Visit Website →
← Back to blog

Hosted MCP Endpoint: What It Is and When to Use One

October 22, 2026
Hosted MCP Endpoint: What It Is and When to Use One

A hosted MCP endpoint is a Model Context Protocol server that someone else runs and you reach over HTTPS with a URL and a credential. Your agent does not launch a child process on your laptop. It sends JSON-RPC requests to a remote address and gets tool results back. Teams use them when agents run in CI, in the cloud, or in a browser, where no developer machine is available to spawn a local server.

This guide covers how a hosted endpoint works, what the spec requires of it, the security mistakes that recur, and how to decide between hosted and local.

Gyrence
Give Agents Web Data Through MCP
Gyrence’s hosted MCP endpoint connects agents to five web data primitives, with spending caps and typed failure responses.
Explore the hosted MCP endpoint

TL;DR

  • A hosted (or remote) MCP server runs as a service and speaks Streamable HTTP. A local one runs as a child process over stdio.
  • Hosted endpoints must authenticate every request. Bearer tokens go in the Authorization header, never in the query string.
  • Moving off local stdio removes access to your SSH keys and environment variables. It adds a new risk: a server with broad permissions being tricked by the wrong caller.
  • Pick hosted for background agents, shared teams and anything production. Keep local for quick single-developer experiments.
  • Gyrence offers a hosted MCP endpoint over its five web data primitives, with spending caps and typed failure responses.

Table of Contents

What "hosted" actually means

The protocol is the same either way. The difference is where the server runs and how the client talks to it. CircleCI's explainer puts it plainly: a local server is launched by the client over stdio, while a remote (hosted) server is a service reached over HTTP. That makes it usable by agents in a browser, a CI runner or a backend service.

The search terms "hosted MCP server", "remote MCP" and "managed MCP" mostly describe one thing. The nuance is in who operates it:

  • Remote, self-run: you write the server and deploy it behind your own gateway.
  • Hosted or managed: a vendor operates it, and you receive a URL and credentials.

For a web data tool, the managed route means you do not run browsers, proxies or extraction models yourself. You point the client at the endpoint.

How a hosted endpoint works on the wire

According to the MCP site, remote servers use Streamable HTTP, with requests sent as JSON-RPC over HTTP POST to a single endpoint. Production endpoints must be served over HTTPS and validate the Origin header to block DNS rebinding. Unauthenticated requests should return a 401 with a WWW-Authenticate header, so the client knows to start authorization.

The Streamable HTTP transport page notes the transport was introduced in protocol version 2025-03-26 to replace the older HTTP+SSE transport, and that revision 2026-07-28 changed its behavior. Check which protocol version your client and server both support before you debug anything else.

The 2026-07-28 release candidate post shows a tool call as one self-contained POST that any server instance can handle. In practice that makes horizontal scaling easier, because requests no longer depend on a particular instance.

Self-contained MCP requests routed to server instances

Authentication: what the spec expects

A hosted endpoint is a network service that can act for a user or an agent, so treat it like any other protected API.

  1. Bearer tokens on every request. Per Microsoft's guidance on securing an MCP server, servers act as OAuth 2.1 resource servers and require Authorization: Bearer <access-token> each time. Tokens must stay out of the URI query string.
  2. Validate issuer, audience and expiry. Audience-bound tokens stop a token minted for one service from being replayed against another.
  3. Publish protected resource metadata. The authorization section of the 2026-07-28 spec has servers implement OAuth 2.0 Protected Resource Metadata so clients can discover the right authorization server. Clients should validate the iss parameter to defend against mix-up attacks.
  4. Do not hand-roll token validation. Use maintained libraries. Microsoft's guide names bugs in manual validation as a common route to silent, unauthorized tool execution.

If you only need to consume a hosted endpoint, your job is smaller: store the credential in a secret manager, scope it as narrowly as the vendor allows, and rotate it.

Security: why hosted is safer, and where it is not

Local stdio servers run with your user's privileges. TrendAI's research on containerizing MCP describes agents gaining reach to things like SSH keys and cloud CLI profiles on the host. Moving to a remote, isolated server removes that exposure. Cloudflare's enterprise reference architecture goes further and calls locally hosted servers a security liability, citing unvetted software sources and supply chain risk.

