MODEL CONTEXT PROTOCOL · HOST & SERVE

MCP Server Hosting (2026): Every Option Compared

You built the server; hosting an MCP server is what turns it from a local script into a service any client can reach. This guide covers the four hosting routes — managed MCP platforms, edge/serverless, classic PaaS, and a plain VPS — with 2026 pricing, the OAuth 2.1 gate you cannot skip, and the five gotchas that kill remote servers in production. Everything reflects the stateless 2026-07-28 spec, not the SSE-era guides still ranking.

New here? Build one first Next: make it earn

The one technical decision behind “hosting”

MCP servers speak JSON-RPC 2.0 over a transport, and the transport decides whether hosting exists at all. stdio is a subprocess the client launches on its own machine — no URL, no auth, nothing to host, and it stays that way. Streamable HTTP turns the server into a web service at a URL (by convention under /mcp) that any client, anywhere, can call. “Hosting an MCP server” means exactly one thing: serving it over Streamable HTTP behind a public HTTPS endpoint.

Transport	What it is	Hosting implication
stdio	Client launches the server as a local subprocess; JSON-RPC over stdin/stdout	Zero hosting — but local-only. Cannot be shared with a team, called by a cloud agent, or metered for per-call revenue.
Streamable HTTP	Independent process exposing one HTTP endpoint (by convention `/mcp`); replies as JSON or a request-scoped SSE stream	Ordinary web hosting: keep it up, put TLS in front, gate it with OAuth — everything below.

Two 2026 facts settle the transport question for new work. First, the 2026-07-28 spec revision removed protocol-level sessions from Streamable HTTP and formally deprecated the legacy HTTP+SSE transport — the protocol now leans stateless plain HTTP, which is what makes edge and serverless hosting easy. Second, vendors are switching the old transport off on their own clocks (Neon's SSE endpoint, for one, stops working on or after October 1, 2026). Anything new you build should speak Streamable HTTP from day one.

Client support as of August 2026: Claude Code accepts stdio, SSE, and HTTP servers (--transport http for remote ones); Cursor and Codex accept stdio and Streamable HTTP; ChatGPT connectors and Claude.ai accept remote HTTPS servers only. The practical read: a server with no remote endpoint is invisible to two of the biggest client surfaces, and per-call metering is impossible on stdio because the buyer's machine runs the code.

The four hosting routes

A dozen platforms claim to host MCP servers; they are not competing for the same job. Sort them into four buckets and the choice gets obvious:

1. Managed MCP platforms

Git push becomes a live URL, usually in under a minute: Manufact (formerly mcp-use — TS + Python SDKs, a FastMCP preset, any stack via Dockerfile; top of the 2026 deployment benchmark at 95/100) and Prefect Horizon (built by the FastMCP team) are MCP-native end to end. Smithery (now part of Arcade.dev) and Glama sit a layer up — registries where clients discover servers, with hosted compute on top. OAuth handled for you.

2. Edge / serverless

Cloudflare Workers is the default for a remote MCP server in production: global edge, sub-50ms cold starts, 100,000 requests/day free, an official Agents SDK with the McpAgent class, and the workers-oauth-provider library that implements the OAuth 2.1 provider side for you. Vercel works the same way via mcp-handler. You write TS against the Agents SDK; the platform does not know or care it speaks MCP.

3. Classic PaaS / containers

Railway, Render, and Fly.io run a long-lived process for roughly $5–10/mo: full Node or Python runtime, Dockerfile deploys, familiar flow. Render ships official MCP templates (Blueprint + health check + auto-generated bearer token). Watch free tiers — 30s+ cold starts on Render's free plan, and a sleeping instance drops the long-lived sessions MCP depends on.

4. A plain VPS or your own box

~$5–6/mo buys a small VPS that runs FastMCP behind Caddy or nginx with TLS — the only route where the code, the data, and the logs never leave infrastructure you control, and the only one with no request meter at all. Worth it if you run several servers and know your way around a Linux box; it is the DIY end of the spectrum.

What MCP hosting costs in 2026

Verified against the platforms' own pricing pages, September 2026 — re-check before you commit, this market reprices quarterly:

Platform	Free tier	Paid
Cloudflare Workers	100,000 requests/day; containers include 25 GiB-hrs memory, 375 vCPU-min, 1TB egress free	$0.30 per million requests beyond free; $5/mo covers millions of requests for a low-traffic server
Smithery (Arcade)	Hobby: free, 50K RPCs/month, 3 namespaces, managed OAuth	$10/mo for 100K RPCs/month, then $0.10 per 1K; publishing to the registry stays free
Glama	Free to browse; free hosting for open-source servers	$9/mo Starter (3 hosted servers, $4 each additional) → $26 Pro (10) → $80 Business (30); gateway, call logs, managed OAuth 2.1 included
Manufact / Prefect Horizon	Git-push deploys with preview URLs per PR; free tiers on both	Usage-based; MCP-native build pipeline (mcp-use SDK / FastMCP)
Railway / Render / Fly.io	Limited; free tiers sleep (Render cold starts 30s+)	~$5–10/mo for a persistent process
VPS (self-managed)	—	~$5–6/mo flat, no meter; you own TLS, auth, process management, updates

