yum upgrades for production use, this is the repository for you.
Active subscription is required.
Technical Briefing: Amplify Adds a Hosted, Read-Only MCP Server for NGINX Monitoring Data
Today’s source is a GetPageSpeed article on a new capability in Amplify, GetPageSpeed’s existing NGINX monitoring service. Amplify now offers a hosted MCP (Model Context Protocol) server, so AI coding agents can query monitoring and security data directly instead of relying on a human to copy it from the dashboard. The article covers how the server works, its 14 tools, setup for several clients, real-world examples, and its limits and plan requirements.
The Problem: Monitoring Data Stuck Behind a Dashboard
NGINX monitoring data sits in a dashboard. That includes:
- CVE exposure
- config bugs
- 5xx spikes
Developers working with AI coding agents copy numbers from a browser tab into chat by hand. The MCP server lets the agent read Amplify directly.
How It Works
- Endpoint: `https://amplify.getpagespeed.com/mcp`. The server is hosted, so there is nothing to install or run.
- Transport and auth: Stateless Streamable HTTP, authenticated with your account API key.
- Read-only: Every tool is read-only, and nothing in the account can be changed through MCP. The article presents this as what makes it safe to connect to production monitoring.
- Hostnames, not UUIDs: Host arguments accept a hostname such as
web1.example.com.
The 14 Tools
The article groups the tools by area:
- Security
get_security_overviewranks every host by NGINX CVEs, gixy config findings and PHP CVE exposure in a single call.get_host_securityreturns full detail for one host, including suggested config fixes and PHP upgrade commands.
- Inventory: Hosts, agent versions, tags and detected components, including the NGINX version and modules, PHP-FPM pools, MySQL and Varnish.
- Metrics: Up to 10 metrics over a time window.
- The default response is a compact min/max/avg/last summary per metric, which keeps the agent’s context from being flooded.
- Raw points are available on request.
- Alerts and websites: Recent alerts, uptime, response time, HTTP/3 checks and TLS certificate checks.
Tool names mentioned in the examples include list_hosts, get_host and list_host_components.
Setup
First, copy your API key from the API Keys settings page.
Claude Code:
claude mcp add --transport http --scope user amplify \
https://amplify.getpagespeed.com/mcp \
--header "Authorization: Bearer YOUR_API_KEY"
Cursor: Add the following to ~/.cursor/mcp.json:
{ "mcpServers": { "amplify": { "url": "https://amplify.getpagespeed.com/mcp", "headers": { "Authorization": "Bearer YOUR_API_KEY" } } } }
VS Code (GitHub Copilot): Add the following to .vscode/mcp.json or to your user MCP config:
{ "servers": { "amplify": { "type": "http", "url": "https://amplify.getpagespeed.com/mcp", "headers": { "Authorization": "Bearer YOUR_API_KEY" } } } }
OpenAI Codex CLI: Add the following to ~/.codex/config.toml, then export AMPLIFY_API_KEY in your shell:
[mcp_servers.amplify]
url = "https://amplify.getpagespeed.com/mcp"
bearer_token_env_var = "AMPLIFY_API_KEY"
Other clients: Any client that supports remote Streamable HTTP servers with a custom header can use the same URL and header.
Real-World Examples
The article anonymizes hostnames in these examples.
“Which servers need security attention?”
The agent called get_security_overview, then called get_host_security for each host. It returned a prioritized list in about 30 seconds.
Overall result:
– All three hosts were flagged, and every flag was for NGINX config issues.
– No NGINX CVEs were found.
– PHP 8.4.27 on web1 is patched against the critical “PHP2Shell” RCEs.
Gixy findings (high/medium/low):
| Host | Total | High | Medium | Low |
|---|---|---|---|---|
| web1 | 16 | 7 | 4 | 5 |
| web2 | 14 | 3 | 4 | 7 |
| web3 | 8 | 3 | 3 | 2 |
The agent recommended fixing web1 first, for these issues:
– HTTP response splitting through unvalidated variables in two add_header lines
– A ReDoS-prone regex
– TLS 1.1 and 3DES still enabled
– Public DNS resolvers
– quic_bpf combined with reuseport, which is the known cause of HTTP/3 silently dropping connections after a reload
It then recommended one shared change across all three hosts:
– ssl_protocols TLSv1.2 TLSv1.3;
– a modern cipher list
– a local resolver
“Show gixy findings on web1 and write the fix”
- The agent produced a severity-sorted table of all 16 findings, each with a one-line fix, plus a patch file.
- It kept fixes that came from gixy separate from fixes it inferred without seeing the config. It asked for the inferred ones to be checked against the real config lines.
- It advised running
nginx -tand re-running gixy after applying the changes.
“Did any website go down this week?”
- The agent found one outage on Saturday, 17 Oct, from about 07:54 to 09:07 UTC.
- Both sites failed at the same time with timeouts, a DNS lookup timeout and “network is unreachable.”
- It correlated the outage with an “Agent Down” alert at 09:07 UTC. It concluded the cause was a network problem rather than an app crash, and it labelled that conclusion as inference.
Codex
- Codex fanned out over
list_hosts,get_hostandlist_host_components. - It reported that two hosts need an agent upgrade and that no end-of-life PHP was found.
Why the Security Angle Matters
The article draws a contrast with generic monitoring MCPs, which can say CPU is high. Amplify can explain why a server is exposed, using three kinds of data:
- NGINX CVEs matched to each host’s exact version.
- gixy analysis of the live config, with a suggested fix for each finding. It covers header injection, SSRF-prone
proxy_pass,proxy_passpath pitfalls, weak TLS, missing HSTS and more. - Per-host PHP CVE status, including PHP2Shell exposure, with upgrade commands.
Practical payoff: When paired with an agent that writes config, this workflow goes from “something is wrong” to a reviewed patch. You still review and apply every change yourself.
Limits and Caveats
- Built on the Amplify REST API (
/api/v2):- Rate limit: 120 calls per minute per API key, shared between REST and MCP.
- Time windows: Clamped to your plan’s data retention.
- Data exposure: The agent sees the same data as your dashboard. Review your AI client’s data-handling terms before connecting a production account.
- Not yet supported: OAuth-only web connectors such as claude.ai and ChatGPT. The article says this is next on the roadmap.
- Plan requirements:
- MCP access is included with API access on Pro and higher.
- Free and Starter accounts can connect and see the tool list, but tool calls return an upgrade pointer.
- Former F5 users: Amplify is positioned as a drop-in alternative to F5’s discontinued NGINX Amplify. It uses the same agent and adds security analysis and, now, MCP.
Read the full article: Ask Your AI Agent About Your NGINX Servers: Amplify MCP
