Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Use stateless Streamable HTTP at a stable /mcp URL for a new remote Model Context Protocol (MCP) server. Run it behind HTTPS, protect user data and write tools with OAuth 2.1-style authorization, and test the deployed endpoint in MCP Inspector before connecting an agent. Local stdio is appropriate only when the client and server share a machine; SSE is a legacy choice for new deployments.
This guide walks from a focused tool design through local development, Cloudflare deployment, OAuth discovery, private-network hosting, remote testing, migration, and production troubleshooting.
As an Amazon Associate I earn from qualifying purchases.
What a remote MCP deployment looks like
A remote MCP server is an Internet-reachable service that speaks MCP over HTTP. An agent connects to one durable URL, commonly https://your-domain.example/mcp, then discovers tools and invokes them through the protocol. HTTPS terminates at your host or gateway; authentication and authorization determine which tools and records each caller may use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep the server focused on user goals instead of exposing an entire upstream API schema. Narrow tools are easier for models to select, easier to authorize, and easier to evaluate when descriptions or parameters change. Define every parameter precisely, validate input server-side, and run evaluation tests after changing a tool or its description.
#1 Best Overall
Choose the transport and state model
| Transport | Use it for | Guidance |
|---|---|---|
| Streamable HTTP | New remote servers | The standard remote transport. Expose a stable HTTPS endpoint such as /mcp; start stateless unless your application has a documented need for sessions. |
| stdio | Local, same-machine integrations | The client launches the server process directly. It is not an Internet endpoint. |
| SSE | Existing deployments during migration | Legacy remote transport. It is deprecated for new servers, so plan a staged move to Streamable HTTP. |
Stateless operation lets any healthy instance handle a request and simplifies autoscaling and failover. Stateful sessions can be justified by long-running workflows, server-side conversation state, pushed requests, replay, or streams, but they require session affinity or shared state and a migration plan.
Build a focused server
Define tools around outcomes
- Give each tool one clear job, such as
lookup_invoiceorcreate_ticket, rather than mirroring dozens of low-level endpoints. - Use least-privilege scopes. A read-only tool should not inherit write permissions.
- Validate identifiers, ranges, URLs, and enum values before calling downstream systems.
- Return structured, bounded results. Avoid dumping entire database rows or unbounded API responses into a model context.
- Log tool name, caller, authorization decision, latency, and outcome without recording secrets or unnecessary personal data.
Cloudflare Workers starter
Cloudflare’s current quick-deploy path uses a stateless createMcpHandler. The older McpAgent quick-deploy path is marked deprecated for new projects. Package names and SDK signatures can change, so pin versions and verify the current Cloudflare and MCP SDK documentation when creating the project.
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { z } from 'zod';
import { createMcpHandler } from 'agents/mcp';
const server = new McpServer({
name: 'support-tools',
version: '1.0.0'
});
server.tool(
'lookup_ticket',
'Find a support ticket by its public identifier.',
{ ticket_id: z.string().min(1).max(64) },
async ({ ticket_id }) => {
// Replace this with an authenticated, bounded data lookup.
return {
content: [{ type: 'text', text: JSON.stringify({ ticket_id, status: 'example' }) }]
};
}
);
export default createMcpHandler(server);The handler maps the worker to the MCP protocol. Configure routing so the public endpoint is /mcp; do not publish an unrelated health page at that path. Keep downstream credentials in encrypted environment bindings, never in source control.
Run locally before publishing
- Create the worker project and install the MCP SDK and the Cloudflare MCP integration used by your chosen template.
- Start the local worker with Wrangler (the documented example listens on
http://localhost:8788). - Use MCP Inspector to connect to
http://localhost:8788/mcp. Inspect the tool list, schemas, authorization behavior, and representative invocations. - Exercise invalid parameters, denied scopes, downstream timeouts, and oversized responses before deployment.
Opening /mcp in a normal browser does not test MCP. A browser tab is not an MCP client and will not perform the protocol handshake or tool discovery.
