MCP server

The Polytomic MCP server lets MCP clients, such as Claude, work with your Polytomic deployment. On premises, you run the MCP server alongside Polytomic and expose it at its own hostname. Once it's running, your users connect to it as described in Using the MCP server on premises.

The Helm chart and all of our Terraform modules can deploy the MCP server. It's off by default.

Requirements

• A hostname for the MCP server, separate from Polytomic's, for example mcp.polytomic.example.com. Point its DNS record at your ingress or load balancer.
• A TLS certificate for that hostname. MCP clients connect over HTTPS.
• MCP image rel2026.10.07.02 or later. Use the same release as your Polytomic image.

Decide where your MCP clients connect from before you choose how to expose the server. Remote connectors in claude.ai and Claude Desktop connect from the internet, so the MCP server must be publicly reachable. If your MCP server is only reachable inside your network, your users connect through the Polytomic Connector instead.

Deploy with the Helm chart

The MCP server requires chart version 1.10.0 or later. Enable the MCP server and its ingress in your values file:

mcp:
  enabled: true
  ingress:
    enabled: true
    className: nginx
    hosts:
      - host: mcp.polytomic.example.com
        paths:
          - path: /
            pathType: ImplementationSpecific
    tls:
      - secretName: mcp-tls
        hosts:
          - mcp.polytomic.example.com

Then run helm upgrade with your values file.

⚠️

Enable the ingress

mcp.enabled alone starts the MCP server but doesn't expose it outside the cluster. You must also set mcp.ingress.enabled and at least one host.

The MCP server uses your Polytomic release (image.tag) by default. To run a different MCP release, set mcp.image.tag. See the chart documentation for every mcp.* value, including replicas and resources.

EKS and GKE Terraform modules

The EKS and GKE modules set these chart values for you. Both modules use these variables:

Each module also needs a certificate for the MCP hostname:

• EKS: set polytomic_mcp_certificate_arn to an ACM certificate ARN. If you leave it empty, the load balancer serves the MCP server over HTTP only.
• GKE: set polytomic_mcp_cert_name to a GCP managed SSL certificate and polytomic_mcp_ip_name to a global static IP. Both are required when the ingress is enabled.

If you set chart_version, it must be 1.10.0 or later.

Deploy on Amazon ECS

The MCP server requires ECS Terraform module version 2.10.0 or later. To upgrade, set your module source to ref=ecs-v2.10.0 and run terraform init -upgrade.

Add these variables to your module block:

module "polytomic-ecs" {
  # ...

  polytomic_image_tag   = "rel2026.10.21"
  polytomic_mcp_enabled = true
  polytomic_mcp_host    = "mcp.polytomic.example.com"
}

The MCP server uses your Polytomic release (polytomic_image_tag) by default, so polytomic_image_tag must be rel2026.10.07.02 or later. To run a different MCP image, set polytomic_mcp_image to a full image URI.

The module creates the MCP service and routes requests for polytomic_mcp_host to it on the load balancer's HTTP listener. When you enable the MCP server, your prefix must be 25 characters or fewer.

Serve the MCP server over HTTPS

The module doesn't create an HTTPS listener. If you added one, as the complete example does, add a rule that forwards the MCP hostname to the MCP server:

resource "aws_alb_listener_rule" "mcp_https" {
  listener_arn = aws_alb_listener.https.arn

  action {
    type             = "forward"
    target_group_arn = module.polytomic-ecs.mcp_target_group_arn
  }

  condition {
    host_header {
      values = ["mcp.polytomic.example.com"]
    }
  }
}

The listener's certificate must cover the MCP hostname, for example as a subject alternative name or with a wildcard certificate.

⚠️

HTTP stays open

The module's HTTP listener keeps forwarding the MCP hostname to the MCP server, even when load_balancer_redirect_https is true. MCP clients that use the https:// URL aren't affected.

Verify the deployment

The MCP server responds to health checks at /healthz:

curl https://mcp.polytomic.example.com/healthz

A 200 response means the MCP server is running and reachable. Your users' MCP server URL is https://mcp.polytomic.example.com/mcp.

Next steps

• Share Using the MCP server on premises with your users.
• Limit which MCP clients may sign in with OAuth. See MCP OAuth clients.