NewAgent-ready skill for Claude Code, Cursor and Codex →
AgentsReady
Guides · As of

How to add a remote MCP server to your product

A remote MCP server is an HTTPS endpoint that speaks the Model Context Protocol, so AI agents like Claude, ChatGPT and Cursor can use your product's actions as tools without custom integration code. To make yours easy for agents to use: host it at a predictable URL like mcp.yourdomain.com/mcp over Streamable HTTP, protect it with OAuth, publish the discovery metadata, and let clients register themselves.

From our data: As of 3 Nov 2026, our scan reached a remote MCP server for 90 of the 214 software vendors in our rankings (42%), and 68 of them let clients register themselves over OAuth. In our 1,846-company benchmark (11 Oct 2026), 20% ran one.

Steps

  1. Pick the actions

    Start with the 5 to 15 things users ask for most: search records, create one, update one, run a report. Name tools as verbs and describe each in one plain sentence; agents choose tools from those descriptions.

  2. Host it where agents look

    Serve Streamable HTTP at mcp.yourdomain.com/mcp (or yourdomain.com/mcp). Predictable URLs are what scanners, directories and agents try first.

  3. Answer unauthenticated requests with a pointer

    Return 401 with a WWW-Authenticate header whose resource_metadata points at /.well-known/oauth-protected-resource (RFC 9728). That document names your authorization server.

  4. Publish OAuth server metadata

    Serve /.well-known/oauth-authorization-server (RFC 8414) with your authorize, token and registration endpoints, and support PKCE.

  5. Let clients register themselves

    Support client ID metadata documents, which the 2026-07-28 MCP spec recommends, and keep dynamic client registration (RFC 7591) for older clients. Either way a user can connect any MCP client without you issuing a client ID by hand.

  6. Tell agents it exists

    Link the URL from your docs, your llms.txt and your homepage, publish a server card at your MCP URL plus /server-card, and list it in the MCP registry.

Check it yourself

This is the initialize call from spec versions before 2026-07-28, which most servers still accept. A 200 with serverInfo means an open server. A 401 with a WWW-Authenticate header that includes resource_metadata means an OAuth-protected server that clients can discover. A 404 or an HTML page means agents can't find it at that URL.

curl -si https://mcp.example.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"check","version":"1"}}}'
Run the free check on your siteGet the full checklist

Questions

Do I need an MCP server if I have a REST API?

Not strictly; agents can call a REST API from an OpenAPI spec. An MCP server is the shortest path into assistants like Claude and ChatGPT, where users add it as a connector with a URL.

Streamable HTTP or SSE?

Streamable HTTP. The older HTTP+SSE transport has been deprecated since the 2025-03-26 spec.

What changed in the 2026-07-28 MCP spec?

MCP became stateless: the initialize handshake and session IDs are gone, each request carries its protocol version, and servers must answer a new server/discover call. Dynamic client registration was deprecated in favour of client ID metadata documents. Most clients still talk to servers on older versions.

Should the MCP server use API keys or OAuth?

OAuth, if people will connect it from chat assistants: they sign in with the account they already have. API keys still work for developer tools and scripts.