Remote MCP servers: where to host them and how to lock them down

A remote MCP server lets AI assistants use your tools over the internet. It is a small web service with one HTTPS address, so a modest virtual server is enough to run it.

The hard part is security, because anything the server can reach, the assistant can reach too. The MCP specification asks servers to check where each request comes from and to require proper authentication.

The steps below follow the MCP specification of 28 July 2026, the official Python SDK and n8n's documentation, all read on 27 October 2026.

What a remote MCP server is

MCP, the Model Context Protocol, is a standard way for an assistant to discover and call tools. A local server talks to the assistant on the same computer; a remote one answers over the network.

Remote servers use the Streamable HTTP transport: one address, such as https://example.com/mcp, that accepts POST requests. It arrived in the specification of March 2025 and replaced the older HTTP-and-SSE transport.

Three ways to host one

Step by step on a small server

These steps use the official Python SDK, which needs Python 3.11 or newer. The example tool is our own and tells the assistant the server's time; replace it with your tools.

curl -LsSf https://astral.sh/uv/install.sh | sh
uv init mcp-demo && cd mcp-demo
uv add "mcp[cli]"

Save this as server.py:

from datetime import datetime, timezone
from mcp.server import MCPServer

mcp = MCPServer("Server clock")

@mcp.tool()
def utc_time() -> str:
    """Return the server's current time in UTC."""
    return datetime.now(timezone.utc).isoformat()

Start it with the SDK's own command. It serves the MCP address at http://localhost:8000/mcp:

uv run mcp run server.py --transport streamable-http

Then put HTTPS and a token check in front with Caddy. Requests without the right token get a 401 answer and never reach the server:

mcp.example.com {
    @noauth not header Authorization "Bearer choose-a-long-random-token"
    respond @noauth 401
    reverse_proxy 127.0.0.1:8000
}

Keep port 8000 closed in the firewall, so only the proxy on the same server can reach it. Run the server as a system service, or in tmux, so it keeps running after you log out.

n8n as an MCP server

n8n's MCP Server Trigger node turns an n8n workflow into an MCP server. Tools attached to it, including whole workflows through the Custom n8n Workflow Tool node, become tools the assistant can call.

• It supports Streamable HTTP and the older SSE transport, but not stdio, by n8n's documentation.
• It has a test address and a production address; the production one works once you publish the workflow.
• Authentication is built in: none, a bearer token or a custom header.
• In queue mode with several webhook replicas, all /mcp traffic must go to one dedicated replica, or connections break.

n8n's MCP Client Tool node works the other way round, letting n8n's own agents use outside MCP servers. Our guide to self-hosting n8n with Docker sets up the server.

Adding authentication

The specification makes authorisation optional, but asks HTTP servers that offer it to follow its OAuth 2.1-based flow. Servers that support it must publish their protected resource metadata (RFC 9728).

For a server only you use, the simplest lock is a long secret token checked by the proxy. It works if your MCP client can send a fixed header. For a server many people sign in to, OAuth is the specification's own route.

n8n's documentation notes one surprise: claude.ai's custom connectors ask you to sign in to n8n even when the trigger's authentication is set to none.

Security checklist

1. Serve the MCP address over HTTPS only, through a reverse proxy.
2. Require a token or OAuth for every request; the specification asks for proper authentication.
3. Check that your server or SDK rejects requests from unexpected Origin headers, which the specification requires.
4. Keep the MCP server itself on 127.0.0.1, behind the proxy.
5. Give each tool only the access it needs: read-only database users, narrow API keys, one folder.
6. Log every tool call, so you can see what the assistant did.

What it costs

A small MCP server like the one above needs very little: the smallest plan in the boxes below is enough to start (our reading). The tools it calls may need more, so size the server for them.

If you already run n8n, the trigger adds no new server. Our n8n requirements guide sizes it, and our agent platform guide compares n8n with Dify and Langflow.

How we checked

We read the MCP specification of 28 July 2026 and its security best practices on 27 October 2026. The same day we read the official Python SDK's README and n8n's documentation for its MCP nodes. The example server is our own.

Our own measurements will be added here, with their dates, when our test bench runs them.

Back to AI agent hosting