Is the current static/mcp path being routed as intended?

[ESnark]

Hi team,

Because I'm new to FastAPI, I recently realized that app's root_path (configured as APP_ROOT_PATH) is automatically prepended to mounted routes, such as /static or /mcp

As a result of this behavior, I had to configure my reverse proxy so that it strips the common prefix path (/{proxy}) for regular requests, while keeping the full path for mounted routes such as /{proxy}/static

Here's my kong gateway config:

...
services:
  - name: internal.mcp-gateway.service
    host: internal.mcp-gateway.upstream
    routes:
      - name: internal.mcp-gateway.route
        paths:
          - /mcp-gateway
        preserve_host: true
        strip_path: true
      - name: internal.mcp-gateway.static.route
        paths:
          - /mcp-gateway/static
        preserve_host: true
        strip_path: false
      - name: internal.mcp-gateway.mcp.route
        paths:
          - /mcp-gateway/mcp
        preserve_host: true
        strip_path: false
...

Fortunately, it works well for now, but I wonder if this behavior is actually intended because It seems a bit complicated and counter-intuitive.
Let me know if I'm misusing mcp-context-forge or there is a better approach.

Thanks for your time!

[crivetimihai]

Hi @ESnark, thanks for flagging. I can confirm expected routing if you share whether traffic comes from SSE/websocket clients and your exact endpoint/rewrites. I’ll post a corrected routing matrix to avoid ambiguity.

[crivetimihai]

Hi @ESnark, thanks for the detailed Kong config — your setup is actually correct and this behavior is intentional, though I agree it's not immediately intuitive.

How APP_ROOT_PATH works:

When you set APP_ROOT_PATH=/mcp-gateway (defined in config.py:235 as app_root_path: str = ""), FastAPI/Starlette's root_path is set accordingly. This means:

• Regular API routes (e.g., /servers, /tools) are served at their normal paths — your reverse proxy strips the prefix
• Mounted sub-applications (/static, /mcp) get the root_path prepended by the ASGI framework, so they're physically served at /mcp-gateway/static and /mcp-gateway/mcp

This is standard ASGI behavior — mounted apps inherit root_path for both URL generation and actual mount paths.

Your Kong config is the correct approach. The token scoping middleware (middleware/token_scoping.py:245-256) internally normalizes paths by stripping APP_ROOT_PATH via _normalize_scope_path() before permission checks, so authorization works correctly regardless.

Simpler alternative: If you want uniform behavior, set APP_ROOT_PATH="" (empty, which is the default) and have Kong strip the prefix on all routes uniformly. But your current split config (strip for API routes, preserve for mounted apps) works and is the supported pattern for subpath deployments.

This behavior is documented briefly in the configuration docs under the APP_ROOT_PATH tip. Let me know if you need further clarification.