# Deployment Auth Source: https://docs.mcp-agent.com/cloud/authentication/deployment-auth Configure authentication for deployed MCP servers Every deployment needs an explicit stance on who can call its tools. This page covers the options supported today and what’s coming next. ## 1. Bearer token authentication (default) * Each user runs `mcp-agent login` to obtain an API key (`lm_mcp_api_*`). * Keys are stored locally (`~/.config/mcp-agent/credentials.json`) and can also be provided via the `MCP_API_KEY` environment variable (CI, containers). * Clients include the key in the `Authorization: Bearer ` header. * Deployments validate the token before executing requests. ### Share instructions with users ``` 1. Install mcp-agent (uv tool install mcp-agent) 2. Run mcp-agent login and follow the browser prompts 3. Configure the client (mcp-agent install ... --client claude_desktop) ``` ### Rotate or revoke * Re-run `mcp-agent login` to issue a new key (old keys will stop working). * Delete the key file to force re-authentication. * Per-user revocation UI is on the roadmap; in the interim contact support if a key is compromised. ### CLI recap ```bash theme={null} mcp-agent login # browser flow mcp-agent cloud auth whoami # confirm identity mcp-agent install --client cursor # writes config with Authorization header ``` ## 2. Unauthenticated access (`--no-auth`) Use this mode for public servers, demos, or ChatGPT Apps (which cannot provide custom headers). ```bash theme={null} mcp-agent deploy blog-tools --no-auth ``` * Anyone with the server URL can call it. * Logs still capture caller metadata (IP, user agent) for monitoring. * You can re-enable auth later: ```bash theme={null} mcp-agent deploy blog-tools --auth ``` (`--auth` toggles `unauthenticatedAccess` back to false.) > For apps deployed without auth, consider rate limiting or requiring custom user-provided secrets to avoid abuse. ## 3. OAuth 2.1 (coming soon, preview) The upcoming release implements the MCP OAuth specification across three surfaces: 1. **Authorization server** (control plane) * Metadata endpoint: `/.well-known/oauth-authorization-server` * Supports Google + GitHub providers initially * Issues access & refresh tokens 2. **Resource server** (your deployment) * Implements `/.well-known/oauth-protected-resource` (RFC 9728) * Validates JWTs or proxies to token introspection * Allows per-scope access control (e.g., `read`, `write`, `admin`) 3. **Client tooling** * `mcp-agent install` and `mcp-agent cloud configure` will drive the auth flow for supported clients (browser-based loopback or device code). Keep an eye on release notes for timelines. The migration will be additive—existing bearer-token flows continue to work. ## 4. Combining with secrets management * Store long-lived service credentials in `mcp_agent.secrets.yaml` as deployment secrets; the runtime injects them securely. * Ask end-users for their own credentials via `mcp-agent cloud configure` (user secrets). You can enforce domain restrictions or other policies in code when processing those secrets. ## 5. Security best practices Only expose tools/resources that need to be public. For internal deployments, keep `--auth` enabled and share API keys via secure channels. The platform records every API call (user, timestamp, tool, outcome). A user-facing audit surface is planned—ask the team if you need access before it ships. Rotate provider API keys regularly. Redeploy with updated secrets; the CLI invalidates old handles automatically. Provide install scripts (`mcp-agent install`) rather than asking users to edit config files manually. This reduces the risk of misconfigured auth headers. ## References * [Authentication overview →](/cloud/authentication/overview) * [External MCP server auth (downstream credentials) →](/cloud/authentication/external-mcp-auth) * [Secrets management →](/cloud/mcp-agent-cloud/manage-secrets) # External MCP Auth Source: https://docs.mcp-agent.com/cloud/authentication/external-mcp-auth Configure your agent to authenticate when calling downstream MCP servers Many agents call other MCP servers (e.g., Linear, GitHub, Slack). Each downstream server may require API keys or OAuth credentials. Use `mcp_agent.config.yaml` to specify how your agent should authenticate when acting as an MCP client. ## API key (static) authentication ```yaml mcp_agent.config.yaml theme={null} mcp: servers: github: command: "uvx" args: ["mcp-server-github"] auth: api_key: "${GITHUB_TOKEN}" # injected from secrets ``` * Store the actual token in `mcp_agent.secrets.yaml` (deployment secret) or `mcp_agent.configured.secrets.yaml` (user secret). * At runtime, `ServerRegistry` injects the `Authorization` header when connecting to the MCP server. * Supports any header name via `auth.headers` if the server expects a custom format. ## OAuth client credentials / authorization code For MCP servers that implement OAuth (Linear, Notion, custom internal IdPs), configure the `oauth` block: ```yaml theme={null} mcp: servers: notion: command: "uvx" args: ["mcp-server-notion"] auth: oauth: enabled: true authorization_server: "https://auth.notion.com" client_id: "${NOTION_CLIENT_ID}" client_secret: "${NOTION_CLIENT_SECRET}" scopes: ["documents.read", "documents.write"] resource: "https://mcp.notion.com" redirect_uri_options: - "http://127.0.0.1:33418/callback" - "https://.deployments.mcp-agent.com/oauth/callback" ``` How it works: 1. When the agent first needs the server, the OAuth manager checks the token store. 2. If no token exists, it launches an authorization flow (internal callback inside the deployment or local loopback while running locally). 3. Access + refresh tokens are stored in the configured token store (memory or Redis). 