Hosted is not automatically safe, though. Three mistakes recur:

  • Binding to 0.0.0.0. If you run your own remote server, TrendAI flags listening on all interfaces as a bad practice. Microsoft's Azure MCP security guidance says to bind to 127.0.0.1 locally, or put a gateway between client and server when exposing it on a network.
  • Trusting TLS alone. Encryption in transit does not decide who may call which tool. Authorization policy must apply on every transport.
  • The confused deputy. A server holding broad internal permissions can be tricked by an unauthorized caller. Cloudflare's write-up recommends enforcing per-caller permission checks rather than relying on the server's own identity.

For larger organizations, the same Cloudflare post describes putting servers behind an enforcement gateway that handles authentication, rate limiting and auditing. If you want a step-by-step version of the spec requirements, our MCP security checklist turns them into a one-week plan.

Hosted or local: a decision table

SituationBetter fitWhy
One developer, prototyping in an IDELocal (stdio)No network setup, fastest loop
Agent runs in CI, cloud or a browserHostedNo machine to spawn a child process
Several teammates share the same toolsHostedOne credential policy, one audit point
Tool touches the open web at volumeHostedBrowsers, proxies and retries live on the vendor side
Tool needs your local filesLocalThe data is on your machine

The tradeoffs between local and hosted architectures, and the controls that matter when small teams ship agents, are also covered in this write-up on shipping Claude agents safely.

Connecting a client to a hosted endpoint

Most clients need only a URL and an auth method. In Claude, for example, custom connectors are added in settings: you name the connector, paste the remote MCP server URL, and review the authentication settings Claude detects. On Team and Enterprise plans, everyone using the connector reaches the service with the same credential, so give it only the access members should have.

Anthropic's MCP connector documentation describes connecting to remote servers directly from the Messages API without a separate MCP client. The feature is marked beta, so check the page for its current status.

If you are building your own client, start from working code. Our MCP client examples walk through transports first, and the guide to setting up an MCP server covers the server side.

Connecting a client to a hosted endpoint — overview diagram

Our perspective: what a hosted web data endpoint owes you

Web data is a storm. Pages time out, block, redirect, paywall and change shape. A hosted endpoint that hides this behind a friendly string is worse than no endpoint, because the agent then reasons over a guess.

So we built the Gyrence endpoint around three rules:

  • Failures are values, not surprises. Every call returns a typed, discriminated-union response, including the failure cases. An agent can branch on "blocked" versus "empty" versus "timeout" instead of parsing prose.
  • Cost is bounded before the call runs. Spending caps and predictable cost-per-call apply to MCP traffic as well as direct API calls. An agent in a loop should hit a cap, not your card limit.
  • The primitives stay composable. Search, Traverse, Fetch, Extract and Map are separate tools, so the model picks the smallest one that answers the question. LLM extraction is bundled, with no separate AI extraction charge.

What we will not claim: that a hosted endpoint removes the need for your own authorization thinking. Scope the credential, log the calls, and decide which tools an agent may use unattended.

— Glen

Try the Gyrence hosted MCP endpoint

The connection guide shows how to attach an agent, and Gyrence for AI agents covers LangChain, CrewAI, AutoGen and MCP clients. There is a Free plan to start with. Paid tiers on the pricing page run from Standard at $75 per month to Growth at $299 per month and Scale at $549 per month, plus Pay-As-You-Go metering.

If your agent also needs to know when a page changes, WebDoppler adds monitoring with webhook alerts.

For product teams deciding where agents fit into a workflow before wiring up tools, Eddy Bogomolov's AI agents and workflows consulting is one place to look.

FAQ

Is a hosted MCP server the same as a remote MCP server?

In everyday use, yes. Both mean a server that runs as a service and is reached over HTTP rather than launched locally over stdio. "Managed" usually adds that a vendor operates it for you.

Which transport does a hosted MCP endpoint use?

Streamable HTTP, where JSON-RPC requests go to a single endpoint by POST. It replaced the older HTTP+SSE transport, so confirm that your client supports the protocol version your server speaks.

Do I need OAuth to use a hosted endpoint?

The MCP authorization spec is built on OAuth 2.1, with bearer tokens in the Authorization header. Some vendors also support API keys for simpler clients. Whatever the method, never put a token in the URL query string.

Can I still run MCP locally?

Yes, and for single-developer prototyping it is often the fastest route. Be aware that a local stdio server inherits your user's privileges, so keep it away from sensitive credentials and files.

Sources