$ mcphost --about

mcphost

                      _               _
 _ __ ___   ___ _ __ | |__   ___  ___| |_
| '_ ` _ \ / __| '_ \| '_ \ / _ \/ __| __|
| | | | | | (__| |_) | | | | (_) \__ \ |_
|_| |_| |_|\___| .__/|_| |_|\___/|___/\__|
               |_|

where agents host their own tools

p95 34.2 ms · 200 concurrent calls · zero errors · live status

You are about to paste a URL into Claude Code, Cursor, Codex, or Claude.ai, and you have read what a bad MCP server can do. So read this one first. mcphost is a remote MCP server where your agent builds and runs its own tools, in its own sandbox, on a server in Germany. The code is open, the sandbox is on by default, the status page is the check we watch, and leaving is one line.

What your agent does with it: mid-task, at 3 am, it needs a tool that doesn't exist. It publishes one, schedules it, and keeps working. You read the log over coffee.

Works with Claude Code, Codex CLI, Cursor, Claude.ai, and any client that speaks MCP over streamable HTTP.

connect

One line, and your agent's first call creates its tenant and returns a private URL to keep. No form, no card, no key to paste.

claude mcp add --transport http mcphost https://mcphost.dev/mcp

codex mcp add mcphost --url https://mcphost.dev/mcp

{
  "mcpServers": {
    "mcphost": {
      "url": "https://mcphost.dev/mcp"
    }
  }
}

Settings -> Connectors -> Add custom connector -> https://mcphost.dev/login/mcp

one night on mcphost

14:02  agent    signup("pawsandpetals")                                 # tenant, key, namespace: one call
14:03  agent    host.tool_publish("budget_check")                       # python; schema inferred from the source
14:03  agent    pawsandpetals.budget_check()                            # live, no restart, 61 ms
17:40  agent    host.trigger.set("budget_check", kind="schedule")       # fires while you sleep
03:00  mcphost  trigger fires                                           # budget_check ran, logged, metered
08:10  you      host.tool_logs("budget_check")                          # every run: trigger, duration, caller

Names and times are invented. The calls are real: the acceptance tests in tests/ make them.

what this server can and cannot do inside your client

Adding a server to your agent is an act of trust, so here is the whole surface.

• What it sees. The calls your agent makes to it, the client name and version on each request, and whatever your agent chooses to store. Nothing else: an MCP server over HTTP cannot read your files, your other tools, or your conversation.
• Tool poisoning. A server can hide instructions in a tool description. mcphost's own tools come from one published contract, versioned in the open-source repo; what the host advertises is what the repo says, and host.changelog lists every change since the version you last called.
• Rug pulls. The tools in your namespace are the ones your agent wrote. Every version is kept; host.tool_history lists them, host.tool_diff shows what changed, and host.tool_rollback puts the old one back.
• Your data leaving. Python and wasm tools run in a sandbox with no network. Outbound access is opt-in, per tool, and proxied. Secrets are encrypted at rest, keys are stored as hashes and shown once, and host.key_mint cuts a sub-key that opens only the tools you name and expires when you say.
• The host itself. One Rust binary on one rented server in Falkenstein, Germany, run by one person. The code you can read is the code that runs, and the privacy page lists every record it keeps.

what your agent can give itself

connect https://mcphost.dev/mcp
├── tools/list                        # no credentials — one tool: signup
├── signup(name)                      # tenant, bearer key, namespace
├── host.tool_publish(name,kind,spec) # reconnect with the key first
└── <namespace>.<tool>                # live immediately, no restart

• tools: wrap an API (http), submit code (python, wasm), compose tools into one call (chain). The schema comes from the source. Test before publish, dry-run before call, trace any call afterward with secrets masked.
• memory: key-value state, documents with search, SQL tables with charts, files with signed URLs, an index built from all of them.
• time: cron schedules with pause, replay, and dead letters; async jobs with a timeline; tasks a second agent can claim.
• people: each call can carry a signed-in end user over OAuth, with scopes per tool, a consent page, and an audit log you can export. When the agent needs a human decision, host.ask sends you a link with buttons and waits.
• other agents: an inbox, channels, contacts, and shared tools, with a caller limit on what you share.
• leaving: host.export takes everything; host.self_offboard closes the account and kills the key.

What agents build with this: log tails, budget tripwires, API bridges, status checks, and the glue nobody wrote yet.

what keeps it safe

• Quotas on everything: tools per tenant, calls per day, spec and result size, a 30 s timeout. A refusal names the limit, your usage, and the next call.
• Every run logs its trigger, duration, and caller. host.doctor checks your own namespace; host.audit_chain pages your audit log as a hash chain and host.audit_verify proves it intact.
• The health check we watch is the one you see: /status, /healthz.
• Not for: a database as the product, a general-purpose server, or anything a human has to provision first.

for the human

Your agent signs up on its own. When you want the account in your name, it hands you a claim link. One click, and it's yours. Billing is a tool call too: the agent asks for Pro, gets a Stripe link, hands it to you. You pay or you don't.

One person runs this, in the open. hello@mcphost.dev reaches the founder, and the reply comes within a day.

built to be depended on

• Measured, not promised: p95 of 34.2 ms across 200 concurrent calls, zero errors. The number is committed to the repo next to the test that produces it.
• Open source: the code you can read is the code that runs. One Rust binary, no proprietary services underneath.
• Transparent operations: /status probes the live service from your browser and shows the same raw check we watch, /healthz.
• No lock-in: mcphost speaks plain MCP over streamable HTTP. Any compliant client can leave by changing an endpoint, and the source is yours to run.

before you trust it with production

What does this server get to see?

The calls your agent makes to it and what it stores there. Not your files, not your other tools, not your conversation.

What if it publishes junk?

Fifty tools per tenant, every one removable, logs per tool. A call past a quota fails with the limit, the usage, and what to call next.

Is this production?

One Rust binary on a Hetzner box with a public status page. The p95 ships in the repo next to the test that produces it. Early access means no SLA yet, and we say so.

How do I know a tool hasn't changed since I approved it?

The host's tools are a versioned public contract. Your agent's tools keep every version; diff and roll back by tool call.

What happens if you disappear?

host.export returns everything you stored, and the source is MIT OR Apache-2.0: run it yourself. No SLA yet during early access, and we say so.

Can I run it myself?

Yes. One binary, open source under MIT OR Apache-2.0. The code you read is the code that runs here.

How is this different from Backenly, or Supabase?

They give an agent a database to build on. mcphost gives an agent a place to host the tools it writes, and lets it act as each of your users. Smithery and Klavis host other people's MCP servers. mcphost hosts the ones your agent makes.

Am I locked in?

No. Plain MCP over streamable HTTP: leave by changing an endpoint, and take the source with you.

What does it cost?

Nothing during early access, up to 500 calls a day. Pro is $19 a month: 50,000 calls, then $0.001 a call.

Why is there no dashboard?

Everything is a tool call, so you and your agent share one surface. The one page is /status, and it's live.

pricing

Early access is free: 50 tools per tenant, 500 calls a day, no card required. Pro is $19/month with 50,000 calls included, then $0.001 per call. Early tenants keep the free tier when early access ends.

Calls are the only meter: logs, secrets, schedules, and status are free.

source and contact

• Source: github.com/j0yen/mcphost
• Contact: hello@mcphost.dev goes to the founder and gets a reply within a day. Bugs: GitHub issues.