4. Tokens are refreshed automatically before expiry (`refresh_leeway_seconds`). ### Token store configuration ```yaml theme={null} oauth: token_store: backend: "redis" redis_url: "${REDIS_URL}" redis_prefix: "mcp_agent:oauth_tokens" ``` * `memory` (default) – in-memory, process-scoped. Great for development but not shared across workers. * `redis` – recommended for cloud deployments if your app uses multiple processes or needs persistence across restarts. ## Seeding tokens manually If you already have an access token: ```yaml theme={null} mcp: servers: linear: auth: oauth: enabled: true access_token: "${LINEAR_ACCESS_TOKEN}" refresh_token: "${LINEAR_REFRESH_TOKEN}" expires_at: 1740694445 ``` This bypasses the interactive flow; the token manager will refresh using the provided refresh token when needed. ## Request-time headers For bespoke auth schemes, you can specify arbitrary headers or environment variables: ```yaml theme={null} mcp: servers: internal_search: command: "./bin/internal-search" env: SEARCH_API_KEY: "${SEARCH_API_KEY}" auth: headers: X-Org: "lastmile" Authorization: "Bearer ${SEARCH_API_KEY}" ``` ## Best practices Always reference `${ENV_VAR}` placeholders in config and store the actual values in secrets files. Never hardcode tokens in Python modules. If every user needs their own credential (e.g., personal GitHub PAT), mark it as `!user_secret` so `mcp-agent cloud configure` collects it when they onboard the app. For OAuth-protected upstream servers you probably want a shared token cache (Redis) to avoid re-authorizing for every workflow run. Downstream servers may reject requests if scopes are missing. Log the response body and expose a clear error so users know to re-run the configure flow. ## Related docs * [Secrets management →](/cloud/mcp-agent-cloud/manage-secrets) * [Authentication overview →](/cloud/authentication/overview) * [MCP server configuration reference →](/reference/configuration#mcp-servers) # Authentication Overview Source: https://docs.mcp-agent.com/cloud/authentication/overview Authentication architecture for mcp-agent cloud deployments mcp-agent cloud supports multiple authentication modes so you can choose the right balance between security and accessibility. This page introduces the architecture and flows; the detailed configuration lives in the sub-pages. ## Components | Component | Role | | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | **Authorization server** | Issues API keys today; OAuth 2.1 support (authorization code flow) is in development. Hosted in LastMile’s control plane. | | **Resource server (your deployment)** | Exposes MCP endpoints (`call_tool`, `read_resource`, etc.) and validates tokens. Powered by FastMCP + `MCPApp`. | | **Clients** | MCP clients (Claude Desktop, Cursor, ChatGPT Apps), custom code (Python, cURL), or other MCP servers calling downstream resources. | | **Secrets service** | Stores deployment/user secrets, eliminating the need to embed credentials in clients. | Agents exposed as MCP servers, sitting between MCP clients and downstream MCP servers ## Modes at a glance | Mode | Use case | How | Docs | | -------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------- | | **Bearer token** (default) | Internal deployments, quick sharing within a team | `mcp-agent login` → provides `MCP_API_KEY`. Clients send `Authorization: Bearer`. | [Deployment auth →](/cloud/authentication/deployment-auth) | | **Unauthenticated** | Public endpoints, ChatGPT Apps | Deploy with `mcp-agent deploy ... --no-auth`. | [Deployment auth →](/cloud/authentication/deployment-auth) | | **OAuth 2.1 (Upcoming)** | Enterprise SSO, fine-grained scopes | Follows MCP OAuth spec (RFC 9728 + RFC 8414). | (Coming soon) | | **External MCP auth** | Your agent needs to authenticate to downstream MCP servers | Configure `mcp_agent.config.yaml -> mcp.servers..auth` for API keys or OAuth client credentials. | [External MCP auth →](/cloud/authentication/external-mcp-auth) | ## Current flow (Bearer tokens) 1. Developer or user runs `mcp-agent login`. 2. Browser-based auth returns an API key (`lm_mcp_api_*`), stored locally. 3. CLI and MCP clients use the key in the `Authorization: Bearer` header. 4. Deployment validates the token before executing tools/workflows. ## Upcoming OAuth architecture The forthcoming OAuth implementation follows the MCP Authorization specification: * `/.well-known/oauth-authorization-server` metadata endpoint (RFC 8414). * Authorization endpoint (`/oauth2/authorize`) supporting Google, GitHub, and custom IdPs. * Token endpoint (`/oauth2/token`) returning access + refresh tokens. * Resource server metadata (`/.well-known/oauth-protected-resource`) for deployments advertising supported methods (`bearer_methods_supported`, scopes). * Token introspection and JWKS endpoints for JWT validation. We aim to make the default configuration zero-touch for mcp-agent cloud deployments while still allowing you to point at other OAuth providers if you self-host. ## Choosing an authentication mode * **Internal tools or staging** → keep bearer tokens (fastest path). * **Publishing to ChatGPT Apps** → deploy with `--no-auth`, optionally combine with rate limiting in code. * **Customer-facing apps** → use bearer tokens initially, migrate to OAuth when available to integrate with existing identity providers. * **Agents calling other MCP servers** → configure outbound auth in `mcp_agent.config.yaml`. This is independent of how end-users authenticate to your deployment. ## Related guides * [Configure deployment auth (bearer, unauthenticated, OAuth preview) →](/cloud/authentication/deployment-auth) * [Authenticate to external MCP servers →](/cloud/authentication/external-mcp-auth) * [Manage secrets →](/cloud/mcp-agent-cloud/manage-secrets) # Cloud Quickstart Source: https://docs.mcp-agent.com/cloud/deployment-quickstart Deploy an MCP application to mcp-c in a couple of commands **mcp-c** is in open beta. Share feedback via [GitHub](https://github.com/lastmile-ai/mcp-agent/issues) or [Discord](https://lmai.link/discord/mcp-agent). ## TL;DR ```bash theme={null} uvx mcp-agent login uvx mcp-agent deploy my-agent uvx mcp-agent cloud servers describe my-agent ``` That is enough to put any MCP application—`mcp-agent` workflow, FastMCP server, or ChatGPT App backend—online. Deployments automatically run on the managed Temporal cluster; you do **not** need to configure Temporal hosts or queues yourself. The sections below add a little context and point to deeper guides when you are ready. ## 1. Authenticate (one time) ```bash theme={null} uvx mcp-agent login ``` The CLI opens a browser window so you can sign in with GitHub or Google and generate an API key. Credentials are cached under `~/.mcp-agent/credentials.json`. In CI, set the `MCP_API_KEY` environment variable instead. ## 2. Confirm your project layout Minimal structure: ``` my-agent/ ├── main.py ├── mcp_agent.config.yaml └── (optional) mcp_agent.secrets.yaml ``` `mcp_agent.config.yaml` just needs to describe your app. You can keep `execution_engine: temporal` if you already use it locally, but the cloud service will always launch your code on Temporal automatically. Example: ```yaml mcp_agent.config.yaml theme={null} name: web_summarizer logger: transports: [console] mcp: servers: fetch: command: "uvx" args: ["mcp-server-fetch"] openai: default_model: gpt-4o ``` If your app needs API keys, place them in `mcp_agent.secrets.yaml` (details in [Manage secrets](/cloud/mcp-agent-cloud/manage-secrets)). ## 3. Deploy ```bash theme={null} uvx mcp-agent deploy