OpenAPI Explorer:Use Aliyun mcp-proxy to proxy the OpenAPI MCP Server

Step 1: Configure Alibaba Cloud CLI

1. Install or upgrade Alibaba Cloud CLI to version 3.2.0 or later. Install or update Alibaba Cloud CLI.

2. Configure the CLI with credentials of an Alibaba Cloud account or RAM user with permissions to create OAuth applications. To use an existing OAuth application, specify --oauth-app-name in a later step.

   aliyun configure
   # Enter your AccessKey ID, AccessKey Secret, and default region as prompted.

Step 2: First run and OAuth authorization

On first run, mcp-proxy requires a one-time OAuth authorization to obtain a refresh token.

1. Start the proxy in the foreground.

   • In a GUI environment, the CLI opens a browser for OAuth authorization unless --no-browser is specified. After authorization, skip to step 5.

     aliyun mcp-proxy --host 127.0.0.1 --port 8088

   • In a headless environment, add --no-browser. The CLI prompts you to obtain the authorization code manually.

     aliyun mcp-proxy --host 127.0.0.1 --port 8088 --no-browser

   Note

   To specify a custom OAuth application with --oauth-app-name, the application must meet these requirements:

   • OAuth Scope: Must be /acs/mcp-server.

   • Redirect URI: Must match the Redirect URI used during the aliyun mcp-proxy authentication.

   • Application Type: Must be a Native application.

2. The terminal displays the authorization URL.

   Setting up MCPOAuth profile 'default-mcp'...
   Opening browser for OAuth login...
   URL: https://signin.aliyun.com/oauth2/v1/auth?client_id=XXX8&response_type=code&scope=%2Facs%2Fmcp-server&redirect_uri=http://0.0.0.0:8088/callback&code_challenge=XXX&code_challenge_method=S256
   Please open the authorization URL on a machine with a browser and complete the sign-in.
   After authorization, the browser will redirect to a callback URL.
   Even if the page fails to load (connection error), the authorization code is in the URL.
   Please copy the value of the `code` parameter from the browser's address bar.
   Example: If the URL is:
     http://127.0.0.1:8088/callback?code=abc123xyz&state=...
     Then copy only: abc123xyz
   Enter authorization code: <YOUR CODE>

3. Open the URL in a browser, sign in, and complete the authorization.

4. After authorization, the page redirects to a URL containing a code parameter, or displays the code directly. Copy the code value, paste it into the terminal, and press Enter.

5. The terminal displays OAuth login successful! when authorization succeeds.

   2025/12/04 19:11:49 Oauth authorization successfully, code received: XXXX
   2025/12/04 19:11:49 Start to exchange code for token with PKCE
   2025/12/04 19:11:49 Exchange code for token with PKCE successfully
   OAuth login successful!

6. The terminal displays MCP Proxy Server Started when the proxy is ready.

   MCP Profile 'default-mcp' configured for oauth app 'aliyun-cli-mcp-proxy' successfully!
   MCP Proxy Server Started
   Listen: 127.0.0.1:8088

Step 3: Configure systemd service (CentOS)

For stable operation, configure the proxy as a systemd service that starts on boot.

1. Create a systemd service file named aliyun-mcp-proxy.service.

   Note:

   • Replace your-user with the actual non-root username that runs this service. This user must have configured credentials by using aliyun configure.

   • In the ExecStart line, $(which aliyun) automatically finds the path to the aliyun command. If this fails, manually replace it with the output of the which aliyun command (for example, /usr/local/bin/aliyun).

   sudo tee /etc/systemd/system/aliyun-mcp-proxy.service << 'EOF'
   [Unit]
   Description=Aliyun CLI MCP Proxy
   After=network.target
   [Service]
   Type=simple
   User=your-user
   ExecStart=$(which aliyun) mcp-proxy --host 127.0.0.1 --port 8088 --no-browser
   Restart=always
   RestartSec=10
   Environment=HOME=/home/your-user
   [Install]
   WantedBy=multi-user.target
   EOF

2. Reload the systemd configuration and start the service.

   # Reload the configuration
   sudo systemctl daemon-reload
   # Start the service
   sudo systemctl start aliyun-mcp-proxy
   # Enable the service to start on boot
   sudo systemctl enable aliyun-mcp-proxy

Step 4: Verify the proxy service

Verify the service is running.

• View the service status

  Check the service status.

  sudo systemctl status aliyun-mcp-proxy

  If the output contains active (running), the service has started successfully.

• Request the proxy port

  Send a test request to the proxy port.

  curl http://127.0.0.1:8088/

  A working proxy returns an XML error response from the MCP server, confirming connectivity.

