{ "manifest_version": "1.0.0", "template": { "id": "dfb7a9d6-7bc8-4950-9d45-699cf7bd0302", "slug": "contextforge-mcp-g-1", "name": "ContextForge MCP Gateway", "description": "Self-hosted IBM registry, proxy and admin UI for MCP servers and REST APIs", "url": "https://railway.com/deploy/contextforge-mcp-g-1", "upstream": { "image": "ghcr.io/ibm/mcp-context-forge:v1.0.10" } }, "status": "unvalidated", "validated_at": null, "success_rate_30d": null, "services": [ { "name": "Postgres", "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "needs_volume": true, "volume_mount_path": "/var/lib/postgresql/data", "http": false }, { "name": "ContextForge", "source": { "image": "ghcr.io/ibm/mcp-context-forge:v1.0.10" }, "needs_volume": false, "http": true } ], "required_inputs": [ { "key": "PGDATA", "service": "Postgres", "description": "[Do not change] Directory holding the database files inside the volume.", "secret": false, "strategy": "default", "default": "/var/lib/postgresql/data/pgdata" }, { "key": "PGHOST", "service": "Postgres", "description": "[Do not change] Private hostname the gateway uses to reach this database.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "PGPORT", "service": "Postgres", "description": "[Do not change] Port Postgres listens on inside the private network.", "secret": false, "strategy": "default", "default": "5432" }, { "key": "PGUSER", "service": "Postgres", "description": "[Do not change] Alias of POSTGRES_USER that client tools read.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGDATABASE", "service": "Postgres", "description": "[Do not change] Alias of POSTGRES_DB that client tools read.", "secret": false, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "PGPASSWORD", "service": "Postgres", "description": "[Do not change] Alias of POSTGRES_PASSWORD that client tools read.", "secret": true, "strategy": "railway_provided", "railway_source": "reference_variable" }, { "key": "POSTGRES_DB", "service": "Postgres", "description": "[Do not change] Name of the database created on first boot.", "secret": false, "strategy": "default", "default": "railway" }, { "key": "DATABASE_URL", "service": "Postgres", "description": "[Do not change] Standard connection string for database clients.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "POSTGRES_USER", "service": "Postgres", "description": "[Do not change] Superuser created on first boot.", "secret": false, "strategy": "default", "default": "postgres" }, { "key": "SSL_CERT_DAYS", "service": "Postgres", "description": "[Do not change] Lifetime in days of the self-signed certificate for encrypted connections.", "secret": false, "strategy": "default", "default": "820" }, { "key": "POSTGRES_PASSWORD", "service": "Postgres", "description": "Superuser password of your database.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "RAILWAY_DEPLOYMENT_DRAINING_SECONDS", "service": "Postgres", "description": "[Do not change] Seconds Postgres gets to finish open queries during a redeploy.", "secret": false, "strategy": "default", "default": "60" }, { "key": "HOST", "service": "ContextForge", "description": "[Do not change] Interface the gateway binds to.", "secret": false, "strategy": "default", "default": "0.0.0.0" }, { "key": "PORT", "service": "ContextForge", "description": "[Do not change] Port the gateway listens on.", "secret": false, "strategy": "default", "default": "4444" }, { "key": "APP_DOMAIN", "service": "ContextForge", "description": "[Do not change] Public URL of this gateway. CORS and OAuth callbacks are bound to it.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "ENVIRONMENT", "service": "ContextForge", "description": "[Do not change] Runtime mode. Production enforces strict CORS and secure cookies.", "secret": false, "strategy": "default", "default": "production" }, { "key": "DATABASE_URL", "service": "ContextForge", "description": "[Do not change] Connection string to the bundled Postgres, in the psycopg scheme the gateway requires.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_private_domain" }, { "key": "JWT_SECRET_KEY", "service": "ContextForge", "description": "Signs login sessions and API tokens.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "LLM_API_PREFIX", "service": "ContextForge", "description": "[Do not change] URL prefix of the built-in LLM proxy endpoints.", "secret": false, "strategy": "default", "default": "/llm/v1" }, { "key": "SECURE_COOKIES", "service": "ContextForge", "description": "[Do not change] Marks session cookies HTTPS-only.", "secret": false, "strategy": "default", "default": "true" }, { "key": "BASIC_AUTH_USER", "service": "ContextForge", "description": "Username for HTTP Basic Auth, which is off by default.", "secret": false, "strategy": "default", "default": "admin" }, { "key": "GUNICORN_WORKERS", "service": "ContextForge", "description": "[Do not change] Number of gateway worker processes. The built-in LLM Chat needs Redis with more than one.", "secret": false, "strategy": "default", "default": "1" }, { "key": "REQUIRE_USER_IN_DB", "service": "ContextForge", "description": "[Do not change] Keeps the administrator bootstrap login enabled.", "secret": false, "strategy": "default", "default": "false" }, { "key": "BASIC_AUTH_PASSWORD", "service": "ContextForge", "description": "Password for HTTP Basic Auth, which is off by default.