The honest framing: for one low-traffic server the free tiers are genuinely usable — Cloudflare's 100K requests/day or Smithery's 50K RPCs/month carry a hobby tool indefinitely, and Glama hosts your server free if it is open-source. Paid plans start mattering when the server is a product: persistent always-on infrastructure, SLAs, and per-call billing all live on the paid side.

The auth layer you cannot skip

The moment the server is remote, MCP's authorization spec applies: your server is an OAuth 2.1 resource server — it verifies tokens and never issues them. On the first unauthenticated call it returns 401 with a WWW-Authenticate header pointing at your RFC 9728 Protected Resource Metadata document, and the client walks 401 → metadata → authorization server → token → retry with no custom code. PKCE is mandatory for public clients (which is most MCP clients), tokens must be audience-bound to your server per RFC 8707, and the 2026-07-28 revision made stateless per-request validation the protocol's posture.

Client registration moved too: Client ID Metadata Documents (CIMD) are now the recommended approach, with Dynamic Client Registration demoted to fallback and slated for removal after summer 2027. For enterprise deployments, Enterprise-Managed Authorization (EMA) is an official extension — an identity provider governs which clients reach which servers via the ID-JAG grant behind Cross-App Access, with no per-user consent screens. And never pass a client's token through to an upstream API: the server obtains its own tokens, or it becomes a confused deputy.

Implementation reality, September 2026: this is the part hosting platforms actually sell. Cloudflare's workers-oauth-provider implements the full provider side (including CIMD and RFC 9728 resource metadata) as a wrapper around your Worker; Smithery and Glama bundle managed OAuth with credential storage; MintMCP sells the compliance posture as its product. Roll it yourself on a VPS only if you have done OAuth 2.1 before — “OAuth with MCP is hard to implement yourself” is the reason the managed layer exists.

Five hosting gotchas that kill remote servers

Every one of these is silent from your side until a buyer or teammate hits it:

1. The sleeping instance

MCP sessions are long-lived; a free-tier instance that sleeps between calls drops them, and the first call after a quiet period pays a cold-start penalty. Fix: a plan that never sleeps is the single most important setting for a real MCP deployment.

2. In-memory session state

FastMCP keeps session context on the instance that handled the first request — the moment you run two instances behind a load balancer, requests land on the wrong one. Go stateless from the start: mcp.http_app(stateless_http=True). The 2026-07-28 spec removed protocol sessions entirely, so stateless is now the default posture, not an optimization.

3. Building on SSE

HTTP+SSE is formally deprecated; every guide (and one search engine's AI overview) still lists it as a live remote transport. Vendors are switching it off on their own schedules — build Streamable HTTP, and expect health probes every few hours if your server is listed anywhere.

4. The missing auth gate

A remote server with no 401-and-metadata flow is an open server — anyone who finds the URL can call your tools. Return 401 with WWW-Authenticate pointing at the RFC 9728 document, bind tokens to your audience, and test that an unauthenticated call fails closed.

5. The /mcp mount mismatch

Most HTTP servers mount the endpoint under /mcp; a client pointed at the bare domain gets ECONNREFUSED-style failures that look like the server is down when it is one path off. A healthy HTTP server answers a bare request with 405/406, not connection-refused — that is the fastest diagnostic.

Where VibeFuse fits

Hosting answers where the server runs; the harness answers where it gets used. VibeFuse is a free Windows harness where Settings → Tools hosts branded MCP cards (Google Workspace, Drive, GitHub, Copilot, Discord, Linear) plus your custom servers — every connected tool exposed to the built-in agents, no separate MCP host to babysit. That makes every install a potential user for whatever you host.

And hosting is the prerequisite for the money conversation: a stdio package can never collect per-call revenue because no call passes through a meter, which is three quarters of why the ecosystem earns almost nothing. Once your server lives at a public HTTPS endpoint, the VibeFuse marketplace is the open-source layer where creators make money on what they build — a flat 80% revenue share via Stripe Connect, $0.50–$500 creator-set pricing, no listing fee — inside the first ever free widget-based AI harness. Local/offline processing, works in any app.

MCP tools in a real harness Every marketplace compared (80% payouts)

✓ Free forever harness, VF- key
✓ Branded + custom MCP servers
✓ Local/offline processing
✓ 80% creator payouts

Run hosted servers in a free harness Where MCP servers get paid

Explore VibeFuse & harness guides

MCP server hosting — FAQ

How do I host an MCP server?

