MCP infrastructure
MCP Server Hosting: Best Platforms for Secure Remote MCP
Remote MCP servers are now much closer to ordinary HTTP services than earlier stateful deployments. That makes VPS, container, serverless, and managed application infrastructure viable choices, but authentication, authorization, tool exposure, logging, and network boundaries remain critical.
Remote MCP Server Architecture
The current MCP specification uses a stateless protocol core for remote operation. Requests can be routed across normal HTTP infrastructure without requiring sticky sessions, while method and tool information can be surfaced through request headers for gateways and policy layers.
MCP Server Hosting Options: VPS, Containers, Serverless, and PaaS
| Deployment | Good fit | Main tradeoff |
|---|---|---|
| VPS / VM | Maximum infrastructure control | You operate the host |
| Containers | Repeatable deployments and scaling | Host and container boundaries still need hardening |
| Serverless / edge | Stateless request-driven MCP workloads | Runtime and execution constraints vary |
| Managed application platform | Lower operational burden | Less low-level control |
Remote MCP Server Security Requirements
- Authenticate clients before granting access to protected tools.
- Authorize operations using the narrowest useful scopes.
- Separate public transport access from sensitive backend credentials.
- Rate-limit high-impact or expensive tools.
- Record tool calls and failures for audit and incident review.
- Do not expose administrative or destructive tools unnecessarily.
MCP Server Observability and Distributed Tracing
The current MCP specification supports trace-context propagation so an MCP tool call can participate in a broader distributed trace across the agent, gateway, MCP server, and downstream services.
Sources
- MCP 2026-07-28 specification release— Current MCP authorization, transport and protocol changes
- MCP 2026-07-28 release candidate — tracing— W3C Trace Context propagation across hosts, SDKs, servers and downstream services
- MCP TypeScript SDK v2— Stable SDK line implementing the 2026-07-28 specification