[Unit]
Description=MCPProxy - Smart proxy for AI agents using Model Context Protocol
Documentation=https://mcpproxy.app https://github.com/smart-mcp-proxy/mcpproxy-go
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=mcpproxy
Group=mcpproxy
ExecStart=/usr/bin/mcpproxy serve --config=/etc/mcpproxy/mcp_config.json --data-dir=/var/lib/mcpproxy
Restart=on-failure
RestartSec=5s

# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
ReadWritePaths=/var/lib/mcpproxy

# Allow binding to privileged ports if user reconfigures listen address
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

Environment=HOME=/var/lib/mcpproxy
Environment=HEADLESS=1

[Install]
WantedBy=multi-user.target
