mcp-server-hosting

mcp-server-hosting is a skill for Claude Code, Codex from ihatesea69/kiro-kit. It costs 71 tokens per session (1,379 once invoked), scanned A, original, MIT.

A guide to running a remote MCP server on AWS. An MCP server makes tools available to agents, while remote hosting lets agents connect to it over the network with user authentication.

In plain words
What is it for?
Use it to host MCP servers with AWS Lambda, ECS/Fargate, or AgentCore Runtime, expose them over streamable HTTP, and configure OAuth with Cognito, Okta, or Auth0.
Why use it?
It addresses the deployment, transport, and login concerns that arise when moving an MCP server from a local process to a shared service.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to host MCP servers with AWS Lambda, ECS/Fargate, or AgentCore Runtime, expose them over streamable HTTP, and configure OAuth with Cognito, Okta, or Auth0.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/ihatesea69/kiro-kit/mcp-server-hosting
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add ihatesea69/kiro-kit --skill mcp-server-hosting
Clone the repo
git clone --depth 1 https://github.com/ihatesea69/kiro-kit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for mcp-server-hosting

README.md
[![agentmods](https://agentmods.dev/badge/skills/ihatesea69/kiro-kit/mcp-server-hosting/github.svg)](https://agentmods.dev/skills/ihatesea69/kiro-kit/mcp-server-hosting)
Your own site
<a href="https://agentmods.dev/skills/ihatesea69/kiro-kit/mcp-server-hosting"><img src="https://agentmods.dev/badge/skills/ihatesea69/kiro-kit/mcp-server-hosting/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for mcp-server-hosting

Your own site · 80×15
<a href="https://agentmods.dev/skills/ihatesea69/kiro-kit/mcp-server-hosting"><img src="https://agentmods.dev/badge/skills/ihatesea69/kiro-kit/mcp-server-hosting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 71 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,379 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 122
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00071 $0.01379
Opus 5 $0.00036 $0.00690
Sonnet 5 $0.00014 $0.00276
Haiku 4.5 $0.00007 $0.00138

Measured 6d ago against content hash e723a1a92d8e, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

mcp-server-hosting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

presets/ai-engineer/skills/mcp-server-hosting/SKILL.md · 139 lines

How it starts

The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.

MCP Server Hosting on AWS

Activate this skill when an MCP server must be reachable by remote agents. For authoring server logic and tool design see mcp-builder; this skill is about where it runs and how it is protected.

When to Use

  • Promoting a local stdio MCP server to a remote, multi-tenant service
  • Choosing between Lambda, Fargate/ECS, and AgentCore Runtime
  • Adding OAuth to an MCP server
  • Debugging the 401 / token / retry handshake

Transport

Local, co-located servers use stdio. Remote servers use streamable-HTTP.

from mcp.server.fastmcp import FastMCP

mcp = FastMCP(host="0.0.0.0", stateless_http=True)

@mcp.tool()
def search_docs(query: str, limit: int = 5) -> list[dict]:
    """Search internal documentation. Returns title, url, and snippet per hit.
    Do not use for customer records — see lookup_customer."""
    ...

mcp.run(transport="streamable-http")

Client side:

from mcp.client.streamable_http import streamablehttp_client
from mcp import ClientSession

async with streamablehttp_client(url, headers=auth_headers) as (read, write, _):
    async with ClientSession(read, write) as session:
        await session.initialize()
        result = await session.call_tool("search_docs", {"query": "refund policy"})

stateless_http=True matters on Lambda: with per-request containers there is no reliable place to hold session state between invocations.

Choosing a Host

Host Good for Watch out for
AgentCore Gateway The tools are already Lambdas or REST APIs — no server to write at all See agentcore-gateway-mcp; adopt its auth and listing semantics
AgentCore Runtime A container you own, agent-adjacent Must serve at 0.0.0.0:8000/mcp, streamable-HTTP
Lambda + Function URL Small, spiky, self-contained servers Cold starts on a chatty tool loop; response streaming limits; 15-minute ceiling
Fargate / ECS Long-lived, heavy dependencies, steady traffic You own scaling, patching, and the load balancer — and an ALB rules out Gateway SigV4 outbound auth

Read the full file on GitHub · 139 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 139 lines · 71 tokens per session scan A e723a1a92d8e

Subscribe to this mod's changes

mcp-server-hosting is a skill published in the GitHub repository ihatesea69/kiro-kit (18 stars, last pushed 21d ago), licensed MIT. It adds 71 tokens to every session and 1,379 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

awesome-azd-template-submit

Submit an azd template to the awesome-azd gallery. Use when asked to submit, add, or contribute a template to awesome-azd. Requires only a GitHub repository URL — all metadata (title, description, languages, frameworks, Azure services, IaC) is auto-detected by the submission pipeline.

Azure/awesome-azd · 72 tokens

expo-dev-client

Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.

fatihkan/badi · 68 tokens

expo-eas-build

A guide to profile discipline, credentials management, and the build process for EAS Build. Scoped to eas.json configuration, iOS provisioning + push cert, Android keystore + service account, secrets, and monorepo support. Store-submit DETAIL lives in expo-eas-submit.

fatihkan/badi · 75 tokens

expo-eas-update

Publishing OTA updates with EAS Update, channels, runtime versions, branch management, and rollback strategy. Triggers on eas update, ota, over-the-air, runtime version, channel, branch, rollback, embedded update, asset selection, expo-updates, hot update, partial release, release cohort.

fatihkan/badi · 65 tokens

lizard-core

Core Lizard CLI usage guide. Read this before running any lizard commands. Covers the full app lifecycle (login, init, link, add, up, redeploy, logs, events, status, scale, restart, secrets, domains, run, ssh, metrics), the workspace → project → service model, managed addons (postgres, redis, s3 with auto-public…

lizard-build/lizard-cli · 248 tokens

setup-deploy

Configure deployment settings for /land-and-deploy. Detects your deploy platform (Fly.io, Render, Vercel, Netlify, Heroku, GitHub Actions, custom), production URL, health check endpoints, and deploy status commands. Writes the configuration to CLAUDE.md so all future deploys are automatic.

timurgaleev/vibestack · 69 tokens