web-summarizer ``` The CLI bundles the current directory, prompts you to classify secrets (deployment vs. user), uploads the bundle, and provisions the runtime. On success you will see something like: ``` ✓ Deployed app ID: app_abc123xyz Server URL: https://app_abc123xyz.deployments.mcp-agent.com Status: ONLINE ``` Redeploy with the same name to ship updates. Useful flags: * `--config-dir ` – deploy from another directory. * `--non-interactive` – reuse stored secrets (CI/CD). * `--dry-run` – validate without uploading. ## 4. Check status & logs ```bash theme={null} uvx mcp-agent cloud servers describe app_abc123xyz uvx mcp-agent cloud logger tail app_abc123xyz --follow ``` `describe` prints the endpoint, auth mode, and worker status. `logger tail` streams application logs; add `--since 30m` or `--grep "ERROR"` as needed. All other operational commands are listed on the [cloud overview](/cloud/mcp-agent-cloud/overview). ## 5. Configure clients Most deployments need per-user credentials. Prompt users (or your CI job) with: ```bash theme={null} uvx mcp-agent cloud configure --id https://app_abc123xyz.deployments.mcp-agent.com ``` Then install the server into your favourite MCP client: * **Claude Desktop / Cursor / VS Code / ChatGPT** – `uvx mcp-agent install --client https://app_abc123xyz.deployments.mcp-agent.com/sse` * **ChatGPT Apps** – deploy with `--no-auth` and register the SSE endpoint in the Apps dashboard. * **Python** – add the server endpoint to your MCP client config ([see guide](/cloud/mcp-agent-cloud/use-deployed-server)). ## Going further * [Cloud overview](/cloud/mcp-agent-cloud/overview) – architecture, auth, observability. * [Long-running tools](/cloud/mcp-agent-cloud/long-running-tools) – design durable workflows. * [Manage secrets](/cloud/mcp-agent-cloud/manage-secrets) – developer vs. user secrets. * [Use a deployed server](/cloud/mcp-agent-cloud/use-deployed-server) – client setup recipes. # Architecture Overview Source: https://docs.mcp-agent.com/cloud/mcp-agent-cloud/architecture-overview How mcp-c stitches MCP apps, Temporal, and container orchestration together This page expands on the managed architecture that powers `mcp-c`, our MCP cloud platform. Use it to understand deployment flows, security boundaries, and the runtime environment your code executes inside. ## High-level layout Infrastructure diagram showing Temporal cluster, edge tier, and user container instances The environment is split into three planes: | Plane | Responsibilities | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Control plane** | CLI/API ingress, bundle processing, secrets management, permission checks, deployment orchestration. | | **Runtime (userspace)** | Dedicated container instance per deployment hosting the MCPApp and any declared stdio MCP servers. Connects to Temporal and logging/metrics pipelines. | | **Temporal plane** | Multi-role Temporal cluster (frontend, history, matching) backed by RDS for durability. Handles workflow scheduling, state persistence, and task queues. | ### Control plane * **Deployment service** – receives bundles from `mcp-agent deploy`, validates manifests, resolves dependencies, and produces container images. * **Secrets service** – encrypts deployment secrets and stores handles returned to your app via `mcp_agent.deployed.secrets.yaml`. `mcp-agent cloud configure` interacts with the same service to capture user-provided secrets. * **Auth service** – issues API keys (`mcp-agent login`) and will host the OAuth 2.1 authorization server described in the [Authentication design](https://github.com/lastmile-ai/lm/docs-revamp/blob/main/mcp-agent9/docs/cloud/authentication/overview.mdx) (Beta). * **Artifact store** – versioned bundles and metadata (git commit, description, ignore patterns). The same bundle can be replayed to recreate deployments. ### Runtime plane * **MCP application container** – runs your `main.py` and exposes the MCP transport (SSE + HTTP). The container boots the `MCPApp`, loads secrets, and registers workflows/tool definitions with FastMCP. * **Stdio MCP server containers** – every entry in `mcp_agent.config.yaml -> mcp.servers` becomes a sidecar container. We currently support Python (`uvx`), Node (`npx`), and any binary accessible via command/args. * **Envoy router** – mediates outbound requests to Temporal, logging services, and other managed APIs. This allows features like environment-wide header injection and future policy enforcement. * **Temporal worker** – the MCPApp process hosts the Temporal worker; it polls the shared task queue defined in `mcp_agent.config.yaml` (`temporal.task_queue`) and executes workflows. * **Observability agents** – Fluent Bit forwards structured logs; OTEL collectors batch traces. You can override endpoints via `mcp-agent cloud logger configure`. ### Temporal plane * **Multi-role cluster** – uses ECS (or Kubernetes) to run Temporal frontend, history, matching, and worker services with service discovery. * **RDS** – stores workflow state, task queues, and visibility history. Backups and retention policies are managed centrally. * **Internal auth** – the Temporal frontend is behind an auth proxy. Runtime containers use short-lived credentials issued by the control plane when deployments start. * **Notifications** – Temporal emits events for workflow state changes; these feed into future dashboard features and CLI improvements. ## Request flow (MCP client → deployed app) 1. An MCP client (Claude Desktop, Cursor, ChatGPT Apps, custom SSE) connects to `https://.deployments.mcp-agent.com/` with the configured auth mode. 2. Edge services terminate TLS, validate bearer tokens or OAuth claims, and route traffic to the user runtime. 3. FastMCP inside your container invokes the requested tool or workflow. `@app.tool` handlers return immediately; `@app.async_tool` handlers start a Temporal workflow. 4. The runtime interacts with stdio MCP servers or external APIs as defined in your config. Secrets are available via environment variables or the config object. 