  <?xml version='1.0' encoding='UTF-8'?><Error><RequestId>B3311876-XXXXX</RequestId><HostId>openapi-mcp.cn-hangzhou.aliyuncs.com</HostId><Code>InvalidAction.NotFound</Code><Message>Specified api is not found, please check your url and method.</Message><Recommend><![CDATA[https://api.aliyun.com/troubleshoot?q=InvalidAction.NotFound&product=OpenAPIExplorer&requestId=B3311876-XXX]]></Recommend></Error>

Step 1: Get host IP and start proxy

The Dify container accesses mcp-proxy through the host machine's Docker bridge IP.

1. Get the Docker bridge IP address.

   ip addr show docker0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1

   This command returns an IP address similar to 172.17.0.1.

2. Start aliyun mcp-proxy in the foreground, or modify the systemd startup command to run it as a service.

   aliyun mcp-proxy --host 172.17.0.1 --port 8088 --no-browser

Step 2: Configure the MCP server in Dify

1. In Dify, go to the Tools > MCP configuration page.

2. ClickAdd MCP Server (HTTP).

3. In theserver endpoint URL field, enter your MCP proxy address.

   Find the Streamable HTTP Endpoint in the OpenAPI MCP Service console and replace the host with your proxy address.

   Example conversion:

   • Original Endpoint:
     https://openapi-mcp.cn-hangzhou.aliyuncs.com/accounts/1234/custom/cli-proxy-test/id/1234/mcp
     
     
     
     

   • Proxied Endpoint: (assuming the proxy runs on172.17.0.1:8088):
     http://172.17.0.1:8088/accounts/1234/custom/cli-proxy-test/id/1234/mcp
     
     
     
     

4. Complete the remaining fields and click Add & Authorize. Dify routes MCP traffic through this proxy.

Mitigations

• Environment isolation: Run the proxy only in a trusted, single-user environment.

• Network access control: Bind --host to 127.0.0.1 (default) or a specific internal IP. Use firewall or security group rules to restrict proxy port access. Never expose the port to the public internet.

• Server access control: Use --allowed-servers (allowlist) or --blocked-servers (blocklist) to restrict accessible MCP servers. Configure server access control.

• Principle of least privilege: Grant the CLI user and MCP server only the minimum required permissions. Prefer read-only access.

• Auditing and monitoring: Review proxy access logs regularly. Blocked requests are recorded in the logs.

Configure server access control

aliyun mcp-proxy supports allowlist and blocklist modes to restrict accessible MCP servers.

Available Servers:
  - cloudphone
    MCP: http://127.0.0.1:8088/accounts/0000000000000000/system/eds-aic/cloudphone/id/XSkb9v4dXx000000/mcp
    SSE: http://127.0.0.1:8088/accounts/0000000000000000/system/eds-aic/cloudphone/id/XSkb9v4dXx000000/sse
  - multi_account
    MCP: http://127.0.0.1:8088/accounts/0000000000000000/custom/multi_account/id/OV0Qkpxh0Uodx000/mcp
    SSE: http://127.0.0.1:8088/accounts/0000000000000000/custom/multi_account/id/OV0Qkpxh0Uodx000/sse

......./system/eds-aic/$server_name/id/$server_id/mcp
......./custom/$server_name/id/$server_id/mcp

MCP Proxy Server Started
Listen: 127.0.0.1:8088
Region: CN
Access Control:
  Blacklist (blocked servers):
    - ram
  Whitelist (allowed servers):
    - ecs
    - oss
Available Servers:
  - ecs
    MCP: http://127.0.0.1:8088/acs/mcp-server/ecs/mcp
  - oss
    MCP: http://127.0.0.1:8088/acs/mcp-server/oss/mcp
  - ram (blocked)

Security incident response

If you suspect the proxy's authentication token has been leaked or abused:

• Stop the MCP Proxy service.

• Delete the local configuration file: rm ~/.aliyun/.mcpproxy_config.

• Revoke the OAuth authorization in the Alibaba Cloud console.

• Check the API call logs to identify any abnormal operations.

• Reconfigure the MCP Proxy and generate a new token.

After running aliyun mcp-proxy for OAuth authentication, I get the "ERROR: OAuth flow returned empty RefreshToken" error and the proxy fails to start. Why does this happen?

This usually indicates an incorrect OAuth application type or identity. Verify:

• The OAuth application type used is Native.

• You are authenticating with an Alibaba Cloud account or a RAM user. Assuming a RAM role does not support obtaining a refresh token.

Connection Refused or Timeout error in Dify

Check these configurations:

1. Set --host to the Docker bridge IP or host internal IP so the container can reach the mcp-proxy service.

2. The ECS security group or host firewall must allow TCP traffic from Docker containers to the proxy port (for example, 8088).

How to view mcp-proxy logs?

For systemd deployments, view real-time logs with:

sudo journalctl -u aliyun-mcp-proxy -f