[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_115":116},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":21,"_24":25,"_26":27,"_28":29,"_30":31,"_32":33,"_34":25,"_35":36,"_37":-5,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_47":46,"_48":49,"_50":51,"_52":53,"_54":-5,"_55":46,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65,"_66":46,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":-5,"_79":-5,"_80":46,"_81":-5,"_82":57,"_83":84,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94},"apiUrl","https://odel.app/api","creator","j0yen","moduleId","mcphost","@j0yen/mcphost","displayName","tagline","Hosted MCP runtime where the agent is the operator: sign up by tool call, publish your own tools.","iconKey","https://avatars.githubusercontent.com/u/178452872?v=4","category","remote","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://mcphost.dev/mcp\",\"transport\":\"streamable-http\",\"authType\":\"none\"}","pricingModel","free","creatorUserId","system:external-import","createdAt",1788769663000,"updatedAt","sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=dev.mcphost%2Fmcphost","sourceVerified",false,"sourceMissingSince","importedAt","upstreamStars",0,"upstreamUpdatedAt",1788766438000,"detectedTransport","streamable-http","detectedAuthType","none","probeStatus","ok","lastProbedAt","githubRepoUrl","https://github.com/j0yen/mcphost","githubRepoFullName","j0yen/mcphost","releaseId","ext-j0yen-mcphost","version","0.14.0","descriptionMarkdown","# mcphost\n\n`mcphost serve` is a streamable-HTTP MCP server, stateless per the 2026-07-28\nspecification, on which an agent signs up with one unauthenticated tool call,\nreceives a tenant key, and then owns a namespace of tools it publishes, lists,\ninspects and removes through further tool calls. There is no web page. The\noperator administers tenants and reads metering through `admin.*` tools on\nthe same endpoint. Tool *execution* kinds (REST wrappers, code) are separate\nPRDs; this one ships the endpoint, tenancy, the control plane, the `Kind`\ntrait, and a built-in `echo` kind so the harness can measure the bootstrap\npath end to end.\n\n> **For agents evaluating this host:** the machine-readable summary lives at [`/llms.txt`](https://mcphost.dev/llms.txt) on the production endpoint. Signup is one unauthenticated tool call; the quickstart there is six steps.\n\nBuilt from `PRD-mcphost-endpoint.md` (vision: `visions/mcp-host.md`).\n\n## Recent\n\n- **v0.11.0** — `host.tool_publish` reports every simultaneously-invalid\n field at once (`data.errors`, each with its own `field`/`expected`/\n `example`) instead of one rejection per attempt; each kind's example\n spec/blurb and the new \"Kinds\" section below both render from\n `docs/kinds/*.md`, checked to match by\n `tests/publishfirsttry_ac06_docs_shared_source.rs`.\n- **v0.4.0** — `args_schema` (and, for `python`, `requirements`) is now\n optional on the `python` and `http` kinds: when absent, the host derives it\n deterministically and offline from the source/templates the tenant already\n wrote (`src/kinds/infer.rs`). An explicit `args_schema` is used unchanged.\n- **v0.1.2** — `synthorg consume --preflight` now has a real integration\n test (AC12); the `Kind` conformance suite moved to\n `tests/ac17_kind_conformance.rs`; `host.registry_publish` + `GET\n /.well-known/mcp//server.json` are implemented behind the\n `--registry-url` flag (AC19, see \"Registry publish (P1)\" below).\n\n## Install\n\n```\ncargo install --path .\n```\n\nOr build locally:\n\n```\ncargo build --release\n./target/release/mcphost serve\n```\n\n### Environment contract\n\n| Variable | Meaning | Default |\n|---|---|---|\n| `MCPHOST_DATA_DIR` | Directory holding `mcphost.db` (SQLite, WAL) | `./data` |\n| `MCPHOST_BIND` | `host:port` to listen on | `127.0.0.1:8080` |\n| `MCPHOST_PUBLIC_URL` | URL returned by `signup` as the endpoint | `http://` |\n| `MCPHOST_ADMIN_KEY` | Bearer key that unlocks `admin.