5. Results stream back to the client through SSE or HTTP responses. Long-running workflows return `run_id`s which clients poll via `workflows-get_status`. ## Deployment flow (CLI → control plane) ```mermaid theme={null} sequenceDiagram participant Dev as Developer CLI participant Control as Control Plane participant Secrets as Secrets Service participant Build as Build & Deploy participant Runtime as Runtime Plane Dev->>Control: mcp-agent deploy (bundle + metadata) Control->>Secrets: Transform secrets (handle generation) Secrets-->>Control: Handles + user secret prompts Control->>Build: Dispatch build job (images + manifests) Build-->>Runtime: Provision containers, inject secrets Runtime-->>Temporal: Register workers & workflows Runtime-->>Control: Health/ready signal Control-->>Dev: App ID, server URL, status ONLINE ``` ### Bundling specifics * Uses git metadata when available (`branch`, `commit`, optional `--git-tag`). * Honors `.mcpacignore` (gitignore syntax). Precedence: `--ignore-file`, then `/.mcpacignore`, then `cwd/.mcpacignore`. * Embeds `mcp_agent.deployed.secrets.yaml` instead of the raw secrets file. * Includes `pyproject.toml`, `requirements.txt`, and any other files referenced at runtime (static assets, prompts, etc.). ## Security considerations * **Network isolation** – runtime containers run in per-tenant subnets; inter-deployment access is blocked by default. * **Secrets at rest** – encrypted using envelope encryption; only decrypted inside the runtime at startup. * **Auditability** – all CLI and API calls are logged (coming soon to the user-facing console). * **Future OAuth** – the upcoming OAuth implementation follows the MCP Authorization spec (RFC 9728) with dynamic client registration and token introspection (`/.well-known/oauth-authorization-server`, `/oauth2/authorize`, `/token`). ## Roadmap highlights * Web console for deployment management (list, metrics, publish to marketplace). * Native Temporal trace viewer and workflow search. * First-class support for publishing public MCP servers with usage analytics. * Expanded deployment regions and VPC peering for enterprise integrations. ## Related pages * [Cloud overview →](/cloud/mcp-agent-cloud/overview) * [Secrets & credential management →](/cloud/mcp-agent-cloud/manage-secrets) * [Long-running tools & workflows →](/cloud/mcp-agent-cloud/long-running-tools) * [Authentication modes →](/cloud/authentication/overview) # Deploying MCP Servers Source: https://docs.mcp-agent.com/cloud/mcp-agent-cloud/deploy-mcp-server Ship FastMCP or custom MCP servers on mcp-agent cloud infrastructure `mcp-agent cloud` is not limited to full agent workflows—you can deploy any MCP-compliant server (Python, Node, Rust, etc.) and let the platform handle hosting, auth, and observability. This is ideal for tool libraries, data access APIs, or bridge services that you want to publish without maintaining infrastructure. ## Why deploy plain MCP servers? * **Standard MCP interface** – Serve tools, resources, and prompts that any MCP client can consume. * **Managed runtime** – Containers, TLS, load balancing, and scaling handled automatically. * **Security** – Secrets vault, per-client API keys, optional unauthenticated mode for public registries. * **Observability** – Consistent logging + OTEL pipeline and CLI integration (`mcp-agent cloud logger tail`). * **Upgrade path** – When you are ready for long-running workflows, migrate the project to `MCPApp` without changing deployment tooling. ### Side-by-side capabilities | Capability | Managed MCP server | Full mcp-agent app | | ------------------ | ------------------------------ | ---------------------------------------- | | Tools & resources | ✅ Standard MCP tools/resources | ✅ Same, plus workflow-generated tools | | Long-running work | ⚠️ Request lifetime only | ✅ Temporal workflows with pause/resume | | Human input | Manual implementation | ✅ Built-in `request_human_input` APIs | | Retry & durability | Manual retries/logging | ✅ Automatic retries, state persistence | | Observability | ✅ Logs + OTEL forwarding | ✅ All of the left, plus workflow history | | Client integration | ✅ SSE/HTTP endpoints | ✅ Same endpoints | ## FastMCP example ```python theme={null} # main.py from fastmcp import FastMCP mcp = FastMCP("utilities") @mcp.tool() async def hash_text(text: str, algorithm: str = "sha256") -> str: """Generate a hash of text using hashlib.""" import hashlib h = hashlib.new(algorithm) h.update(text.encode()) return h.hexdigest() @mcp.resource("utils://algorithms") async def list_algorithms(): return {"algorithms": ["md5", "sha1", "sha256", "sha3_512"]} if __name__ == "__main__": mcp.run() ``` Configuration (`mcp_agent.config.yaml`) only needs to reference the entrypoint: ```yaml theme={null} name: utilities-server description: "Handy utility tools exposed over MCP" execution_engine: asyncio # No workflows required mcp: servers: utilities: command: "uvx" args: ["python", "main.py"] logger: transports: [console] level: info ``` `mcp_agent.secrets.yaml` remains optional unless your server calls external APIs. ## MCPApp-only example (no workflows) If you prefer to stay inside the `mcp-agent` API surface (to reuse `context`, logging, etc.) you can create tools with decorators and skip workflow definitions. ```python theme={null} from mcp_agent.app import MCPApp app = MCPApp(name="markdown_tools") @app.tool async def to_title_case(text: str) -> str: return text.title() @app.tool async def count_words(text: str) -> int: return len(text.split()) if __name__ == "__main__": import asyncio asyncio.run(app.run()) ``` Config: ```yaml theme={null} name: markdown-tools execution_engine: asyncio logger: transports: [console] level: info ``` Because there are no workflows, the app behaves like a standard MCP server but you can add Temporal-backed workflows later without changing the deployment process. ## Deploy the server 1. **Authenticate** (once per environment): ```bash theme={null} mcp-agent login # stores MCP_API_KEY ``` 2. **Deploy from the directory that contains `main.py` and `mcp_agent.config.yaml`:** ```bash theme={null} mcp-agent deploy utilities-server \ --app-description "Utility functions as MCP tools" ``` * Use `--config-dir path/to/server` if deploying from a monorepo. * Add `--no-auth` to expose a public endpoint (e.g., for ChatGPT Apps). * Use `--non-interactive` in CI/CD to reuse stored secrets. 