proxy-isolated deployments without server auth |