Hosted Bridge (planned)

The Hosted Bridge spec defines bridge.aiwerk.ch as a managed, multi-tenant MCP bridge service.

Planned highlights

• Single URL onboarding for clients (no local npm install)
• Per-user bridge instances with isolated secrets/config
• AES-256-GCM encrypted secret storage with per-user key derivation
• API-key auth in phase 1, OAuth login options in phase 2
• Per-user rate limiting with tiered quotas
• Audit logging per tool call (metadata only, no plaintext secrets)
• Hybrid bridge-of-bridges mode (local bridge can call hosted bridge upstream)

Endpoint shape

• POST /u/:userId/mcp (streamable-http)
• GET /u/:userId/sse
• GET /u/:userId/health

Status

This is currently a specification and roadmap item. It is not a released deployment flow in this docs set yet.

Spec source: mcp-bridge/docs/hosted-bridge-spec.md.