NyxID

What NyxID MCP server does

NyxID provides an agent connectivity gateway for APIs and services. It can proxy requests to public APIs, internal APIs, and localhost services, while keeping the credentials used for those requests inside the gateway. REST APIs with OpenAPI specifications can be exposed as Model Context Protocol (MCP) tools, allowing supported agents to call them through MCP rather than requiring direct access to each API.

The NyxID MCP server also separates access by agent. Each agent receives a scoped token, so one agent can be permitted to use selected services while another receives a different service set. Sessions can be revoked without changing the underlying credentials. The project is listed in the Developer Tools category and is relevant when an application needs an identity and access layer in front of several APIs.

How it works

Agents authenticate with the gateway through OIDC/OAuth 2.0 with PKCE, API keys, service accounts, and role-based access controls. After authentication, NyxID either forwards a request directly or sends it through its credential-injection proxy. The target API receives the configured credential, while the agent communicates with NyxID instead of handling the raw key.

For local or private services, a credential node can provide access through NAT traversal. The command-line interface identifies this node as nyxid node. The project also documents nyxid ssh for reaching remote hosts through SSH tunneling. These paths are intended to avoid VPN setup and port forwarding for the supported connectivity scenarios.

Tools and capabilities

The NyxID MCP server supports the following documented capabilities:

• Convert REST APIs with OpenAPI specifications into MCP tools.
• Generate MCP client configuration with nyxid mcp config --tool cursor.
• Proxy API requests while injecting configured credentials.
• Reach public, internal, and localhost services.
• Assign scoped tokens and isolate service access between agents.
• Authenticate through OIDC/OAuth 2.0, API keys, service accounts, and RBAC.
• Apply transaction approval through Telegram and mobile push.
• Provide an LLM gateway for seven providers.

The repository also documents managed connections for selected services, including Stripe read-only customer, invoice, payment, and subscription tools, plus Aurinko mailbox operations. Those service-specific capabilities depend on their respective connection and configuration flows.

Limitations and notes

Service access is not automatically available just because an API is reachable. Administrators configure credentials, access rules, endpoint rules, and, where applicable, provider connections. Per-agent tokens limit what each agent can use, but the required service access still has to be granted.

Some documented features have additional rollout or availability conditions. Telnyx voice is unavailable as a shared-platform service, the Telnyx offering is described as a restricted pilot, and certain voice features require an enabled provider, tariff, and sufficient funding. Feature-flag administration is role-based, and the relevant roles control whether users can create or manage flags. Review the service-specific configuration before relying on those integrations.