Skip to main content

​
Transports & auth

Every MCPCloud server ships with multiple transports and built-in authentication, so the same deployment works across modern and legacy clients and across cloud and local development.

​
Transports

Streamable HTTP

The default transport for remote clients. Use this for Cursor, VS Code, ChatGPT connectors, and most hosted agents.

SSE

Server-Sent Events for legacy clients that don’t yet speak Streamable HTTP.

stdio

A stdio adapter for local development and clients that launch a local process (for example, Claude Desktop via a bridge).
When in doubt, start with Streamable HTTP — it is the default and the most broadly supported. Fall back to SSE only for clients that require it, and use stdio for local/offline development.

​
Authentication methods

Auth is built into the platform. Secrets are encrypted and injected at runtime, never written into generated source.

​
Local development

mcp dev mirrors the deployed worker locally, hot-reloads on spec changes, and auto-wires popular coding agents (Claude Code, Cursor, Codex, VS Code Copilot, Continue):

​
Security on every build

Before any deployment goes live, MCPCloud runs static analysis:
  • ESLint security rules flag unsafe patterns.
  • Semgrep scans the generated server.
  • No eval() and no dynamic imports are allowed in generated output.
This means the server an agent connects to has been linted and scanned every single build — not just at authoring time. For who can reach a deployment once it’s live, see runtime access. To connect specific clients, see the Clients guides.