The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
There is no single, portable “HTTP server parameters” block in MCP. The Model Context Protocol defines transport behavior, while each SDK or hosting framework exposes its own listener, route, session, timeout, body-size, and security options. In the official MCP Python SDK, the Streamable HTTP server method documents 127.0.0.1, port 8000, and the /mcp route as defaults. Treat those as Python SDK defaults, not universal MCP settings.
Before changing code, identify the protocol revision and SDK version your client and server support. The published 2025-11-25 transport specification and the 2026-07-28 draft describe materially different HTTP behavior.
Start with the protocol revision
The published 2025-11-25 transport requires one MCP endpoint path supporting both POST and GET. It also says local servers should bind only to localhost (127.0.0.1) instead of all interfaces (0.0.0.0), validate the Origin header, and implement authentication for connections. HTTP clients send the negotiated MCP-Protocol-Version header. Read the exact requirements in the published specification.
The draft revision dated 2026-07-28 is not interchangeable with that published contract. It describes a POST-only endpoint, changed stream behavior, required metadata headers, and removal of protocol-level sessions and a standalone GET stream. Use draft rules only when your SDK explicitly targets that draft; otherwise configure and test against the published revision your implementation supports.
Python SDK server parameters
The official Python SDK exposes these options on run_streamable_http_async (see the Server API reference):
| Parameter | Purpose | Documented Python SDK default or behavior |
|---|---|---|
host |
Address on which the HTTP listener binds. | 127.0.0.1 |
port |
TCP listener port. | 8000 |
streamable_http_path |
HTTP route used as the MCP endpoint. | /mcp |
json_response |
Selects JSON responses rather than the streaming response mode where supported. | Configure for the client and protocol behavior you need. |
stateless_http |
Chooses stateless handling instead of retaining per-session state. | Explicitly choose; requirements depend on your server. |
event_store |
Optional store for resumable or event-related behavior. | Optional. |
retry_interval |
Optional retry interval used by the transport. | Optional. |
max_request_body_size |
Maximum accepted HTTP request body. | Set according to tool arguments and proxy limits. |
session_idle_timeout |
How long an inactive session may remain open. | Configure for workload and resource limits. |
max_sessions |
Capacity limit for concurrent sessions. | Configure for available resources. |
transport_security |
Host, origin, and related transport-security policy. | Default protection applies when no custom policy is supplied. |
A minimal illustrative server is:
await mcp.run_streamable_http_async(
host="127.0.0.1",
port=8000,
streamable_http_path="/mcp",
stateless_http=True,
)This shape is specific to the current Python SDK API. It is not a production checklist: add the limits, authentication, security policy, and state model required by your deployment. The SDK passes these values to its Streamable HTTP application and runs it through Uvicorn.
Set host and port safely
Local development
- Bind to
127.0.0.1(or the IPv6 loopback address if your environment requires it). - Choose an unused port, such as
8000, and make the same host, port, and route available to your MCP client. - Open
http://127.0.0.1:8000/mcponly from the local machine.
Do not use 0.0.0.0 merely because a tutorial does. Binding all interfaces makes the listener reachable through every network interface and should be a deliberate deployment decision protected by network controls and authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remote deployment
For a public server, bind according to your process manager or reverse-proxy design, publish a real HTTPS hostname, and configure the framework’s trusted host and origin policy for that hostname. Terminate TLS and enforce authentication at the service or an explicitly trusted proxy. Also make sure the proxy forwards the MCP route, required headers, streaming responses, and request-size limits without changing methods.
Choose the endpoint path
The Python SDK default is /mcp, but the protocol does not make that path universal. If you select /api/mcp, configure the same path in the client, reverse proxy, health checks, firewall rules, and documentation. Under the published 2025-11-25 transport, the server exposes one MCP endpoint supporting POST and GET; do not create separate “POST endpoint” and “GET stream” paths unless the specific draft or framework you use requires that different shape.
Stateful versus stateless operation
Stateless mode
stateless_http=True avoids retaining per-client session state. It can simplify horizontal scaling when each request contains everything required to process it. Confirm that your tools do not depend on server-initiated messages, resumable streams, or other stateful behavior before selecting it.
Stateful mode
Stateful operation lets the server retain session context and may be necessary for implementations that rely on negotiated state or server-initiated behavior. Set session_idle_timeout, max_sessions, and an event_store when the SDK and workload require them. These are resource and behavior controls, not protocol-wide defaults.
Configure security and host validation
The Python deployment guide explains that, without custom transport_security, the app applies DNS-rebinding protection for local hosts such as 127.0.0.1, localhost, and [::1], with corresponding local origins. That local policy rejects a real public hostname until you configure an appropriate allowlist. Invalid Host requests can produce HTTP 421, while invalid Origin requests can produce HTTP 403. See Deploy and scale.