*` tools | unset (admin tools unreachable) |\n| `MCPHOST_SECRET_KEY` | Passphrase, SHA-256-derived into an AES-256 key for tenant secrets | dev default (set a real one in production) |\n| `MCPHOST_LOG_LEVEL` | `tracing` filter, e.g. `info` | `info` |\n| `MCPHOST_REGISTRY_URL` | Enables `host.registry_publish` (P1) and names the registry API's base URL; `mcphost serve --registry-url ` takes precedence | unset (registry-publish disabled) |\n| `MCPHOST_SIGNUP_RATE_LIMIT_PER_HOUR` | Overrides the per-source-IP `signup` rate limit (PRD-mcphost-signup-rate-configurable) — raise it for a many-session measure run from one IP; absent or non-integer falls back to the default. Effective value is logged once at startup | `5` |\n\n`mcphost migrate` applies pending SQL migrations and exits. `mcphost version`\nprints the version and exits. `mcphost serve --registry-url ` is the\nCLI-flag form of `MCPHOST_REGISTRY_URL` above.\n\n### Registry publish (P1)\n\nOff by default. Once `--registry-url` / `$MCPHOST_REGISTRY_URL` names a\nregistry API base (e.g. `https://registry.modelcontextprotocol.io`):\n\n1. The operator verifies a tenant's domain namespace by whatever method\n they trust (the PRD leaves the verification METHOD itself — DNS vs\n HTTP record — as an open question owned by Joe; this crate does not\n implement one) and records the outcome with `admin.tenant_verify_namespace`:\n `admin.tenant_verify_namespace(tenant=\"t_xxxxxxxx\", domain_namespace=\"io.github.example.myserver\")`.\n2. That tenant can then call `host.registry_publish()` (no arguments): it\n POSTs a `server.json` document (`name`/`description`/`version`/`remotes:\n [{type: \"streamable-http\", url}]`) to `/v0/publish`, and\n the same document becomes servable, unauthenticated, at\n `GET /.well-known/mcp//server.json`.\n3. `host.registry_publish` refuses with a distinct, machine-readable error\n in `data.error_code`: `registry_disabled` (flag off),\n `namespace_unverified` (step 1 not done for this tenant), or\n `registry_rejected` (the registry API answered non-2xx).\n\n## Kinds\n\nEvery registered kind's minimal example spec, below, and `host.tool_publish`'s\non-wire description (visible from `tools/list` before signup) are both\nrendered from the same `docs/kinds/*.md` files (PRD-mcphost-publish-first-try\nrequirement 6) -- `tests/publishfirsttry_ac06_docs_shared_source.rs`\nregenerates this section from those files and fails CI if it's drifted from\nwhat's checked in below. Call `host.quickstart(kind)` for the same example\nwith your own namespace already filled in.\n\n\n### `echo`\n\nspec.schema is any JSON Schema; a call echoes back the arguments it was given, validated against it.\n\nExample spec:\n\n```json\n{\n \"schema\": {\n \"properties\": {\n \"msg\": {\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"msg\"\n ],\n \"type\": \"object\"\n }\n}\n```\n\nExample call arguments:\n\n```json\n{\n \"msg\": \"hi\"\n}\n```\n\n### `http`\n\nurl must be an absolute https URL; method and url are the only required fields -- args_schema is inferred from the url/header/body templates when omitted.\n\nExample spec:\n\n```json\n{\n \"method\": \"GET\",\n \"url\": \"https://api.example.com/items/{{id}}\"\n}\n```\n\nExample call arguments:\n\n```json\n{\n \"id\": \"123\"\n}\n```\n\n### `python`\n\nonly source is required -- args_schema and requirements are both inferred from it (tool-infer, v0.4.0); source must define main(args).\n\nExample spec:\n\n```json\n{\n \"source\": \"def main(args):\\n return {\\\"doubled\\\": args[\\\"n\\\"] * 2}\\n\"\n}\n```\n\nExample call arguments:\n\n```json\n{\n \"n\": 3\n}\n```\n\n\n### Python spec-language notes\n\nPRD-mcphost-python-kind-runtime (AC6): the AST-check that gates\n`host.tool_publish` accepts assignment expressions (`:=`, PEP 572) in\ngeneral -- CPython has parsed them since 3.8, and mcphost's publish-time\ncheck and the tool's own runtime both compile `source` with the same\nCPython grammar, so there is no mcphost-added restriction to relax. The\none thing that *is* rejected is a restriction Python's own grammar\nenforces: an assignment expression's target must be a plain name.\n`(obj.attr := 1)` and `(d[key] := 1)` are both invalid Python syntax\n(`cannot use assignment expressions with attribute` / `...with\nsubscript`) and would fail identically whether or not mcphost validated\nthem first -- the tool's own `main(args)` would refuse to even parse.