Enterprise networking
BMO reaches private-network MCP servers through configured client transports, not a hosted first-party tunnel.
What BMO supports
Section titled “What BMO supports”| Pattern | Config |
|---|---|
| HTTP/SSE MCP on internal URL | [mcp.<id>] with type = "http" or "sse" |
| Stdio MCP on VPC host | type = "stdio", command on reachable machine |
| Internal TLS CAs | [options.mcp_client.tls] ca_bundle_path |
| Auth to internal MCP | Per-server headers, OAuth, or github_cli |
See MCP Client and the maintainer topic Private-network MCP access.
What competitors may offer (and BMO does not)
Section titled “What competitors may offer (and BMO does not)”Some managed agents document MCP tunnels — hosted relays to private MCP
servers. BMO does not ship an equivalent multiplexer. Operators supply VPN,
SSH port-forward, or corporate proxy paths; BMO dials the configured url or
launches stdio where policy allows.
HTTP server in enterprise
Section titled “HTTP server in enterprise”When exposing bmo service start http:
- Bind loopback or TLS-terminated reverse proxy
- Use token auth
- Treat as trust expansion — HTTP server
Related
Section titled “Related”- Security and data
- Why BMO — comparison matrix
- Protocols