- For local use, keep loopback binding and validate Host and Origin.
- For public use, allow only the deployment hostnames and origins you actually control.
- Require authentication appropriate to the application and protect credentials in transit.
- If a reverse proxy is trusted, document which forwarded host and origin headers it may set and prevent untrusted clients from spoofing them.
The C# SDK illustrates why you must read your selected library’s documentation: its v2 transport maps HTTP at a configured route, describes stateless hosting as the default for that documented transport, and recommends limiting accepted hostnames rather than allowing every host. Compare its current guidance at C# SDK v2 transports.
Configure limits, responses, and timeouts
Request body size
Set max_request_body_size high enough for legitimate tool arguments but low enough to limit memory and abuse. Coordinate this value with the reverse proxy’s maximum body size; the smallest limit wins.
Response mode
Use json_response when your protocol revision and client expect a complete JSON response. Streaming behavior is revision- and SDK-dependent, so verify the negotiated transport rather than assuming that a setting changes the protocol contract.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIdle sessions and capacity
Use session_idle_timeout to reclaim abandoned state and max_sessions to cap concurrent resource use. Size both for expected concurrency, then observe rejected or expired sessions under realistic load.
Retry and event storage
retry_interval and event_store are optional Python SDK controls. Add them only when your selected transport behavior needs retries or event persistence, and ensure any store is shared or externally durable when multiple server instances handle the same logical clients.
Keep client settings separate
Server listener parameters do not configure the client. A Python Streamable HTTP client receives the endpoint URL and may receive a configured HTTP client for headers, authentication, and other HTTP settings; redirects are constrained to same-origin and method-preserving redirects. See the Python client reference.
The OpenAI Agents SDK documents client-side values including server URL, headers, HTTP request timeout, Streamable HTTP connection timeout, authentication, and a custom HTTP-client factory at its MCP server reference. A client request timeout does not set the server’s listener or session timeout. Names and defaults vary by SDK.
Verify a configuration before production
- Record the MCP protocol revision and exact SDK versions on both sides.
- Confirm the route, method support, and required protocol headers with a real client.
- Check that Host and Origin validation accepts the intended local or public hostname and rejects an unapproved one.
- Test authentication failure, oversized bodies, idle-session expiry, and the maximum-session limit.
- Place the server behind the actual reverse proxy and verify streaming, redirects, forwarded headers, TLS, and timeout behavior.
- Test a restart and, if stateful, confirm whether sessions and events are intentionally lost or recovered.
Troubleshooting common HTTP failures
Connection refused
Usually the process is stopped, listening on another port, or bound only to loopback while the client runs elsewhere. Check the process listener, configured host, port, container port mapping, and firewall.
404 Not Found
The client route and server route differ, or the proxy did not forward the path. Compare the exact path, including a trailing slash, with streamable_http_path.
421 Misdirected Request
The Python security policy rejected the Host value. Configure an allowlist for the real hostname or use the documented local host during development.
403 Forbidden
An Origin check failed. Send the permitted origin from the client or update the transport-security policy intentionally; do not disable validation as a shortcut.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
413 Request Entity Too Large
The request exceeded max_request_body_size or a proxy limit. Increase both only after reviewing memory and abuse risk, or reduce tool payloads.
Best Value
Unexpected stream or method errors
The client and server may target different protocol revisions. Check whether one expects the published 2025-11-25 POST-and-GET endpoint while the other implements the 2026-07-28 draft POST-only behavior.
Sessions disappear or scale poorly
Review stateless_http, session_idle_timeout, max_sessions, and event-store configuration. Stateful workloads generally need shared state when requests can reach multiple instances.
Or skip the browser setup
If your HTTP MCP work includes capturing pages for documentation, tests, or agent workflows, ScreenshotNeo provides a one-call website screenshot API and MCP server. It accepts cookie and consent banners before capture, removes more than 60 known consent platforms plus newsletter popups and chat widgets, and bills only clean shots: bot checks, blank pages, timeouts, failed loads, and cache hits cost nothing. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf for Claude, Cursor, and other MCP clients.
Recommended Free Tools
cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);See the complete options in the ScreenshotNeo documentation. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
FAQ
Is port 8000 required by MCP?
No. Port 8000 is the documented default of the MCP Python SDK method, not a protocol requirement.
Can I expose MCP on any URL path?
The path is selected by the SDK or framework, but client and server must use the same configured endpoint and follow the protocol revision they support.
Should every MCP server be stateless?
No. Choose stateless or stateful operation based on session, event, and server-initiated behavior required by your implementation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Bottom Line
Configure MCP HTTP servers from the protocol revision and SDK documentation together: set the listener and route explicitly, keep local servers on loopback, define host/origin and authentication policy for public deployment, and treat client timeouts and headers as separate settings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