Deploy the endpoint
Cloudflare Workers
- Store configuration and secrets in the worker’s environment, and keep the handler stateless unless sessions are required.
- Run the documented deployment command:
npx wrangler@latest deploy- Record the resulting HTTPS URL, for example
https://your-worker.workers.dev/mcp. - Connect that URL in MCP Inspector and invoke every production tool with a least-privilege test identity.
- If your repository is connected to the deployment service, enable deployment on reviewed pushes or merges rather than editing production manually.
AWS and other HTTP hosts
AWS guidance treats remote hosting as a way to centralize authentication, authorization, versioning, and updates. You can run the MCP service behind an HTTPS load balancer or API gateway, then route /mcp to the service. A gateway is useful when several agents or servers need one controlled entry point: it can centralize authentication, authorization, routing, protocol translation, and dynamic tool availability.
Rank #2
Add authentication and authorization before going live
Do not expose account data, destructive actions, or write tools on an unauthenticated endpoint. Authorization should include user consent, scopes mapped to individual tools, and a permission check on every call—not only at connection time.
OAuth discovery sequence
- Require authentication and return
401 Unauthorizedwhen no valid token is supplied. - Include a
WWW-Authenticateheader that points to aresource_metadataURL. Clients such as Amazon Quick can discover authorization metadata from that URL. - If that header-based route is unavailable, publish the applicable well-known metadata URI supported by your authorization server.
- Let clients use Dynamic Client Registration when your provider offers it; otherwise provide client credentials through the client’s configuration process.
- Use PKCE for public clients that cannot safely hold a client secret. Keep confidential-client secrets only on a trusted backend.
- After login and consent, validate issuer, audience, signature, expiry, and scopes for every request. Map each scope to the smallest set of tools needed.
Cloudflare documents OAuth 2.1-based authorization, Cloudflare Access, and integrations with providers including Stytch, Auth0, WorkOS, and Descope. Choose one authority for token issuance and document which tenant, user, and tool each scope permits.
Choose a hosting architecture
| Architecture | When it fits | Questions to answer |
|---|---|---|
| Cloudflare Workers | Stateless edge deployment with a documented createMcpHandler and Wrangler workflow. |
Where will secrets live? Which OAuth or Access integration will enforce scopes? Do downstream systems allow edge egress? |
| AWS remote hosting | Teams already operating AWS networking, gateways, identity, and release pipelines. | Which gateway owns authentication and routing? How are versions promoted and rolled back? |
| Private VPC service | Enterprise data must remain on private networks. | Does the client have an active VPC connection with network access? Can OAuth metadata be reached through the configured authentication-server VPC connection? |
| Gateway in front of multiple servers | Organizations needing one endpoint, centralized policy, or dynamic server and tool discovery. | How are tenant isolation, per-tool authorization, protocol translation, and audit logs enforced? |
Compare candidates on transport compatibility, state handling, private-network reachability, tenant isolation, observability, deployment automation, version control, and cost. A managed edge is not automatically suitable for a private database, and a private VPC is not automatically reachable by a public SaaS client.
Test a deployed remote endpoint
Use MCP Inspector
- Start MCP Inspector and enter the complete HTTPS URL, including
/mcp. - Complete the OAuth flow if the endpoint requires it; verify that the consent screen names the scopes and tools being granted.
- Confirm that tool discovery returns only tools intended for that identity.
- Invoke a read-only tool, then test a denied write or elevated-scope operation with the same identity.
- Repeat from a clean session to verify token expiry, reauthorization, and tenant isolation.
Clients without native remote transport
Use the documented mcp-remote local proxy when a desktop client expects a local process. A Claude Desktop-style configuration points the proxy at the deployed URL:
{
"mcpServers": {
"remote-support": {
"command": "npx",
"args": ["mcp-remote", "https://your-worker.workers.dev/mcp"]
}
}
}The proxy adapts the local client connection; it does not remove the need for HTTPS, OAuth, scopes, or server-side authorization.
