Configure the GitGuardian Remote MCP server in self-hosted

Beta

The GitGuardian MCP Server is currently in beta. Features and behavior may change as we iterate based on user feedback.

The GitGuardian self-hosted Helm chart ships the Remote MCP server as an opt-in component. It runs in your own cluster, next to your instance, so no traffic and no secret ever leaves your network.

Requirements:

• GitGuardian self-hosted 2026.7.0 or later.
• With the aws_alb ingress controller, AWS Load Balancer Controller 2.14 or later (for Helm-based installation).

Enable the MCP server

Add the following to your Helm values file:

mcpServer:
  enabled: true

Then run helm upgrade with the version currently installed, to avoid an unwanted upgrade of your instance. Use helm ls to find the release name and that version:

helm upgrade <release-name> -n <namespace> oci://registry.replicated.com/gitguardian/gitguardian --version <installed-version> -f local-values.yaml

Once the pod is running, the MCP server is served under the /mcp-server path of your application host, on the same ingress and the same TLS certificate as your dashboard. The OAuth proxy is enabled by default, so your developers log in against your own domain and no token has to be distributed.

Connect an MCP client

Point clients at the /mcp endpoint of the MCP server. For Cursor, edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "GitGuardian": {
      "type": "http",
      "url": "https://dashboard.gitguardian.mycorp.local/mcp-server/mcp"
    }
  }
}

Replace the host with your own instance URL. Claude Desktop, Windsurf, and Zed take the same type: http block in their own configuration file. See Installation for the file locations.

The client opens a browser tab to your dashboard the first time it connects. The tools it then exposes depend on the permissions of the account that logs in, so a developer and a manager do not get the same set. See the tools reference.

Tune the deployment

The most useful keys, on top of mcpServer.enabled:

Key	Purpose	Default
mcpServer.replicas	Fixed number of replicas	1
mcpServer.autoscaling.hpa.enabled	Scale with the Kubernetes HPA	false
mcpServer.autoscaling.metrics.targetLatency	Target latency in milliseconds driving autoscaling	1000
mcpServer.resources	CPU and memory requests and limits	250m / 1Gi requested
mcpServer.ingress.enabled	Expose the server through the application ingress	true
mcpServer.mcpOAuthProxyEnabled	Let clients run OAuth against your dashboard	true
mcpServer.extraEnv	Extra environment variables passed to the server	[]

The full list is in the Helm values reference. For the environment variables you can inject through mcpServer.extraEnv, see the configuration reference of the MCP server repository.

In an airgapped environment, mirror ghcr.io/gitguardian/mcp-server to your private registry along with the other GitGuardian images. See Airgap installation.

Troubleshoot

The client cannot reach the server. Check that mcpServer.ingress.enabled is true and that your ingress controller routes the /mcp-server path. On AWS ALB, confirm the Load Balancer Controller is 2.14 or later.

The OAuth flow fails or redirects to the wrong host. The MCP server derives its public URL from your application host. Make sure clients use the same host as your dashboard, not an internal service address.

Some tools are missing. The exposed tools follow the permissions of the account that logged in. Check the role and the team perimeters of that member.

What's next

• Tools reference: the tools the server exposes.
• Security: the permission model and secret redaction.