\nBecause this is executor-level, not validator-level, there is nothing for\nmcphost to loosen; the fix here is that the publish-time rejection now\nnames the construct and the accepted alternative in one sentence (assign\nto a plain name first, then set the attribute/subscript in a separate\nstatement) instead of leaving CPython's bare grammar message to speak for\nitself.\n\n## Metered overage (billing emit-meter)\n\nPRD-mcphost-metered-overage: pro tenants' successful calls past the plan's\n50,000 included calls/month bill themselves through Stripe's\n`mcphost_tool_calls` meter and its graduated metered price. Set these\nenv vars from `~/.config/mcphost/stripe-objects.json` (unset means the\nsame v0.14.0 behavior -- no metering, no `meter_lag`):\n\n- `MCPHOST_STRIPE_METERED_PRICE_ID` -- the metered price id `billing.checkout`\n attaches alongside the base price.\n- `MCPHOST_STRIPE_METER_EVENT_NAME` -- defaults to `mcphost_tool_calls`.\n\nThen run `mcphost billing emit-meter` on a timer (every five minutes is the\nshipped default): it reads pro tenants' unemitted `ok` calls, POSTs one\nStripe meter event per tenant (chunked at 100 events/request), ledgers each\nbatch, and advances its own high-water mark only once every event in the\nrun has been accepted -- safe to rerun after a crash or a failed POST (see\n`src/metering.rs`'s doc comment for the replay/idempotency contract).\n\nInstall the shipped systemd **user** units (`~/.config/systemd/user/`,\nmatching this host's other `mcphost-*` units):\n\n```\ncp deploy/mcphost-emit-meter.service deploy/mcphost-emit-meter.timer \\\n ~/.config/systemd/user/\nsystemctl --user daemon-reload\nsystemctl --user enable --now mcphost-emit-meter.timer\n```\n\n`mcphost-emit-meter.service` reads `~/.config/mcphost/emit-meter.env` (via\n`EnvironmentFile=-`, so a missing file is not an error) for\n`MCPHOST_DATA_DIR` / `MCPHOST_STRIPE_SECRET_KEY` / the two vars above.\nBoth unit files pass `systemd-analyze verify --user` (AC9;\n`tests/metering_ac09_deploy_units_verify.rs`).\n\n`/healthz`'s `meter_lag` field (present only when `MCPHOST_STRIPE_METERED_PRICE_ID`\nis set) is the count of pro-tenant `ok` calls still above the high-water\nmark -- watch it for emission health at a glance.\n\n## Acceptance\n\nEvery P0 acceptance criterion is paired with a real `cargo test` (integration\ntests under `tests/` spin up the server on an ephemeral port against a temp\n`$MCPHOST_DATA_DIR`), except AC11 which is hardware-dependent and is\nrecorded as a smoke result below.\n\n### Sandbox suite: user namespace requirement\n\nThe `python` kind's sandbox suites (`tests/sandboxready_*`, `python_ac*`,\n`infer_ac*`, `warmpool_ac*`, `ac17_kind_conformance`) spawn real `bwrap`/\n`unshare` isolation and need unprivileged user namespaces\n(`unshare --user --map-root-user -- true` must succeed) to run for real. If\nyour box denies that (Ubuntu's default AppArmor policy on some kernels, some\ncontainer runtimes), running `cargo test` fails loudly by design outside\nCI, naming the fix: `sysctl kernel.unprivileged_userns_clone=1` on older\nkernels, or `sysctl kernel.apparmor_restrict_unprivileged_userns=0` on\nUbuntu 24.04+. See `sandbox::require_user_namespaces_or_ci_skip`'s doc\ncomment for the full contract, and `.github/workflows/ci.yml` for how the\nhosted CI runner grants the same capability (PRD-mcphost-ci-sandbox-coverage)\ninstead of silently skipping.\n\nCI runs these suites as their own `sandbox` job, in parallel with the `gate`\njob that carries static analysis and everything else — once the suites stopped\nskipping, a single `cargo test --workspace` step measured 313–336 s against a\n300 s budget. Which targets go where is derived, not hand-listed:\n`scripts/ci-test-partition.sh core|sandbox` classifies every `tests/*.rs` by\nwhether it touches the sandbox-execution surface, and `check` proves the split\nis total and disjoint. Both jobs then fail on any capability-skip in their log,\nso a target filed into the wrong half turns CI red rather than passing\nvacuously.