Migrate an existing SSE or stateful server
Do not switch transports blindly if clients depend on session state, pushed requests, streams, or replay. Run a stateless Streamable HTTP lane alongside the legacy lane, route a controlled set of clients to it, compare authorization and tool behavior, then retire SSE after clients have migrated. Preserve the old endpoint long enough to honor active sessions and communicate its retirement date.
Production checklist
- Endpoint: HTTPS is mandatory; use a stable versioned route if you need incompatible protocol or tool changes.
- Authorization: Every call checks token validity, tenant, user, tool scope, and resource ownership.
- Isolation: Never trust a model-supplied tenant or account identifier without deriving or checking it from the authenticated principal.
- Reliability: Set downstream timeouts, bounded retries, circuit breaking, and idempotency keys for write operations.
- Observability: Track request IDs, tool latency, status, authorization failures, downstream errors, and rate limits while redacting tokens and sensitive payloads.
- Capacity: Keep responses bounded, enforce request-size limits, and verify that autoscaling does not rely on in-memory session state.
- Change control: Version tool schemas, run evaluation tests after description changes, and deploy through reviewable commits.
Troubleshooting
Inspector cannot connect
Check that the URL includes /mcp, DNS resolves publicly or through the required private connection, and the TLS certificate is valid. A browser page loading at that URL is not proof that MCP works; use Inspector or an MCP-capable client.
The client receives repeated 401 responses
Inspect the WWW-Authenticate header and its resource_metadata URL. Verify issuer, audience, redirect URI, clock skew, and requested scopes. If Dynamic Client Registration is not enabled, configure the client credentials manually.
Tools are visible but calls are denied
Discovery and invocation may use different scopes. Map the required scope to the specific tool, verify consent, and enforce the same check inside the handler. Do not solve a scope mismatch by granting a broad administrator token.
Requests fail only in a private deployment
Confirm the active VPC connection has routes, security-group or firewall permissions, DNS resolution, and access to the authorization server’s metadata endpoint. A public OAuth URL may be unreachable from an isolated network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Sessions break after scaling
The service is probably storing state in one instance. Convert the flow to stateless Streamable HTTP, or move required session data to a shared durable store and configure explicit affinity. During migration, keep separate legacy and stateless lanes.
Large or slow tool results time out
Paginate downstream queries, cap result size, set explicit timeouts, and return a continuation token or summary. Instrument each downstream call so you can distinguish model latency from network or dependency latency.
Or skip the browser setup
If your immediate need is a clean visual capture of a remote page or endpoint, ScreenshotNeo provides a one-request website screenshot API and MCP server. Before capture it accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each cleanup step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf for Claude, Cursor, and other MCP clients.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for the full option set, including full-page and element capture, device presets, custom CSS and JavaScript, waits, headers, cookies, geolocation, PDF output, caching, signed links, asynchronous webhooks, bulk capture, and the usage API.
Recommended Free Tools
import requests
r = requests.get(
'https://api.screenshotneo.com/v1/shot',
params={'access_key': 'YOUR_API_KEY', 'url': 'https://stripe.com'},
timeout=90
)
r.raise_for_status()
open('shot.webp', 'wb').write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
require('fs').writeFileSync('shot.webp', Buffer.from(await res.arrayBuffer()));ScreenshotNeo includes 1,000 screenshots per month free with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account to get an API key.
Frequently Asked Questions
Do I need a gateway if I run only one MCP server?
No. A single service can expose its own HTTPS endpoint and enforce OAuth directly. Add a gateway when centralized routing, policy, protocol translation, or multi-server discovery justifies another layer.
Can a public MCP client reach a private VPC server?
Only when the client or its hosting service has an active VPC connection with network access to the server. Verify routes, firewall rules, DNS, and the path to OAuth metadata.
When is stateful MCP worth the operational cost?
Use state only for documented requirements such as long-running workflows, pushed requests, streams, replay, or conversation state. Otherwise stateless Streamable HTTP avoids session affinity and shared-state failure modes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