Four routes, all requiring the same prerequisite: switch the server from stdio to Streamable HTTP (in FastMCP that is transport="http", host="0.0.0.0"), then (1) a managed MCP platform — Manufact or Prefect Horizon turn a git push into a live URL in about a minute, Smithery and Glama add registry distribution on top; (2) Cloudflare Workers — the production default, with the Agents SDK McpAgent class and the workers-oauth-provider library handling the OAuth 2.1 side; (3) a classic PaaS — Railway, Render, or Fly.io running a persistent process for ~$5-10/mo; (4) a VPS behind Caddy/nginx where nothing leaves infrastructure you control. After the transport change, hosting is ordinary web deployment plus the auth gate.

How much does it cost to host an MCP server?

Free tiers are genuinely usable for one low-traffic server: Cloudflare Workers gives 100,000 requests/day free, Smithery Hobby gives 50K RPCs/month with managed OAuth at no cost, and Glama hosts open-source servers entirely free. Paid entry is low: Glama Starter $9/mo for 3 hosted servers, Smithery $10/mo for 100K RPCs, Railway/Render/Fly.io roughly $5-10/mo for a persistent process, Cloudflare $0.30 per million requests beyond the free tier, a small VPS $5-6/mo flat. The paid tiers start mattering when the server is a product — always-on persistence, SLAs, and per-call billing all live on paid plans.

Can I host an MCP server for free?

Yes, three ways. Cloudflare Workers: 100,000 requests/day and a real free container allocation — enough for a hobby tool indefinitely. Smithery Hobby: free with 50K RPCs/month and managed OAuth included. Glama: hosting is free if your server is open-source — deploy from the registry, no card. The catches: free PaaS tiers (Render, Railway free plans) sleep instances and cold-start 30+ seconds, which drops long-lived MCP sessions; and free serverless tiers have CPU-time limits that rule out heavy dependencies. For anything user-facing, a never-sleeps plan is the most important single setting.

Why does my hosted MCP server return 401?

That is the protocol working, not an error to suppress. A remote MCP server must act as an OAuth 2.1 resource server: on the first unauthenticated call it returns 401 with a WWW-Authenticate header pointing at its RFC 9728 Protected Resource Metadata document (/.well-known/oauth-protected-resource), and the client walks 401 -> metadata -> authorization server -> token -> retry with no custom code. If the 401 never resolves, the metadata endpoint is missing or misconfigured, the authorization server metadata is unreachable, or the token is not audience-bound to your server (RFC 8707 requires tokens issued specifically for it). PKCE is mandatory for public clients.

What is the difference between managed MCP hosting and a VPS?

Managed platforms (Manufact, Smithery, Glama, Cloudflare with workers-oauth-provider) sell you the boring 60%: OAuth 2.1 with PKCE, TLS, persistent connections, call logs, and deployment pipelines are handled, and registries add discovery. A ~$5-6/mo VPS keeps the code, data, and logs on infrastructure you control with no request meter at all — but you own TLS, reverse proxy, auth, and patching yourself. The rule of thumb: prototype free on managed, go VPS when data residency or cost-per-request matters, and re-evaluate when the server becomes a product with real traffic.

Do MCP servers need OAuth?

Remote (HTTP-transport) servers effectively do: the MCP authorization spec makes the server an OAuth 2.1 resource server — it validates tokens, never issues them, and responds to unauthenticated calls with 401 plus a WWW-Authenticate header pointing at its Protected Resource Metadata. PKCE is mandatory for public clients; tokens must be audience-bound (RFC 8707); Client ID Metadata Documents are now the recommended registration path with Dynamic Client Registration deprecated (removal slated after summer 2027). Enterprise deployments can layer Enterprise-Managed Authorization (EMA/ID-JAG, the Cross-App Access pattern) so an IdP governs which clients reach which servers with no per-user consent screens. stdio servers are the exception — they run locally and read credentials from the environment.

How does VibeFuse fit in?

VibeFuse is the buyer-side harness: a free Windows desktop where Settings -> Tools hosts branded MCP cards (Google Workspace, Drive, GitHub, Copilot, Discord, Linear) plus custom servers, all exposed to the built-in agents — every install is a potential user for your hosted server. Hosting is also the prerequisite for monetization: stdio packages run on the buyer's machine and can never collect per-call revenue, so a public HTTPS endpoint is step one. The VibeFuse marketplace is where creators make money on what they build — a flat 80% revenue share via Stripe Connect, $0.50-$500 creator-set pricing, no listing fee — inside the first ever free widget-based AI harness, with local/offline processing that works in any app.