# What is an MCP server?

An MCP server is a program that offers tools, data and prompts to AI applications over the Model Context Protocol, locally or over HTTP.

**A Runtime sandbox can host MCP servers for your agent, each at its own
private HTTPS address, and the servers never hold your real API keys.** One
call starts GitHub, Postgres, a Playwright browser or your own server inside a
Firecracker microVM, behind the sandbox's network rules
([MCP servers in a sandbox](/docs/javascript#mcp-servers-in-a-sandbox)).

## What a server does

The protocol's documentation describes MCP servers as "programs that expose
specific capabilities to AI applications through standardized protocol
interfaces". A server offers three kinds of thing, and each has a different
party in charge:

| Building block | What it is                                           | Controlled by   |
| -------------- | ---------------------------------------------------- | --------------- |
| Tools          | Functions the model decides to call, such as a query | The model       |
| Resources      | Read-only data for context, such as a file or schema | The application |
| Prompts        | Templates a person invokes, such as a slash command  | The user        |

The client inside an AI application lists a server's tools with `tools/list`
and runs one with `tools/call`. The protocol itself is covered in
[what is the Model Context Protocol](/glossary/model-context-protocol); this
page is about the server end.

## How clients connect: stdio or HTTP

| Question              | stdio                                          | Streamable HTTP                                               |
| --------------------- | ---------------------------------------------- | ------------------------------------------------------------- |
| Who starts the server | The client, as a subprocess                    | It runs on its own and serves many clients                    |
| Wire                  | Newline-delimited JSON-RPC on stdin and stdout | Each message is an HTTP POST to one MCP endpoint              |
| Logs                  | The server may write them to stderr            | Ordinary server logs                                          |
| Replies               | One line each on stdout                        | A JSON object or a request-scoped SSE stream                  |
| Where it runs         | The same machine as the client                 | Anywhere with an address, such as `https://host/mcp`          |
| Security duties       | Those of a local process                       | Validate `Origin`, bind to localhost when local, authenticate |

The stdio rules say a server "MUST NOT write anything to its stdout that is
not a valid MCP message", which is why a stray `print` breaks one. A stdio
server runs with its user's permissions on the user's own machine, so an
untrusted one is a program you have agreed to run locally.

## Host one in a sandbox

Putting a server in a sandbox turns a local stdio program into a remote one
your agent reaches over HTTP, on a machine that is not yours:

```ts check
import { Runtime } from "withruntime";

const runtime = new Runtime();
await using sbx = await runtime.sandboxes.create();
await sbx.files.write("/workspace/server.py", "# your MCP server, speaking stdio\n");
await sbx.mcp.start([
  { id: "fetch" },
  { name: "mine", command: ["python3", "/workspace/server.py"] },
]);
const gateway = await sbx.mcp.ready();
for (const server of gateway.servers) console.log(server.name, server.url);
```

- Each server gets its own Streamable HTTP URL through a private preview link,
  and every request also needs the gateway's bearer token.
- A secret setting names a Runtime secret: the server sees a placeholder, and
  the host's proxy adds the value only on HTTPS requests to that secret's hosts
  ([secrets](/docs/security#secrets-sandboxes-never-see)).
- The servers run as the sandbox's user under its network rules, so a server
  that should reach only one API can be held to it.
- `runtime.mcp.catalog()` lists the ready-made servers with their licences,
  pinned versions and the hosts they call.

Runtime is also an MCP server itself: `npx -y withruntime mcp` is a stdio
bridge to the remote endpoint `https://api.withruntime.com/mcp`
([MCP](/docs/mcp)).

## Related

- [What is the Model Context Protocol?](/glossary/model-context-protocol)
- [Claude Code](/integrations/claude-code)
- [What is egress control?](/glossary/egress-control)
- [MCP: remote connection](/docs/mcp#remote-connection)

## Sources

Checked 25 September 2026.

- [Understanding MCP servers](https://modelcontextprotocol.io/docs/learn/server-concepts)
- [MCP transports](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports)
- [stdio transport](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/stdio)
- [Streamable HTTP transport](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http)

Facts on this page were checked on 25 September 2026.