Hosting and Deploying MCP Servers in Production

Hosting and deploying MCP servers in production means making deliberate choices about transport, state, authorization, and scaling, with the July 2026 stateless core removing much of the old infrastructure burden. For MCP server access to AI agent web data, Olostep offers search, scraping, crawling, and monitoring tools that return clean Markdown or JSON without agents managing browsers or scrapers. Reliable deployment puts those capabilities behind governed, OAuth-protected access rather than treating local success as production readiness.

Why running MCP in production is a different problem than running it locally

A local server that works can give false confidence because the local setup quietly does much of the work. One client spawns one stdio process, with no network and no OAuth flow required. That arrangement is simple because its boundaries are narrow. Moving it onto a network removes those boundaries. The demo has not passed a production test. It has politely avoided one.

The first break is usually the assumption that switching from stdio to HTTP is a configuration change. It changes session management, error handling, and progress reporting, while introducing concurrent clients and a network attack surface. MCP’s move to the Linux Foundation’s Agentic AI Foundation in December 2025 makes this gap more consequential. Infrastructure shared across vendors needs a way to run beyond a developer’s desktop.

What the July 2026 spec change actually means for infrastructure decisions

The July 28, 2026 MCP specification removed the session handshake and Mcp-Session-Id header, making the protocol core fully stateless. Any server instance can answer any request, so sticky-session routing is no longer required. Shared session stores and affinity rules built solely for the old protocol now solve a problem the protocol has removed.

The revision deprecated HTTP+SSE, leaving Streamable HTTP as the sole non-deprecated remote transport. It also added Multi Round-Trip Requests, header-based routing, cacheable list results, authorization hardening, and a formal extensions framework. Cloudflare illustrates the practical result with MCP servers running in a single Worker without stateful infrastructure. The official roadmap published August 22, 2026 goes further, naming a single Streamable HTTP binding, including over stdin/stdout locally, as a transport goal. New network-bound deployments should therefore start with Streamable HTTP rather than plan a later migration from stdio, which will not gain enterprise features.

Choosing transport and deployment model before writing any infrastructure code

Transport comes first because it constrains what follows. Stdio works for a developer tool used by one person, with no network attack surface and no need for OAuth. Streamable HTTP fits concurrent connections, network deployment, and container orchestration. Remote deployment has become the enterprise default because centralized servers are easier to govern, scale, and audit than installations scattered across desktops.

From there, match the deployment model to the boundary the workload needs. On-premises deployment works for regulated or air-gapped environments where data must stay inside the network. Managed cloud works for teams that need elastic scale and fast provisioning, while a private cloud network adds network isolation for sensitive workloads that need source-level governance. Hybrid deployment puts the control plane in the cloud and the data plane locally for mixed cloud and legacy estates. Edge deployment, including Cloudflare Workers, works for stateless TypeScript or Node.js HTTP servers that gain from global routing and near-zero cold starts, though Python makes the runtime more complex.

Risk should settle the decision before infrastructure is provisioned. A read-only CRM agent has different exposure from an agent allowed to write to an ERP system. Centralized HTTP deployment also works when many agents in different places need to retrieve data from the same external sources. For example, an MCP server can orchestrate Olostep’s batch processing and webhook-based updates without making every client operate crawling infrastructure independently.

Containerizing MCP workloads and the platform options for running them

For container-based deployment, package the workload before pushing it to a platform. Docker gives reproducible builds and consistent dependency resolution, with docker run providing a local deployment test before cloud introduces more variables. Use --rm for local runs and let the cloud platform manage lifecycle in production. Otherwise, local tests can end up with a small retirement village of zombie containers. Packaging removes environment drift, but it does not remove platform trade-offs.

AWS offers distinct paths for different needs. Lambda supports stateless HTTP MCP servers through API Gateway, but cold starts can cause connection issues. ECS/Fargate is the recommended AWS pattern for most teams, while Amazon Bedrock AgentCore handles scaling and session isolation across MCP servers and broader agent workloads, with both stateless and stateful protocol support. Azure Functions supports Streamable HTTP and built-in OAuth integration with Entra ID, reducing friction for teams already using Microsoft identity. Cloudflare Workers works well for TypeScript and Node.js at the edge, but Python FastMCP needs Workers Containers in place of the standard V8 isolate.

Vercel offers an opinionated path with built-in OAuth and automatic scaling for lightweight servers serving a single application. Its limited networking and cold-start controls make it less suited to high-traffic, multi-tenant deployments. A self-hosted VPS from Hetzner or DigitalOcean offers no cold starts, transport restrictions, or vendor lock-in, and can run the same container used locally. In return, the team takes care of uptime, scaling, and security.

Scaling stateless MCP servers without the infrastructure weight of the pre-2026 pattern

For teams already using Kubernetes, the post-July 2026 pattern is a Deployment, Service, and HPA, with Mcp-Method routing at the gateway. A plain round-robin load balancer is sufficient because requests do not need to return to a particular instance. There is no protocol-driven need for a session store, affinity rules, or pinning logic.

That does not make Kubernetes mandatory. A monolithic server serving fewer than five tools to one internal team is easier to understand through one process, one set of logs, and one rollback. Splitting by capability buys failure isolation and independent scaling when tool domains have genuinely different load profiles and on-call teams. It also multiplies authorization configuration, observability plumbing, and deployments.

