## Security

- Binds to `127.0.0.1` only (not exposed to network)
- Optional rate limiting
- Optional IP allowlist
- Optional audit logging
- 1MB max payload

### ⚠️ Important Notes

**Commands are user-configured only.** The bridge executes commands specified in `config.json` — it does not accept arbitrary commands via HTTP. You control what runs.

**Don't commit secrets.** If you store API keys via `set-env`, they're saved in plain text in `config.json`. Add it to `.gitignore` or use environment variables instead:

The server inherits your shell environment.

## Running

# Add a server
node cli.js add-server github npx @anthropic/mcp-github

# Set env vars for the server
node cli.js set-env github GITHUB_TOKEN ghp_xxx

# Start
pm2 start bridge.js --name cherry-mcp

# Servers
node cli.js add-server <name> <command> [args...]
node cli.js remove-server <name>
node cli.js list-servers

# Environment variables
node cli.js set-env <server> <KEY> <value>
node cli.js remove-env <server> <KEY>

# Security
node cli.js set-rate-limit <rpm>      # requests per minute
node cli.js set-allowed-ips <ip>...   # IP allowlist
node cli.js enable-audit-log          # log requests

# Other
node cli.js show-config
node cli.js restart

# List servers
curl http://localhost:3456/

# List tools
curl http://localhost:3456/<server>/tools

# Call a tool
curl -X POST http://localhost:3456/<server>/call \
  -H "Content-Type: application/json" \
  -d '{"tool": "search", "arguments": {"query": "test"}}'

# Restart server
curl -X POST http://localhost:3456/<server>/restart

# Alternative: set env vars before starting
export GITHUB_TOKEN=ghp_xxx
pm2 start bridge.js --name cherry-mcp

{
  "servers": {
    "github": {
      "command": "npx",
      "args": ["@anthropic/mcp-github"],
      "env": {}
    }
  }
}

# pm2 (recommended)
pm2 start bridge.js --name cherry-mcp
pm2 save

# Auto-start on boot
pm2 startup