# Project Brief — Private GitHub MCP Server on AWS ECS
## Purpose
Self-hosted GitHub MCP Server running on ECS Fargate, accessible via AWS Client VPN with Okta OAuth authentication. Provides shared GitHub tools (repos, issues, PRs, code search) to any MCP-compatible IDE.
## Core Requirements
- Run official GitHub MCP Server as a private, shared service
- Authenticate users via Okta OAuth 2.0 (Authorization Code + PKCE)
- Expose over Streamable HTTP transport for multi-developer concurrent access
- Restrict access to AWS Client VPN users only (internal ALB)
- Infrastructure as Code via Terraform
## Key Constraints
- ALB is internal-only, not internet-facing
- Self-signed TLS certificate (EasyRSA, imported to ACM)
- Single GitHub PAT shared across all sessions (stored in Secrets Manager)
- Okta Native/public client (no client secret, PKCE required)
- ECS tasks in private subnets, outbound via NAT Gateway