3. **Describe the deployment:** ```bash theme={null} mcp-agent cloud servers describe utilities-server ``` Copy the `Server URL` for client integration. ## Configure clients Use either `mcp-agent install` (writes files automatically) or `mcp-agent configure --client` (prints snippets). ```bash theme={null} mcp-agent install https://.deployments.mcp-agent.com/sse \ --client cursor mcp-agent configure https://.deployments.mcp-agent.com/sse \ --client vscode --write ``` `` is the hostname reported by the CLI (for example, `app_abc123xyz.deployments.mcp-agent.com`). For unauthenticated deployments (e.g., ChatGPT Apps), remember to deploy with `--no-auth` and run: ```bash theme={null} mcp-agent install --client chatgpt ``` ## Operate and monitor Even though these servers do not use Temporal, you still get the operational surface: * `mcp-agent cloud servers list` – inventory of deployed servers. * `mcp-agent cloud logger tail utilities-server --follow` – live logs. * `mcp-agent cloud servers delete utilities-server` – tear down when finished. * `mcp-agent cloud configure --id ` – collect user-specific secrets if needed. ## Upgrade path to full agents Start simple and layer on durability when required: ```python theme={null} # Initial FastMCP tool @mcp.tool() async def fetch_issue(repo: str, number: int) -> dict: ... # Later: wrap inside MCPApp to reuse the tool and add workflows from mcp_agent.app import MCPApp app = MCPApp(name="issue_triage") @app.tool async def fetch_issue(repo: str, number: int) -> dict: ... @app.async_tool async def triage_issue(repo: str, number: int) -> dict: # Durable workflow that assigns, notifies, etc. ... ``` Redeploy with the same name and clients keep working while gaining new capabilities (`workflows-get_status`, pause/resume, etc.). ## Checklist for MCP server deployments * [ ] Entrypoint (`main.py`) starts the server when executed. * [ ] `mcp_agent.config.yaml` references the command + args. * [ ] `requirements.txt` or `pyproject.toml` included. * [ ] Secrets captured in `mcp_agent.secrets.yaml` (if needed). * [ ] `.mcpacignore` excludes large/unnecessary files. * [ ] Deployment tested locally with `uv run main.py` or `npx @modelcontextprotocol/inspector`. * [ ] Documentation for consumers (URL, sample tool calls, auth mode). ## Resources * Example repository: [`examples/cloud/mcp`](https://github.com/lastmile-ai/mcp-agent/tree/main/examples/cloud/mcp) * FastMCP documentation: [github.com/jlowin/fastmcp](https://github.com/jlowin/fastmcp) * [Deployment quickstart →](/cloud/deployment-quickstart) * [Authentication options →](/cloud/authentication/deployment-auth) # Long-Running Tools Source: https://docs.mcp-agent.com/cloud/mcp-agent-cloud/long-running-tools Design synchronous tools, async tools, and workflows for durable execution Cloud deployments turn every tool decorator and workflow definition into a first-class MCP endpoint. This page explains how each decorator maps onto the managed runtime, how Temporal keeps work durable, and how to observe long-running runs in production. Temporal workflow execution timeline for an mcp-agent deployment ## Three building blocks | Decorator | Execution model | When to use | MCP exposure | | ------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | `@app.tool` | Runs inline inside the MCP server process. Caller blocks until the tool returns. | “Quick” actions \< O(seconds). Ideal for fan-out RPCs, data lookups, or deterministic helpers. | Registered as `` | | `@app.async_tool` | Starts a Temporal workflow, returns `{workflow_id, run_id}` immediately. Caller polls for completion. | Any async or long-running operation: multi-step plans, heavy LLM conversations, human-in-the-loop validations. | `` (async). Helpers `workflows-get_status`, `workflows-cancel`, etc. | | `@app.workflow` / `@app.workflow_run` | Explicit workflow class. Useful for complex logic, reusability, or exposing multiple entrypoints. | Multi-agent orchestration, routers, evaluator-optimizer loops, deep orchestrators. | `workflows--run` | All three share the same contextual features: * Access to `context.server_registry`, `context.logger`, and configured MCP servers. * `agent.attach_llm(...)` to work with Augmented LLMs. * Token counting when tracing is enabled. * Human input via `await context.request_human_input(...)`. ## Example: synchronous vs async tool ```python theme={null} from mcp_agent.app import MCPApp from mcp_agent.core.context import Context app = MCPApp(name="reporting_agent") # Fast helper – returns immediately @app.tool(description="Fetch metrics for a repository") async def get_metrics(repo: str, ctx: Context | None = None) -> dict: stats = await ctx.server_registry.call_tool( server_name="github", tool_name="get_repo_stats", arguments={"repo": repo} ) return stats # Long-running operation – durable workflow @app.async_tool(description="Generate a weekly engineering report") async def generate_weekly_report(team: str, ctx: Context | None = None) -> dict: agent = ctx.app.create_agent( # convenience helper – see docs/mcp-agent-sdk name="report_writer", instruction="Compile GitHub + PagerDuty + Notion into a weekly summary.", server_names=["github", "notion", "pagerduty"], ) async with agent: llm = await agent.attach_llm() summary = await llm.generate_str( f"Create a weekly incident & delivery report for {team}. " "Include stats from the connected MCP servers." ) # The value is stored in Temporal history and surfaced via workflows-get_status return {"report": summary} ``` Callers experience: ```bash theme={null} # Synchronous tool – returns result payload immediately mcp-agent cloud invoke --tool get_metrics --json '{"repo": "lastmile-ai/mcp-agent"}' # Async tool – returns IDs to poll mcp-agent cloud invoke --tool generate_weekly_report --json '{"team": "core"}' # Later… mcp-agent cloud workflows describe run_9b43be2a ``` ## Workflow classes For intricate flows you can define a workflow class with reusable steps, activities, and signals. This pattern gives you access to the full Temporal API (signals, queries, child workflows, timers). ```python theme={null} from mcp_agent.executor.workflow import Workflow, WorkflowResult @app.workflow class MultiAgentReview(Workflow[str]): """Orchestrate planner, researcher, and writer agents.""" @app.workflow_run async def run(self, topic: str) -> WorkflowResult[str]: plan = await self.plan(topic) research = await self.research(plan) draft = await self.write(research) return WorkflowResult(value=draft) @app.task async def plan(self, topic: str) -> list[str]: ... @app.task async def research(self, plan: list[str]) -> dict: ... @app.task async def write(self, research: dict) -> str: ... ``` Temporal executes each `@app.task` as an activity. Tasks can run in parallel, include retries/backoff, or call `await self.context.request_human_input(...)