\n\n| AC | Requirement | Test |\n|---|---|---|\n| 1 (P0) | Unauthenticated `tools/list` shows only `signup`; response carries `MCP-Protocol-Version` | `tests/ac01_unauthenticated_lists_signup.rs` |\n| 2 (P0) | `signup` returns key/namespace/endpoint; key stored only as a hash | `tests/ac02_signup_creates_hashed_tenant.rs` |\n| 3 (P0) | Tenant `tools/list` shows `host.*` and no other tenant's tools | `tests/ac03_tenant_lists_control_plane_only.rs` |\n| 4 (P0) | Publish, then list, then call round-trips | `tests/ac04_publish_list_and_call.rs` |\n| 5 (P0) | Cross-tenant isolation: B can't see or call A's tool | `tests/ac05_cross_tenant_isolation.rs` |\n| 6 (P0) | Remove a tool: omitted from list, `tool_not_found` on call | `tests/ac06_remove_tool.rs` |\n| 7 (P0) | `host.usage`/`admin.usage` report calls + p50/p95 | `tests/ac07_usage_metering.rs` |\n| 8 (P0) | `admin.tenant_disable` locks out a key; tenant key is `forbidden` on `admin.tenants` | `tests/ac08_admin_disable_and_forbidden.rs` |\n| 9 (P0) | 6th signup/hour/IP is `rate_limited`, no tenant created | `tests/ac09_signup_rate_limit.rs` |\n| 10 (P0) | Unregistered kind / invalid name / oversized spec each fail distinctly, nothing written | `tests/ac10_publish_validation_errors.rs` |\n| 11 (P0, non-functional) | 200 concurrent `echo` calls, p95 < 50ms, 0 errors, RSS < 100MiB | `tests/ac11_load_smoke.rs` (`#[ignore]`d — hardware-dependent; run with `cargo test --release --test ac11_load_smoke -- --ignored --nocapture`). Measured on the build box: **p95 = 34.20ms, 0 errors, RSS = 37.3MiB** |\n| 12 (P0) | `synthorg consume --preflight ` exits 0 | `tests/ac12_preflight.rs` — an always-run in-process half exercises the same two requests `run_preflight` makes; a second half spawns the real `mcphost` binary and the real `synthorg` CLI when available (bare binary or `uv run --project`) and asserts exit 0 |\n| 13 (P0) | Mismatched `Mcp-Name` header vs. body is recorded by body name and flagged | `tests/ac13_mcp_name_mismatch_metering.rs` |\n| 14 (P0) | Unwritable database: `storage` error, `/healthz` `db_ok: false`, process stays up | `tests/ac14_storage_unwritable.rs` |\n| 15 (P0) | A call that never completes times out at the deadline, future dropped | `tests/ac15_call_timeout.rs` |\n| 16 (P0) | 2MiB request body rejected with HTTP 413 | `tests/ac16_request_body_too_large.rs` |\n| 17 (P0) | `Kind` conformance suite passes `echo`, fails naming `describe` for a bad schema | `tests/ac17_kind_conformance.rs` (reusable checker at `mcphost::kinds::conformance`) |\n| 18 (P1) | `tools/list` carries `ttlMs`/`cacheScope`, `ttlMs: 0` within 60s of a publish | `tests/ac18_tools_list_ttl.rs` |\n| 19 (P1) | `host.registry_publish()` + `/.well-known/mcp//server.json` | `tests/ac19_registry_publish.rs` (mocks the registry API with `wiremock`; see \"Registry publish (P1)\" above — the namespace-verification METHOD stays out of scope, \"verified\" is an admin-set boolean) |\n\n## Related fleet work\n\n- [`mcp-core`](https://github.com/j0yen/mcp-core) — the reusable stdio\n JSON-RPC 2.0 MCP-server core (`Tool` trait + `serve_stdio`) other wintermute\n MCP servers build on. Not reused here: `mcphost` is a streamable-HTTP\n server (`rmcp`), not a stdio server, and its tool surface is dynamic\n (per-tenant, DB-backed) rather than the static `Tool` trait `mcp-core`\n wraps. Cited per the PRD's technical considerations as related, not shared,\n code.\n\n## License\n\nDual-licensed under MIT OR Apache-2.0 — see `LICENSE-MIT` and\n`LICENSE-APACHE`.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays","iconType","image","upstream",{"_101":102,"_103":104,"_105":106,"_107":108,"_109":110,"_111":112},"requiredSecrets",[],"tags",[97,98,99,61,100],"assets",[],"stats",{"_95":57,"_96":57},"ratingAvg","reviewCount","agent-tools","ai-agents","rust","tool-runtime","topics",[97,98,113,114,99,61,100],"license","Apache-2.0","language","Rust","registryName","dev.mcphost/mcphost","homepage","https://mcphost.dev","packages",[],"mcp","model-context-protocol","ENV",{"_117":118,"_119":120,"_121":122},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]