Skip to main content
An upstream represents an MCP server that Latch protects. When you connect an AI agent to Latch, Latch forwards requests to the upstream and enforces your security policies.

​
What is an Upstream?

Think of an upstream as a “protected server registration.” It tells Latch:
  • What MCP server to connect to
  • How to connect (stdio command or HTTP URL)
  • Which tools that server exposes
AI Agent (Claude) → Latch (proxy) → Upstream (MCP Server)

​
Creating an Upstream

  1. Go to Upstreams in the dashboard
  2. Click Create Upstream
  3. Choose your transport type:

​
Stdio Upstreams (Local)

For MCP servers that run as local processes (most common):
  • Name: A label for this upstream (e.g., filesystem, github)
  • Command: The command to run (e.g., npx)
  • Args: Command arguments (e.g., -y,@modelcontextprotocol/server-filesystem,/tmp)
For stdio upstreams, the command/args are only used for tool discovery. The actual server is spawned by the CLI when your agent connects.

​
HTTP Upstreams (Remote)

For MCP servers running as web services:
  • Name: A label for this upstream
  • URL: The server’s HTTP endpoint
  • Headers: Authentication headers (API keys, Bearer tokens)

​
Importing from Claude Desktop / Cursor

Already have MCP servers configured? Import them directly:
  1. Go to Upstreams → Import MCP config
  2. Paste your mcpServers JSON from Claude Desktop or Cursor config
  3. Select which server to import
Claude Desktop config location: 
~/Library/Application Support/Claude/claude_desktop_config.json

​
Tool Discovery

Latch needs to know what tools an upstream exposes so you can create per-tool rules.
TransportDiscovery Method
HTTPAutomatic on save. Re-run via Sync Tools button.
StdioHappens when the CLI connects. Or run manual sync (see below).

​
Manual Tool Sync (Stdio)

To discover tools before connecting an agent: 
npx @latchagent/cli@latest tools-sync \
  --api-key "latch_YOUR_KEY" \
  --upstream "my-upstream" \
  --upstream-command "npx" \
  --upstream-args "-y,@modelcontextprotocol/server-filesystem,/tmp"
After syncing, tools appear in the Tools page and in rule dropdowns.

​
Exporting Client Configs

Once an upstream is configured, export a ready-to-use config for your MCP client:
  1. Go to Upstreams
  2. Click Export on the upstream row
  3. Choose your client format (Claude Desktop, Cursor, etc.)
  4. Paste into your client’s config file
The export wraps your upstream through Latch, so all requests are protected.

​
Common Upstream Examples

​
Filesystem Server

{
  "name": "filesystem",
  "transport": "stdio",
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/projects"]
}

​
GitHub Server

{
  "name": "github",
  "transport": "stdio",
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-github"]
}

​
Remote HTTP Server

{
  "name": "my-api",
  "transport": "http",
  "url": "https://mcp.example.com/api",
  "headers": {
    "Authorization": "Bearer sk-..."
  }
}

​
Next Steps

Once you’ve created an upstream:
  1. Sync its tools so Latch knows what it exposes
  2. Create rules to control what actions are allowed
  3. Export the config to your MCP client