` to pause. ## Monitoring and control Use the workflow commands to introspect long-running operations: ```bash theme={null} # List definitions exposed by the app mcp-agent cloud workflows list app_abc123 # List recent runs (optionally filter by status) mcp-agent cloud workflows runs app_abc123 --status running --limit 5 # Inspect a specific run mcp-agent cloud workflows describe app_abc123 run_cf98712 # Pause / resume with additional context mcp-agent cloud workflows suspend app_abc123 run_cf98712 mcp-agent cloud workflows resume app_abc123 run_cf98712 \ --payload '{"approved": true, "notes": "Ship it"}' # Cancel if you need to stop work mcp-agent cloud workflows cancel app_abc123 run_cf98712 ``` Logs and traces remain available while the workflow executes: * `mcp-agent cloud logger tail app_abc123 --follow` * Configure OTEL exporters in `mcp_agent.config.yaml` or via `mcp-agent cloud logger configure`. * Temporal metadata (start time, attempt count, memo fields) is surfaced in `workflows describe`. ## Best practices Anything that might exceed the default request timeout for clients should be an async tool. Claude Desktop and Cursor expect quick responses; returning `{run_id}` lets them switch to a progress UI. Use `context.logger.info` for status updates and `context.signal_notification` (custom signals) if you need to push progress to the caller. Future versions will surface these in the console. `await context.request_human_input(prompt="...")` pauses the workflow and stores state in Temporal. Users resume via `mcp-agent cloud workflows resume … --payload`. Attach lightweight metadata (`WorkflowResult(metadata=...)`) to make filtering easier (`--status`, custom reports). Memo values show up in `workflows runs`. Set unique `temporal.task_queue` values per application to control worker placement and concurrency. For large deployments you can run additional workers using `mcp-agent cloud app workers`. ## Further reading * [Workflow orchestration patterns →](/workflows/overview) * [Durable agents with your own Temporal cluster →](/mcp-agent-sdk/advanced/durable-agents) * [Authentication for long-running tools →](/cloud/authentication/deployment-auth) # Manage Secrets Source: https://docs.mcp-agent.com/cloud/mcp-agent-cloud/manage-secrets Securely handle API keys and user-provided credentials for cloud deployments Secrets management in `mcp-agent cloud` has two phases: 1. **Deployment secrets** – values known at deploy time (provider API keys, service accounts, webhooks). Stored encrypted, mounted into the runtime automatically. 2. **User secrets** – values each consumer must supply (personal access tokens, OAuth refresh tokens). Collected per user via `mcp-agent cloud configure` and scoped to that user’s configuration. Understanding the difference lets you ship reusable agents without exposing credentials. ## Secret files at a glance | File | When | Contains | Checked into git? | | ----------------------------------- | ---------------------------------------- | ----------------------------------------------------------- | -------------------------------------------- | | `mcp_agent.secrets.yaml` | Before deploy | Raw values you author locally | **No** (add to `.gitignore`) | | `mcp_agent.deployed.secrets.yaml` | Generated by `mcp-agent deploy` | Handles for deployment secrets, `!user_secret` placeholders | Yes – safe to commit | | `mcp_agent.configured.secrets.yaml` | Generated by `mcp-agent cloud configure` | User-supplied secrets bound to secret handles | Optional – safe to share with that user only | ## Step 1 – author your secrets file Create `mcp_agent.secrets.yaml` next to `mcp_agent.config.yaml`: ```yaml theme={null} openai: api_key: "sk-..." # deployment secret notion: api_key: "!user_secret NOTION_KEY" # user secret (collected later) crm: base_url: "https://api.example.com" # not a secret, but you can store config values too ``` You can tag secrets as user secrets in two ways: ```yaml theme={null} notion: api_key: "!user_secret NOTION_KEY" # inline tagged value ``` or ```yaml theme={null} notion: api_key: !user_secret NOTION_KEY ``` Everything else is treated as a deployment secret by default. ## Step 2 – transform during deployment When you run `mcp-agent deploy`, the CLI: 1. Loads `mcp_agent.secrets.yaml`. 2. Asks how to treat each value (unless already tagged or using `--non-interactive`). 3. Creates secrets via the cloud API and stores the resulting handles. 4. Writes `mcp_agent.deployed.secrets.yaml` and bundles it with your deployment. Example output: ``` ? Store OPENAI_API_KEY as a deployment secret? [Y/n] y ? Tag NOTION_KEY as user secret? [Y/n] y ✓ Created 1 deployment secret, 1 user secret placeholder ✓ Wrote mcp_agent.deployed.secrets.yaml (commit safe) ``` Generated file: ```yaml mcp_agent.deployed.secrets.yaml theme={null} openai: api_key: !secret mcpac_sc_5c0e2d7b-5b1b-41af-b5c7-91e0a7c5c6f5 notion: api_key: !user_secret NOTION_KEY ``` > Each `!secret` handle references an encrypted value stored in the control plane. Handles are opaque and cannot be used outside the deployment. ## Step 3 – collect end-user secrets (optional) If you exposed any `!user_secret` entries, share the deployment URL with your users and have them run: ```bash theme={null} mcp-agent cloud configure \ --id https://.deployments.mcp-agent.com ``` `` is the hostname printed in your deployment output (for example, `app_abc123xyz`). The CLI: 1. Checks what user secrets are required (`--params` shows them without storing). 2. Prompts for each secret (or reads them from `--secrets-file`). 3. Writes `mcp_agent.configured.secrets.yaml` (unless `--dry-run`). 4. Uploads encrypted user secret handles tied to the caller’s API key. Example output: ``` ? Provide value for NOTION_KEY: ************************ ✓ Stored 1 user secret ✓ Wrote mcp_agent.configured.secrets.yaml ``` Subsequent runs reuse stored values; use `--dry-run` to validate without persisting changes. ### Sharing with automated clients * Provide `mcp_agent.configured.secrets.yaml` alongside the deployment URL for headless environments (CI, scheduled jobs). * Re-run `mcp-agent cloud configure --params` in pipelines to assert the contract matches expectations. * If you must rotate secrets automatically, script the configure command with `--secrets-file`. ## Accessing secrets in code Secrets are injected into your app via the config layer. Use `app.config` or the global settings helper: ```python theme={null} from mcp_agent.config import get_settings settings = get_settings() openai_key = settings.openai.api_key # decrypted value notion_key = settings.notion.api_key # user secret (per user) ``` You can also access them through environment variables if you prefer: ```python theme={null} import os api_key = os.environ["OPENAI__API_KEY"] ``` > Deployment secrets are available to all users of the app. User secrets are scoped to the specific user/configuration that ran `mcp-agent cloud configure` and are only injected when that user’s API key is used to connect. ## Non-interactive + CI/CD * **Reuse existing handles**: `mcp-agent deploy --non-interactive` reuses secrets stored in `mcp_agent.deployed.secrets.yaml` and fails if new values are required. * **Custom API URL/keys**: set `MCP_API_KEY` (or use `--api-key`) and `MCP_API_BASE_URL` for staging environments. * **Partial