Your Cloud, Your Data, No Exceptions
MCP tool servers execute inside your AWS, GCP, or Azure VPC. Agent data, API keys, database connections, and tool credentials never leave your cloud perimeter. Convox Rack orchestrates Kubernetes infrastructure you own—we manage the platform, you control the data. Unlike AWS Bedrock AgentCore or Cloudflare Workers, there's no shared SaaS infrastructure where vendors can access your agent payloads.
Multi-Tenant Isolation Without K8s Complexity
Serve enterprise customers who demand tenant isolation. Deploy separate Racks per customer or use namespace-level separation within a single cluster. Each tenant gets isolated secrets, network policies, and audit logs—configured through convox.yml service definitions, not raw Kubernetes manifests. Your security team can demonstrate tenant boundaries without hiring a dedicated platform engineering team.
Secrets Management That Actually Works
Inject API keys and tool credentials via `convox env set`. Secrets are encrypted at rest in your cloud account, injected at runtime, and never stored in Convox systems. IAM role passthrough on AWS lets MCP servers assume least-privilege roles for database access or S3 operations without long-lived credentials sitting in environment variables.
Private Networking for Internal Tool Calls
MCP servers often need to call internal APIs, databases, or services inside your VPC. Convox's internal router keeps tool-to-service traffic off the public internet entirely. Define internal services in convox.yml with `internal: true`—no VPC peering, Transit Gateway configuration, or PrivateLink setup required. Your MCP tools can reach your data layer without exposing endpoints.
SOC 2, HIPAA, and FedRAMP Ready Infrastructure
Run MCP servers on infrastructure that passes compliance audits. Convox Rack deploys with encryption at rest, CloudWatch audit logs, private subnets, and network isolation out of the box. Your security team reviews infrastructure you own and can inspect directly—not vendor questionnaires and shared responsibility matrices. Banks, healthcare companies, and government contractors ship faster when compliance is built into the platform.
Autoscaling for Bursty AI Workloads
MCP tool servers face unpredictable load as AI agents spike requests. Define autoscaling in convox.yml with scale: count: 1-10 and targets: cpu: 70 to handle bursts automatically. Scale to zero during idle periods to minimize costs. When an agent calls your MCP server at 3am, Convox spins up capacity in seconds—no cold start penalties from serverless platforms.
