# What is an MCP server?

An MCP server is a program that offers tools, data and prompts to AI
applications over the Model Context Protocol. It runs locally or over HTTP.

**A Runtime sandbox can host your own MCP server for your agent, at a private
HTTPS address.** Start the server as a process inside a Firecracker microVM and
share its port with a preview. The sandbox's network rules apply to it
([MCP servers in a sandbox](/docs/javascript#mcp-servers-in-a-sandbox)).

## What a server does

The protocol's documentation describes MCP servers as "programs that expose
specific capabilities to AI applications through standardized protocol
interfaces". A server offers three kinds of building block. A different party
controls each kind:

| Building block | What it is                                           | Controlled by   |
| -------------- | ---------------------------------------------------- | --------------- |
| Tools          | Functions the model decides to call, such as a query | The model       |
| Resources      | Read-only data for context, such as a file or schema | The application |
| Prompts        | Templates a person invokes, such as a slash command  | The user        |

The client inside an AI application lists a server's tools with `tools/list`.
It runs one tool with `tools/call`. The protocol itself is covered in
[what is the Model Context Protocol](/glossary/model-context-protocol). This
page covers the server end.

## How clients connect: stdio or HTTP

| Question              | stdio                                          | Streamable HTTP                                               |
| --------------------- | ---------------------------------------------- | ------------------------------------------------------------- |
| Who starts the server | The client, as a subprocess                    | It runs on its own and serves many clients                    |
| Wire                  | Newline-delimited JSON-RPC on stdin and stdout | Each message is an HTTP POST to one MCP endpoint              |
| Logs                  | The server may write them to stderr            | Ordinary server logs                                          |
| Replies               | One line each on stdout                        | A JSON object or a request-scoped SSE stream                  |
| Where it runs         | The same machine as the client                 | Anywhere with an address, such as `https://host/mcp`          |
| Security duties       | Those of a local process                       | Validate `Origin`, bind to localhost when local, authenticate |

The stdio rules say a server "MUST NOT write anything to its stdout that is not a
valid MCP message". A stray `print` breaks a stdio server for this reason. A
stdio server runs with its user's permissions on the user's own machine. An
untrusted stdio server is therefore a program that you agreed to run locally.

## Host one in a sandbox

Running a server in a sandbox puts it on a machine that you do not own. Your
agent reaches it over HTTP. The server must serve MCP over Streamable HTTP:

```ts
import { Runtime } from "withruntime";

const runtime = new Runtime();
await using sbx = await runtime.sandboxes.create();
await sbx.spawn("python3 /workspace/server.py --port 8000");
const preview = await sbx.previews.create(8000);
console.log(preview.url, preview.token); // send the token as x-runtime-preview-token
```

- The preview is private. Every request needs its token.
- The server can use a Runtime secret. It sees a placeholder. The host's proxy
  adds the value only on HTTPS requests to that secret's hosts
  ([secrets](/docs/security#secrets-sandboxes-never-see)).
- The server runs as the sandbox's user, under its network rules. You can
  restrict a server that should reach only one API to that API.

Runtime is also an MCP server. `npx -y withruntime mcp` is a stdio bridge to the
remote endpoint `https://api.withruntime.com/mcp`
([MCP](/docs/mcp)).

## Related

- [What is the Model Context Protocol?](/glossary/model-context-protocol)
- [Claude Code](/integrations/claude-code)
- [What is egress control?](/glossary/egress-control)
- [MCP: remote connection](/docs/mcp#remote-connection)

## Sources

Checked 25 October 2026.

- [Understanding MCP servers](https://modelcontextprotocol.io/docs/learn/server-concepts)
- [MCP transports](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports)
- [stdio transport](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/stdio)
- [Streamable HTTP transport](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http)

Facts on this page were checked on 25 October 2026.