updates**: if you add a new entry to `mcp_agent.secrets.yaml`, the CLI prompts only for the new value. ## Advanced tips For local testing or one-off overrides, set `MCP_APP_SETTINGS_PRELOAD` to a YAML string that merges into the app settings before initialization. Useful when you do not want to create a secrets file on disk. Handles are per deployment. If you want to share the same credential across multiple apps, store the raw value in a secure password manager and paste it during each deploy. Secret rotation APIs are on the roadmap. Today rotation is manual (`mcp-agent deploy` with a new value). We log all secret creation/update events for future audit surfaces. Automatic rotation hooks are planned post-beta. By default secrets are scoped to your user account. Team-wide sharing is coming with the upcoming workspace model—expect CLI flags to target a workspace instead of a personal scope. ## Troubleshooting * **“Must have API key to process secrets”** – run `mcp-agent login` (or set `MCP_API_KEY`) before deploying. * **Secrets not injected at runtime** – double-check `mcp_agent.deployed.secrets.yaml` is present in your project and that you are reading via `get_settings()`. Also ensure the file is not ignored by `.mcpacignore`. * **Configure prompts unexpectedly** – you likely tagged a value as `!user_secret`. If it should be global, re-run `mcp-agent deploy` and choose “store as deployment secret”. * **Need to revoke a user’s secrets** – run `mcp-agent cloud app revoke-config --id ` (coming soon). For now, delete the configuration via the API or ask the user to run configure again. ## Related docs * [Deployment quickstart →](/cloud/deployment-quickstart) * [Authentication options →](/cloud/authentication/deployment-auth) * [Reference configuration schema →](/reference/configuration) # Use a Deployed Server Source: https://docs.mcp-agent.com/cloud/mcp-agent-cloud/use-deployed-server Configure clients, share endpoints, and automate consumption of deployed MCP servers After deployment, each app is reachable at an HTTPS endpoint such as: ``` https://.deployments.mcp-agent.com Replace `` with the hostname shown by `mcp-agent deploy` or `mcp-agent cloud servers describe` (e.g., `app_abc123xyz.deployments.mcp-agent.com`). ``` This page explains how to retrieve the URL, set up authentication, configure clients, and script interactions. ## 1. Find the server URL ```bash theme={null} # Show all deployments (filterable, sortable) mcp-agent cloud servers list # Describe a specific deployment and copy the Server URL mcp-agent cloud servers describe app_abc123 --format text ``` The description output includes: * `Server URL` – base URL (append `/sse` for SSE transport or `/call_tool` for HTTP). * Authentication mode (Bearer token, unauthenticated, OAuth coming soon). * Status, creation time, description. ## 2. Make sure clients have the right secrets If you tagged any `!user_secret` entries, each consumer must configure the deployment before connecting: ```bash theme={null} # Prompts for required secrets (per API key) mcp-agent cloud configure --id https://.deployments.mcp-agent.com # Inspect required parameters without storing mcp-agent cloud configure --id --params ``` You can supply a YAML file (`--secrets-file`) or capture the resulting file (`--secrets-output-file`) to share with your team. ## 3. Install into MCP clients Use the top-level install command to update client-specific config files: ```bash theme={null} # Claude Desktop (macOS, Windows, Linux) mcp-agent install https://.deployments.mcp-agent.com/sse \ --client claude_desktop --name web-summarizer # Cursor mcp-agent install https://.deployments.mcp-agent.com/sse \ --client cursor # VS Code MCP extension mcp-agent install https://.deployments.mcp-agent.com/sse \ --client vscode # Claude Code (codespaces experience) mcp-agent install https://.deployments.mcp-agent.com/sse \ --client claude_code # ChatGPT Apps (requires --no-auth deployments) mcp-agent install https://.deployments.mcp-agent.com/sse \ --client chatgpt ``` What the command does: * Validates your `MCP_API_KEY` (or uses `--api-key`). * Fetches app metadata (name, unauthenticated status) for validation. * Writes the appropriate JSON snippet to the client-specific config file. * Masks secrets when printing to the terminal (use `--dry-run` to preview). > Client config locations:\ > • Claude Desktop – `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)\ > • Cursor – `~/.cursor/mcp.json`\ > • VS Code – `/.vscode/mcp.json`\ > • Claude Code – `~/.claude.json` ## 4. Manual configuration (if needed) All MCP clients understand the same HTTP/SSE interface. A minimal configuration looks like: ```json theme={null} { "servers": { "web-summarizer": { "url": "https://.deployments.mcp-agent.com/sse", "headers": { "Authorization": "Bearer ${MCP_API_KEY}" } } } } ``` For Claude Desktop (stdio-only), wrap the HTTP server with `mcp-remote`: ```json theme={null} { "servers": { "web-summarizer": { "command": "npx", "args": [ "mcp-remote", "https://.deployments.mcp-agent.com/sse", "--header", "Authorization: Bearer ${MCP_API_KEY}" ] } } } ``` ## 5. Automate calls from code ### Python 1. Create or update a server entry in `mcp_agent.config.yaml`: ```yaml theme={null} mcp: servers: web_summarizer_cloud: transport: sse url: "https://.deployments.mcp-agent.com/sse" headers: Authorization: "Bearer ${MCP_API_KEY}" ``` 2. Use the shared server registry to open a client session: ```python theme={null} import asyncio from mcp_agent.config import get_settings from mcp_agent.mcp.mcp_server_registry import ServerRegistry from mcp_agent.mcp.gen_client import gen_client async def run_workflow(): registry = ServerRegistry(config=get_settings()) async with gen_client("web_summarizer_cloud", server_registry=registry) as client: launch = await client.call_tool( "workflows-WebSummarizerWorkflow-run", arguments={"run_parameters": {"url": "https://example.com"}}, ) run_id = launch.content[0].text status = await client.call_tool( "workflows-get_status", arguments={"run_id": run_id}, ) print(status.content[0].text) asyncio.run(run_workflow()) ``` ### HTTP / cURL ```bash theme={null} curl -X POST https://.deployments.mcp-agent.com/call_tool \ -H "Authorization: Bearer $MCP_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "workflows-WebSummarizerWorkflow-run", "arguments": {"run_parameters": {"url": "https://example.com"}} }' ``` ### MCP Inspector ```bash theme={null} npx @modelcontextprotocol/inspector \ --transport sse \ --server-url https://.deployments.mcp-agent.com/sse \ --header "Authorization: Bearer $MCP_API_KEY" ``` ## 6. Provide usage instructions to end