How to secure your MCP using Private Networks on Scalingo

MCPs are often shipped as simple HTTP endpoints. Great for speed, risky for exposure. In this 5-minute demo, I’ll show how to secure an MCP server on Scalingo using Private Network and a minimal WAF proxy.
We’ll deploy an MCP backend as a webless app listening only inside the private network, then add a public “front” app running Nginx that enforces an API key and forwards traffic to the private internal domain.
No slides, only code: Scalingo CLI, private DNS, Nginx template, and a tiny Express MCP server using streamable HTTP transport.
You’ll leave with a copy-pasteable pattern to isolate your AI/agent backends, keep credentials off the public internet, and still expose safe, controlled access.