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "PLATFORM_ADMIN_EMAIL", "service": "ContextForge", "description": "Login email of the administrator account. Required: enter your own address.", "secret": false, "strategy": "ask_user" }, { "key": "UAID_ALLOWED_DOMAINS", "service": "ContextForge", "description": "[Do not change] Domain allowlist for cross-gateway routing.", "secret": false, "strategy": "railway_provided", "railway_source": "railway_domain" }, { "key": "DEFAULT_USER_PASSWORD", "service": "ContextForge", "description": "Initial password of users created through the admin UI. They must replace it on first sign-in.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "MCPGATEWAY_UI_ENABLED", "service": "ContextForge", "description": "Serves the admin web UI at /admin.", "secret": false, "strategy": "default", "default": "true" }, { "key": "AUTH_ENCRYPTION_SECRET", "service": "ContextForge", "description": "Encrypts the credentials you store for connected MCP servers.", "secret": true, "strategy": "generate", "generate": "random_base64_32" }, { "key": "PLATFORM_ADMIN_PASSWORD", "service": "ContextForge", "description": "First-login password of the administrator account. The gateway makes you replace it on first sign-in.", "secret": true, "strategy": "generate", "generate": "strong_password" }, { "key": "MCPGATEWAY_SKIP_MIGRATIONS", "service": "ContextForge", "description": "[Do not change] Runs database migrations on every deployment.", "secret": false, "strategy": "default", "default": "false" }, { "key": "RATE_LIMITING_REDIS_ENABLED", "service": "ContextForge", "description": "[Do not change] Rate limiting runs in memory. This template ships no Redis.", "secret": false, "strategy": "default", "default": "false" }, { "key": "SSRF_ALLOW_PRIVATE_NETWORKS", "service": "ContextForge", "description": "[Do not change] Allows registering MCP servers that run on this project's private network.", "secret": false, "strategy": "default", "default": "true" }, { "key": "MCPGATEWAY_ADMIN_API_ENABLED", "service": "ContextForge", "description": "Enables the admin REST API.", "secret": false, "strategy": "default", "default": "true" } ], "deploy": { "mcp": { "server": "railway", "tool": "deploy_template", "args": { "template_code": "contextforge-mcp-g-1" } }, "cli": "railway deploy --template contextforge-mcp-g-1", "api": { "method": "POST", "path": "/graphql/v2", "body": { "query": "mutation templateDeploy($input: TemplateDeployV2Input!) { templateDeployV2(input: $input) { projectId workflowId } }", "variables": { "input": { "templateId": "dfb7a9d6-7bc8-4950-9d45-699cf7bd0302", "serializedConfig": { "buckets": {}, "services": { "0dded225-abd1-436e-9b40-472006eafc8c": { "icon": "https://devicons.railway.app/i/postgresql.svg", "name": "Postgres", "deploy": { "startCommand": null, "healthcheckPath": null, "restartPolicyType": "ALWAYS", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/railwayapp-templates/postgres-ssl:18" }, "variables": { "PGDATA": { "isOptional": false, "description": "[Do not change] Directory holding the database files inside the volume.", "defaultValue": "/var/lib/postgresql/data/pgdata" }, "PGHOST": { "isOptional": false, "description": "[Do not change] Private hostname the gateway uses to reach this database.", "defaultValue": "${{RAILWAY_PRIVATE_DOMAIN}}" }, "PGPORT": { "isOptional": false, "description": "[Do not change] Port Postgres listens on inside the private network.", "defaultValue": "5432" }, "PGUSER": { "isOptional": false, "description": "[Do not change] Alias of POSTGRES_USER that client tools read.", "defaultValue": "${{POSTGRES_USER}}" }, "PGDATABASE": { "isOptional": false, "description": "[Do not change] Alias of POSTGRES_DB that client tools read.", "defaultValue": "${{POSTGRES_DB}}" }, "PGPASSWORD": { "isOptional": false, "description": "[Do not change] Alias of POSTGRES_PASSWORD that client tools read.", "defaultValue": "${{POSTGRES_PASSWORD}}" }, "POSTGRES_DB": { "isOptional": false, "description": "[Do not change] Name of the database created on first boot.", "defaultValue": "railway" }, "DATABASE_URL": { "isOptional": false, "description": "[Do not change] Standard connection string for database clients.", "defaultValue": "postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}" }, "POSTGRES_USER": { "isOptional": false, "description": "[Do not change] Superuser created on first boot.", "defaultValue": "postgres" }, "SSL_CERT_DAYS": { "isOptional": false, "description": "[Do not change] Lifetime