users Consider sharing a short README with: * The server URL and description. * Required user secrets (from `mcp-agent cloud configure --params`). * Example calls (like the snippets above). * Recommended MCP clients (Claude Desktop, Cursor, ChatGPT, etc.). * Observability tips (`mcp-agent cloud logger tail` for debugging). ## 7. Rotate tokens and access * **Rotate API keys** – run `mcp-agent login` again or set a new `MCP_API_KEY`. * **Revoke access** – delete individual configurations (coming soon) or redeploy with `--auth` to disable unauthenticated access. * **Publish publicly** – ensure the deployment is unauthenticated and document explicit rate limits / expectations. ## Related docs * [Deployment quickstart →](/cloud/deployment-quickstart) * [Authentication options →](/cloud/authentication/deployment-auth) * [Secrets management →](/cloud/mcp-agent-cloud/manage-secrets) # Observability Source: https://docs.mcp-agent.com/cloud/observability Stream logs, emit traces, and integrate mcp-agent cloud with your OTEL stack Robust observability is critical for diagnosing LLM workflows and multi-agent behaviour. mcp-agent cloud provides two complementary surfaces: 1. **Managed telemetry** – live log streaming, request metadata, and token usage accessible via CLI. 2. **Bring-your-own OTEL** – forward traces and metrics to any OpenTelemetry collector (Grafana, Honeycomb, Datadog, etc.). ## Live logs from the CLI ```bash theme={null} # Tail logs (newest first) mcp-agent cloud logger tail app_abc123 # Follow in real time mcp-agent cloud logger tail app_abc123 --follow # Filter and limit mcp-agent cloud logger tail app_abc123 \ --since 30m \ --grep "ERROR|timeout" \ --limit 200 \ --format json ``` Options: * `--since 5m | 2h | 1d` – relative duration. * `--grep "pattern"` – regex filtering. * `--format text|json|yaml` – machine-readable output for automation. * `--order-by timestamp|severity` + `--asc/--desc` – sort order (non-follow mode). > Pro tip: Pipe JSON output into `jq` for structured analysis:\ > `mcp-agent cloud logger tail app_abc123 --format json --limit 200 | jq '.message'` ## Configure your own OTEL endpoint Forward logs and traces to your collector: ```bash theme={null} mcp-agent cloud logger configure https://otel.example.com:4318/v1/logs \ --headers "Authorization=Bearer abc123,X-Org=lastmile" ``` * `--test` validates the current configuration without saving. * The command writes OTEL settings back into your project’s `mcp_agent.config.yaml` for portability. ### Sample OTEL configuration ```yaml mcp_agent.config.yaml theme={null} otel: enabled: true service_name: web-summarizer sample_rate: 1.0 exporters: - type: otlp protocol: http/protobuf endpoint: https://otel.example.com:4318 headers: Authorization: "Bearer ${OTEL_API_TOKEN}" ``` Set `OTEL_API_TOKEN` in your deployment secrets to keep credentials secure. ## Instrumentation inside your app The logging and tracing helpers automatically annotate spans with MCP metadata (tool names, agent names, token counts). Supplement with custom attributes: ```python theme={null} context.logger.info( "Planner completed", data={"plan_steps": len(plan), "user": context.session_id}, ) from mcp_agent.tracing.telemetry import record_attribute record_attribute("workflow.stage", "summarize") ``` When using AugmentedLLM classes, request/response payloads and tool invocations are automatically traced (provider, model, max tokens, tool call IDs). ## Temporal workflow insights * `mcp-agent cloud workflows describe` prints Temporal status, history length, retries, and memo. * Enable the Temporal Web UI (coming soon) or connect to your own instance if you self-host. * For long workflows, log progress using `context.logger.info` so run history includes human-friendly breadcrumbs. ## Tracing examples Explore the tracing examples in the repository for end-to-end setups: * [`examples/tracing/agent`](https://github.com/lastmile-ai/mcp-agent/tree/main/examples/tracing/agent) – structured logs + spans for agent lifecycle. * [`examples/tracing/temporal`](https://github.com/lastmile-ai/mcp-agent/tree/main/examples/tracing/temporal) – demo with Temporal and OTEL collector. * [`examples/tracing/langfuse`](https://github.com/lastmile-ai/mcp-agent/tree/main/examples/tracing/langfuse) – integrate with Langfuse dashboards. ## Alerting and dashboards (BYO) Because telemetry is standardised on OTEL, you can: * Emit metrics to Prometheus/Grafana (set up an OTLP receiver and transform logs to metrics). * Send traces to Honeycomb/Langfuse for timeline analysis. * Export logs to Datadog or Splunk via OTLP → vendor-specific connectors. ## Best practices Add `data={...}` payloads to log calls. When streamed to OTEL, these become searchable attributes (e.g., `workflow_id`, `customer_id`, `plan_length`). Logs and traces can include LLM prompts/responses. Mask secrets before logging (`***`) or disable verbose logging in production. High-volume workflows may require sampling (`otel.sample_rate`). You can also implement custom sampling logic in code (e.g., only record traces for specific users or stages). Store run IDs or correlation IDs in workflow memo and include them in log messages. This makes it easier to pivot between CLI output, OTEL dashboards, and Temporal history. ## Next steps * [Deployment quickstart →](/cloud/deployment-quickstart) * [Long-running tools →](/cloud/mcp-agent-cloud/long-running-tools) * [mcp-agent SDK observability deep dive →](/mcp-agent-sdk/advanced/observability) # Deployment Overview Source: https://docs.mcp-agent.com/cloud/overview Deploy mcp-agent applications to production `mcp-agent` gives you one programming model that scales from a laptop to a managed cloud runtime. You can deploy full agents **and** standalone MCP servers (FastMCP services, ChatGPT App backends, bespoke tool APIs) without rewriting your app. This section maps the deployment options, explains when to reach for each path, and points to the detailed runbooks that follow. ## Why deploy with `mcp-agent`? * **One protocol everywhere** – every deployment option exposes the same MCP endpoints (`call_tool`, `read_resource`, `list_prompts`). Any MCP client (Claude, Cursor, ChatGPT Apps, custom SSE client) can connect without rewriting code. * **Durable workflows when you need them** – the same decorators (`@app.tool`, `@app.async_tool`, `@app.workflow`) run on `asyncio` locally and on Temporal in the cloud. Pause/resume, retries, and human-in-the-loop all come along for free. * **Operational guardrails** – the CLI manages build artifacts, secrets, auth configuration, client installation, and observability so you can focus on agent logic.