MCP Enterprise Deployment: Production Guide for 2026

Dockerfile — TypeScript MCP server

# Build stage
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY tsconfig.json ./
COPY src ./src
RUN npm run build

# Runtime stage
FROM node:22-alpine AS runtime
WORKDIR /app

# Non-root user (UID 1001 to avoid conflicts)
RUN addgroup -g 1001 mcp && adduser -u 1001 -G mcp -s /bin/sh -D mcp
USER mcp

COPY --from=builder --chown=mcp:mcp /app/dist ./dist
COPY --from=builder --chown=mcp:mcp /app/node_modules ./node_modules

EXPOSE 3000
ENV NODE_ENV=production

CMD ["node", "dist/server.js"]

mcp-server-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mcp-github-server
  namespace: mcp-prod
spec:
  replicas: 3
  selector:
    matchLabels:
      app: mcp-github-server
  template:
    metadata:
      labels:
        app: mcp-github-server
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
        - name: server
          image: yourregistry/mcp-github-server:v1.4.2
          ports:
            - containerPort: 3000
          env:
            - name: GITHUB_TOKEN
              valueFrom:
                secretKeyRef:
                  name: mcp-secrets
                  key: github-token
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: mcp-github-server-pdb
  namespace: mcp-prod
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: mcp-github-server

cert-manager Certificate resource

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: mcp-server-tls
  namespace: mcp-prod
spec:
  secretName: mcp-server-tls-secret
  issuerRef:
    name: internal-ca-issuer
    kind: ClusterIssuer
  commonName: mcp-github-server.mcp-prod.svc.cluster.local
  dnsNames:
    - mcp-github-server.mcp-prod.svc.cluster.local
  duration: 720h   # 30 days
  renewBefore: 168h # Renew 7 days before expiry

Kong rate-limiting plugin config

plugins:
  - name: rate-limiting
    config:
      minute: 120          # 120 tool calls per user per minute
      hour: 2000
      policy: redis        # Shared state across gateway pods
      redis_host: redis.mcp-prod.svc.cluster.local
      identifier: consumer # Key by authenticated user, not IP
      hide_client_headers: false

TypeScript — structured audit logging middleware

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

function withAuditLog(server: McpServer) {
  const original = server.tool.bind(server);

  return function auditedTool(
    name: string,
    schema: Record<string, unknown>,
    handler: Function
  ) {
    return original(name, schema, async (args: unknown, extra: unknown) => {
      const start = Date.now();
      const logEntry = {
        timestamp: new Date().toISOString(),
        tool: name,
        userId: (extra as any)?.meta?.userId ?? "unknown",
        sessionId: (extra as any)?.meta?.sessionId,
        args: redactSensitiveFields(args),
        status: "pending" as string,
        durationMs: 0,
      };

      try {
        const result = await handler(args, extra);
        logEntry.status = "success";
        logEntry.durationMs = Date.now() - start;
        console.log(JSON.stringify(logEntry));
        return result;
      } catch (err) {
        logEntry.status = "error";
        logEntry.durationMs = Date.now() - start;
        (logEntry as any).error = (err as Error).message;
        console.log(JSON.stringify(logEntry));
        throw err;
      }
    });
  };
}

function redactSensitiveFields(args: unknown): unknown {
  const REDACT = new Set(["token", "password", "secret", "api_key", "apiKey"]);
  if (typeof args !== "object" || args === null) return args;
  return Object.fromEntries(
    Object.entries(args as Record<string, unknown>).map(([k, v]) => [
      k,
      REDACT.has(k.toLowerCase()) ? "[REDACTED]" : v,
    ])
  );
}

TypeScript — Prometheus metrics with prom-client

import { Counter, Histogram, register } from "prom-client";
import express from "express";

const toolCallsTotal = new Counter({
  name: "mcp_tool_calls_total",
  help: "Total MCP tool invocations",
  labelNames: ["tool", "status"],
});

const toolLatencySeconds = new Histogram({
  name: "mcp_tool_duration_seconds",
  help: "MCP tool call latency",
  labelNames: ["tool"],
  buckets: [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
});

// Metrics endpoint for Prometheus scraping
const metricsApp = express();
metricsApp.get("/metrics", async (_req, res) => {
  res.set("Content-Type", register.contentType);
  res.end(await register.metrics());
});
metricsApp.listen(9090);

.circleci/config.yml (abbreviated)

version: 2.1
jobs:
  test:
    docker:
      - image: node:22-alpine
    steps:
      - checkout
      - run: npm ci
      - run: npm test
      - run: npm run lint

  build-and-push:
    machine: true
    steps:
      - checkout
      - aws-ecr/build-and-push-image:
          repo: mcp-github-server
          tag: "${CIRCLE_SHA1}"

  deploy-staging:
    docker:
      - image: bitnami/kubectl:latest
    steps:
      - run: |
          kubectl set image deployment/mcp-github-server             server=yourregistry/mcp-github-server:${CIRCLE_SHA1}             -n mcp-staging

  approve-production:
    type: approval   # Pauses pipeline; requires manual click

  deploy-production:
    docker:
      - image: bitnami/kubectl:latest
    steps:
      - run: |
          kubectl set image deployment/mcp-github-server             server=yourregistry/mcp-github-server:${CIRCLE_SHA1}             -n mcp-prod

workflows:
  deploy:
    jobs:
      - test
      - build-and-push:
          requires: [test]
      - deploy-staging:
          requires: [build-and-push]
      - approve-production:
          requires: [deploy-staging]
      - deploy-production:
          requires: [approve-production]