Deploying & Hosting Remote MCP Servers

TL;DR — Production Deployment Quickstart

Running a local stdio MCP server is ideal for personal dev tools. To share tools across your team or AI agent fleet, wrap your MCP logic in an HTTP/SSE transport, package it as a Docker image or Cloudflare Worker, enforce TLS & Bearer token auth, and route requests to dedicated /sse and /message endpoints.

// wrangler.json
{
  "name": "production-mcp-agent",
  "main": "src/index.ts",
  "compatibility_date": "2026-01-01",
  "observability": { "enabled": true }
}

import { McpAgent } from "agents/mcp";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { z } from "zod";

export class CloudflareMCPServer extends McpAgent {
  server = new McpServer({
    name: "cloud-mcp-service",
    version: "1.0.0",
  });

  async init() {
    // Register custom production tool
    this.server.tool(
      "fetch_weather_forecast",
      {
        city: z.string().min(2),
        units: z.enum(["celsius", "fahrenheit"]).default("celsius"),
      },
      async ({ city, units }) => {
        return {
          content: [
            {
              type: "text",
              text: JSON.stringify({
                city,
                temp: units === "celsius" ? 22 : 72,
                condition: "Sunny",
              }),
            },
          ],
        };
      }
    );
  }
}

export default {
  async fetch(request: Request, env: Record<string, unknown>, ctx: ExecutionContext) {
    const url = new URL(request.url);

    // Secure endpoint with Bearer Token validation
    const authHeader = request.headers.get("Authorization");
    if (!authHeader || !authHeader.startsWith("Bearer ")) {
      return new Response(JSON.stringify({ error: "Unauthorized: Missing Bearer Token" }), {
        status: 401,
        headers: { "Content-Type": "application/json" },
      });
    }

    if (url.pathname.startsWith("/mcp")) {
      return CloudflareMCPServer.serve("/mcp").fetch(request, env, ctx);
    }

    return new Response("MCP Server operational.", { status: 200 });
  },
};

npx wrangler deploy

# Stage 1: Build TypeScript binaries
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json tsconfig.json ./
RUN npm ci
COPY src ./src
RUN npm run build

# Stage 2: Production runtime image
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production

# Security: Run as non-root user
USER node

COPY package*.json ./
RUN npm ci --only=production
COPY --from=builder /app/dist ./dist

EXPOSE 3001
CMD ["node", "dist/server.js"]

# docker-compose.yml
version: '3.8'
services:
  mcp-server:
    build: .
    ports:
      - "3001:3001"
    environment:
      - PORT=3001
      - DATABASE_URL=postgresql://user:secret@db:5432/app_db
      - MCP_API_KEY=prod_mcp_sec_8f92a1b3c4
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/health"]
      interval: 30s
      timeout: 5s
      retries: 3

# Generate fly.toml configuration
fly launch --name my-remote-mcp-server --no-deploy

# Deploy container image to Fly.io global region
fly deploy

fly secrets set DATABASE_URL="postgresql://user:pass@host:5432/db" MCP_AUTH_TOKEN="sec_key_12345"

import express from 'express';
import cors from 'cors';
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
import { z } from 'zod';

const app = express();
app.use(cors({ origin: '*' }));
app.use(express.json());

// Active sessions map
const transports = new Map<string, SSEServerTransport>();

// Initialize MCP Server capabilities
function createMcpServer() {
  const server = new McpServer({
    name: "production-express-mcp",
    version: "1.0.0",
  });

  server.tool(
    "calculate_tax",
    {
      amount: z.number().positive(),
      state: z.string().length(2),
    },
    async ({ amount, state }) => {
      const taxRate = state.toUpperCase() === 'CA' ? 0.0725 : 0.05;
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify({
              subtotal: amount,
              tax: Number((amount * taxRate).toFixed(2)),
              total: Number((amount * (1 + taxRate)).toFixed(2)),
            }),
          },
        ],
      };
    }
  );

  return server;
}

// 1. SSE Connection Endpoint
app.get('/sse', async (req, res) => {
  console.log('Client connected to /sse');
  const transport = new SSEServerTransport('/message', res);
  const server = createMcpServer();

  transports.set(transport.sessionId, transport);

  req.on('close', () => {
    console.log(`Session ${transport.sessionId} closed`);
    transports.delete(transport.sessionId);
  });

  await server.connect(transport);
});

// 2. HTTP POST Message Endpoint
app.post('/message', async (req, res) => {
  const sessionId = req.query.sessionId as string;
  const transport = transports.get(sessionId);

  if (!transport) {
    res.status(404).send('Session not found or expired');
    return;
  }

  await transport.handlePostMessage(req, res);
});

// Health check endpoint for load balancers
app.get('/health', (req, res) => {
  res.status(200).json({ status: 'ok', activeSessions: transports.size });
});

const PORT = process.env.PORT || 3001;
app.listen(PORT, () => {
  console.log(`Remote MCP Express server listening on http://localhost:${PORT}`);
});

mcp.yourdomain.com {
    # Automatic TLS certificate provisioned by Caddy
    reverse_proxy localhost:3001 {
        # Flush SSE data immediately to prevent response buffering delay
        flush_interval -1
    }
}

server {
    listen 443 ssl http2;
    server_name mcp.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/mcp.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mcp.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

        # Mandatory Nginx directives for Server-Sent Events (SSE)
        proxy_http_version 1.1;
        proxy_set_header Connection '';
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;

        # Increase timeout for persistent client connections
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}

⚠️ Critical Logging Rule for Stdio vs SSE Transports

In stdio mode, writing raw console.log() text to standard output corrupts the JSON-RPC transport stream and crashes the client. In remote HTTP/SSE mode, standard output is safe for application logs, but server metrics should still route to structured log aggregators (Datadog, CloudWatch, Axiom).

app.get('/health', async (req, res) => {
  try {
    // Optionally ping database or internal cache
    await db.raw('SELECT 1');
    res.status(200).json({ status: 'healthy', uptime: process.uptime() });
  } catch (err) {
    res.status(503).json({ status: 'unhealthy', error: err instanceof Error ? err.message : 'DB error' });
  }
});

{
  "mcpServers": {
    "remote-analytics-mcp": {
      "url": "https://mcp.yourdomain.com/sse",
      "headers": {
        "Authorization": "Bearer sec_prod_token_998877"
      }
    }
  }
}