API MCP Server provides both public and VPC endpoints. You can use PrivateLink to access API MCP Server from within a VPC over the Alibaba Cloud internal network, enhancing access security and network stability. This topic describes how to create an interface endpoint to access API MCP Server through PrivateLink.
Use cases
AI agents deployed on ECS, ECI, or Function Compute can call API MCP Server over a private network.
For security and compliance, you can route outbound traffic from sensitive business applications over a private network to reduce the risk of data leakage.
PrivateLink provides low latency and stable high bandwidth, making it ideal for high-frequency API calls.
Configuring PrivateLink does not affect the public endpoint, and both access methods can coexist.
Billing
PrivateLink is a pay-as-you-go service billed hourly. Fees include endpoint instance and data processing fees. There are no fees for enabling the service. For more information, see Billing of PrivateLink.
Prerequisites
You have created a Virtual Private Cloud (VPC) and a vSwitch in the same region as the endpoint. For more information, see VPCs and vSwitches.
The cloud resources that will access API MCP Server, such as an ECS instance, must be in the target VPC or have network connectivity to it.
Procedure
Step 1: Create an interface endpoint
Log on to the console and navigate to .
In the top navigation bar, select the region where you want to create the endpoint.
On the Interface Endpoint tab, click Create Endpoint. If this is your first time using PrivateLink, click Enable PrivateLink first.
On the Create Endpoint page, configure the following parameters and keep the default values for the others.
Region: This field is automatically populated based on the selected region and cannot be changed.
Endpoint Type: Select Interface Endpoint.
Endpoint Name: Enter a custom name for the endpoint.
Type: Select Select Service.
Available Services: In the Endpoint Service Name search box, search for and select the exact service name. An endpoint can be associated with only one endpoint service. See the table below for the service names specific to each region.
The following figure shows an example of the endpoint service name for the
China (Hangzhou)region:
VPC: Select the VPC where you want to create the endpoint.
Zone and vSwitch: Select a zone that the endpoint service supports, and then select a vSwitch in that zone. The system creates an endpoint network interface in each selected vSwitch.
Security Groups: Select a security group to control traffic for the endpoint network interface.
Click OK. After the endpoint is created, go to the Endpoints page and record its domain name. You will need this domain name to access API MCP Server.
Step 2: Verify connectivity
After the endpoint is created, you can use its domain name to access API MCP Server from resources, such as ECS instances, within the VPC. For example, to verify network connectivity, run the ping command from an ECS instance in the VPC:
[root@11111118111111111Z ~]# ping openapi-mcp-cn.vpc-proxy.aliyuncs.com
PING openapi-mcp-cn.vpc-proxy.aliyuncs.com (10.0.0.32) 56(84) bytes of data.
64 bytes from 10.0.0.32: icmp_seq=1 ttl=102 time=0.570 ms
64 bytes from 10.0.0.32: icmp_seq=2 ttl=102 time=0.382 ms
64 bytes from 10.0.0.32: icmp_seq=3 ttl=102 time=0.423 ms
64 bytes from 10.0.0.32: icmp_seq=4 ttl=102 time=0.395 ms
64 bytes from 10.0.0.32: icmp_seq=5 ttl=102 time=0.457 ms