What is an MCP server?
An MCP server is a program that offers tools, data and prompts to AI applications over the Model Context Protocol, locally or over HTTP.
A Runtime sandbox can host MCP servers for your agent, each at its own private HTTPS address, and the servers never hold your real API keys. One call starts GitHub, Postgres, a Playwright browser or your own server inside a Firecracker microVM, behind the sandbox's network rules (MCP servers in a sandbox).
What a server does
The protocol's documentation describes MCP servers as "programs that expose specific capabilities to AI applications through standardized protocol interfaces". A server offers three kinds of thing, and each has a different party in charge:
| Building block | What it is | Controlled by |
|---|---|---|
| Tools | Functions the model decides to call, such as a query | The model |
| Resources | Read-only data for context, such as a file or schema | The application |
| Prompts | Templates a person invokes, such as a slash command | The user |
The client inside an AI application lists a server's tools with tools/list
and runs one with tools/call. The protocol itself is covered in
what is the Model Context Protocol; this
page is about the server end.
How clients connect: stdio or HTTP
| Question | stdio | Streamable HTTP |
|---|---|---|
| Who starts the server | The client, as a subprocess | It runs on its own and serves many clients |
| Wire | Newline-delimited JSON-RPC on stdin and stdout | Each message is an HTTP POST to one MCP endpoint |
| Logs | The server may write them to stderr | Ordinary server logs |
| Replies | One line each on stdout | A JSON object or a request-scoped SSE stream |
| Where it runs | The same machine as the client | Anywhere with an address, such as https://host/mcp |
| Security duties | Those of a local process | Validate Origin, bind to localhost when local, authenticate |
The stdio rules say a server "MUST NOT write anything to its stdout that is
not a valid MCP message", which is why a stray print breaks one. A stdio
server runs with its user's permissions on the user's own machine, so an
untrusted one is a program you have agreed to run locally.
Host one in a sandbox
Putting a server in a sandbox turns a local stdio program into a remote one your agent reaches over HTTP, on a machine that is not yours:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();await using sbx = await runtime.sandboxes.create();await sbx.files.write("/workspace/server.py", "# your MCP server, speaking stdio\n");await sbx.mcp.start([ { id: "fetch" }, { name: "mine", command: ["python3", "/workspace/server.py"] },]);const gateway = await sbx.mcp.ready();for (const server of gateway.servers) console.log(server.name, server.url);- Each server gets its own Streamable HTTP URL through a private preview link, and every request also needs the gateway's bearer token.
- A secret setting names a Runtime secret: the server sees a placeholder, and the host's proxy adds the value only on HTTPS requests to that secret's hosts (secrets).
- The servers run as the sandbox's user under its network rules, so a server that should reach only one API can be held to it.
runtime.mcp.catalog()lists the ready-made servers with their licences, pinned versions and the hosts they call.
Runtime is also an MCP server itself: npx -y withruntime mcp is a stdio
bridge to the remote endpoint https://api.withruntime.com/mcp
(MCP).
Related
Sources
Checked 25 September 2026.
Facts on this page were checked on 25 September 2026.