Compute is only one scaling limit because tool schemas also occupy agent context windows. Their cost compounds as agents connect to more servers, so server count alone is a poor measure of efficiency. Runtime behavior matters too. Cold starts in Lambda and Cloud Run can cause trouble for clients that expect persistent or low-latency responses, but ECS/Fargate and always-on Workers avoid those problems.

Auth is not optional: implementing OAuth 2.1 correctly from day one

Remote scaling increases the reach of a server, which makes authorization a design requirement. The MCP specification has mandated OAuth 2.1 for remote HTTP servers since 2025, with further hardening in the July 2026 revision. Skipping it leaves an implementation out of spec. More importantly, it postpones decisions about identity and access until other architectural choices already depend on them.

The MCP server’s role is an OAuth 2.1 resource server. It validates tokens issued by an external authorization server. Each resource server needs protected-resource metadata, a token audience, and configuration for the RFC 8707 resource indicator. Maintaining those separately across many servers is a strong argument for centralizing authorization at a gateway. Splitting a server therefore has an identity cost as well as a compute benefit.

Stripe, Linear, Asana, and Sentry expose remote MCP servers through public OAuth-protected endpoints. Linear and Sentry use Cloudflare, while Stripe and Asana operate independently hosted endpoints.

The security vulnerabilities that production hardening must address before go-live

One MCP-specific attack starts with a malicious server presenting benign tools to earn approval. The server then changes tool definitions or behavior in subsequent sessions, leaving the agent interacting with something different from what was approved. The specification does not fully close this gap. A valid token answers an identity question. It does not certify a tool’s good intentions.

Unauthorized deployments create another threat surface. Shadow servers are outside governance, so a list of the servers an organization knows about gives only part of the picture of its exposure. NSA guidance calls for regular network scans to find insecure or unauthorized MCP servers. Dedicated MCP scanners, gateways, and runtime-monitoring tools are emerging to address these gaps, but they serve different parts of the problem. The governing principle is zero trust, with every request verified against identity and scope and no server treated as authorized before it enters the registry.

Governance, audit logging, and the controls that separate pilots from production deployments

The gap between a pilot and production is often the absence of organizational controls. A server can execute a tool correctly while the organization cannot explain who approved it or what data it touched. Bloomberg’s productionization gap illustrates the before-and-after distinction. Its MCP approach closed that gap by treating toolchains as governed configuration.

The minimum governance layer starts with a registry, where an unlisted server is an incident. Scoped identity must apply to each tool as well as to the server boundary. Immutable audit logs must answer which agent called which tool, with what data, and at what time, in a format the compliance team can use. Write access to CRM, ERP, or Slack also needs human-in-the-loop approval before broad deployment.

A gateway makes these controls practical by centralizing authorization, rate limiting, per-tool ACLs, and observability between clients and servers. Kong’s AI MCP Proxy plugin and Prefect Horizon represent different points on the build-versus-buy spectrum for that layer. The EU AI Act adds compliance weight, with transparency duties from August 2026 and high-risk rules applying from 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for high-risk AI embedded in Annex I regulated products.

How do AI agents get live web data through an MCP server

MCP lets agents invoke search, scraping, and crawling dynamically. The right retrieval path depends on the source, including an existing API, a public page, or a site that needs crawling. Olostep’s MCP server exposes search, scraping, crawling, and monitoring while its underlying infrastructure handles browsers and proxies. It returns clean Markdown or JSON, allowing agents to use live content without owning the retrieval machinery.

The important comparison is structured retrieval versus raw HTTP fetching inside a tool. Passing raw HTML to an LLM spends context on navigation, ads, scripts, and footers as well as useful content. The server should instead return clean Markdown, structured JSON, or extracted schema-level data. If the task needs a price, a small JSON object with the relevant fields is a better payload than a page the agent must excavate. A web data API that produces this output natively also removes tool-side parsing and cleanup.

Monitoring can also track changes in pricing and updates to technical documentation. A monitoring API lets agents react to changes and removes the need for polling. Because Olostep’s API is stateless and returns structured data, the MCP tool calling it needs no session management and fits the post-July 2026 architecture. The retrieval service is part of the production dependency chain.

Operational practices that keep a production MCP deployment healthy over time

Production readiness has to survive the next deployment, new tool, and unauthorized server. Build observability in from the start rather than waiting for an incident to reveal missing evidence. A small monolith benefits from one set of logs and one deployment to roll back. Deployments split by capability need logging, tracing, and alerting that work the same way across instances before anything fails in production. Otherwise, failure isolation can become investigation isolation.

Schedule network scanning for insecure or unauthorized servers in line with NSA/CISA guidance, because shadow servers accumulate as teams move quickly. Audit and trim tool schemas from time to time as tools gain capabilities, so they use less of the context window for every agent that connects.

The lasting payoff comes from Streamable HTTP, OAuth 2.1 from day one, and a gateway with an active roadmap aligned to MCP specification changes. Teams that used the July 2026 shift to remove unnecessary state are better positioned to absorb unified transport and extended enterprise features without rearchitecting.