in days of the self-signed certificate for encrypted connections.", "defaultValue": "820" }, "POSTGRES_PASSWORD": { "isOptional": false, "description": "Superuser password of your database.", "defaultValue": "{{POSTGRES_PASSWORD}}" }, "RAILWAY_DEPLOYMENT_DRAINING_SECONDS": { "isOptional": false, "description": "[Do not change] Seconds Postgres gets to finish open queries during a redeploy.", "defaultValue": "60" } }, "volumeMounts": { "0dded225-abd1-436e-9b40-472006eafc8c": { "mountPath": "/var/lib/postgresql/data" } } }, "6e2738bf-0c85-4307-b84d-6b3e81c6f0d0": { "icon": "https://github.com/IBM.png", "name": "ContextForge", "deploy": { "startCommand": "", "healthcheckPath": "/health", "restartPolicyType": "ALWAYS", "restartPolicyMaxRetries": 10 }, "source": { "image": "ghcr.io/ibm/mcp-context-forge:v1.0.10" }, "variables": { "HOST": { "isOptional": false, "description": "[Do not change] Interface the gateway binds to.", "defaultValue": "0.0.0.0" }, "PORT": { "isOptional": false, "description": "[Do not change] Port the gateway listens on.", "defaultValue": "4444" }, "APP_DOMAIN": { "isOptional": false, "description": "[Do not change] Public URL of this gateway. CORS and OAuth callbacks are bound to it.", "defaultValue": "https://${{RAILWAY_PUBLIC_DOMAIN}}" }, "ENVIRONMENT": { "isOptional": false, "description": "[Do not change] Runtime mode. Production enforces strict CORS and secure cookies.", "defaultValue": "production" }, "DATABASE_URL": { "isOptional": false, "description": "[Do not change] Connection string to the bundled Postgres, in the psycopg scheme the gateway requires.", "defaultValue": "postgresql+psycopg://${{Postgres.PGUSER}}:${{Postgres.POSTGRES_PASSWORD}}@${{Postgres.RAILWAY_PRIVATE_DOMAIN}}:5432/${{Postgres.PGDATABASE}}" }, "JWT_SECRET_KEY": { "isOptional": false, "description": "Signs login sessions and API tokens.", "defaultValue": "{{JWT_SECRET_KEY}}" }, "LLM_API_PREFIX": { "isOptional": false, "description": "[Do not change] URL prefix of the built-in LLM proxy endpoints.", "defaultValue": "/llm/v1" }, "SECURE_COOKIES": { "isOptional": false, "description": "[Do not change] Marks session cookies HTTPS-only.", "defaultValue": "true" }, "BASIC_AUTH_USER": { "isOptional": false, "description": "Username for HTTP Basic Auth, which is off by default.", "defaultValue": "admin" }, "GUNICORN_WORKERS": { "isOptional": false, "description": "[Do not change] Number of gateway worker processes. The built-in LLM Chat needs Redis with more than one.", "defaultValue": "1" }, "REQUIRE_USER_IN_DB": { "isOptional": false, "description": "[Do not change] Keeps the administrator bootstrap login enabled.", "defaultValue": "false" }, "BASIC_AUTH_PASSWORD": { "isOptional": false, "description": "Password for HTTP Basic Auth, which is off by default.", "defaultValue": "{{BASIC_AUTH_PASSWORD}}" }, "PLATFORM_ADMIN_EMAIL": { "isOptional": false, "description": "Login email of the administrator account. Required: enter your own address.", "defaultValue": "{{PLATFORM_ADMIN_EMAIL}}" }, "UAID_ALLOWED_DOMAINS": { "isOptional": false, "description": "[Do not change] Domain allowlist for cross-gateway routing.", "defaultValue": "[\"${{RAILWAY_PUBLIC_DOMAIN}}\"]" }, "DEFAULT_USER_PASSWORD": { "isOptional": false, "description": "Initial password of users created through the admin UI. They must replace it on first sign-in.", "defaultValue": "{{DEFAULT_USER_PASSWORD}}" }, "MCPGATEWAY_UI_ENABLED": { "isOptional": false, "description": "Serves the admin web UI at /admin.", "defaultValue": "true" }, "AUTH_ENCRYPTION_SECRET": { "isOptional": false, "description": "Encrypts the credentials you store for connected MCP servers.", "defaultValue": "{{AUTH_ENCRYPTION_SECRET}}" }, "PLATFORM_ADMIN_PASSWORD": { "isOptional": false, "description": "First-login password of the administrator account. The gateway makes you replace it on first sign-in.", "defaultValue": "{{PLATFORM_ADMIN_PASSWORD}}" }, "MCPGATEWAY_SKIP_MIGRATIONS": { "isOptional": false, "description": "[Do not change] Runs database migrations on every deployment.", "defaultValue": "false" }, "RATE_LIMITING_REDIS_ENABLED": { "isOptional": false, "description": "[Do not change] Rate limiting runs in memory. This template ships no Redis.", "defaultValue": "false" }, "SSRF_ALLOW_PRIVATE_NETWORKS": { "isOptional": false, "description": "[Do not change] Allows registering MCP servers that run on this project's private network.", "defaultValue": "true" }, "MCPGATEWAY_ADMIN_API_ENABLED": { "isOptional": false, "description": "Enables the admin REST API.", "defaultValue": "true" } }, "networking": { "serviceDomains": { ":4444": { "port": 4444 } } } } } } } } } } }, "post_deploy": { "healthcheck": { "service": "ContextForge", "method": "GET", "path": "/health", "expect_status": 200 } }, "resources": { "expected_services": 2, "needs_volume": true }, "generated_at": "2026-10-06T04:14:42.626Z", "generator_version": "0.1.0" }