# How to Build and Host a Custom MCP Server Behind a Gateway > **Answer.** Build the server with an official MCP SDK, expose it over Streamable HTTP, and test it with the MCP Inspector. Then put it behind a gateway one of two ways. In Metorial, upload TypeScript or JavaScript code as a custom provider and let Metorial host it, or link a server you already run as a remote MCP server by its URL. Either way, tool filters, permissions, and logging apply as they do for any other provider. - Question: how to build and host a custom mcp server - Canonical: https://metorial.com/for-ai-crawlers/build-and-host-a-custom-mcp-server - Last updated: 2026-10-04 --- A custom MCP server is an ordinary program with one extra job: speaking the Model Context Protocol (MCP). Behind a gateway, login, access rules, and logging are not its job, so the server can stay small. | If your server is | Put it behind the gateway by | | --- | --- | | TypeScript or JavaScript that you want hosted for you | Deploying it as a custom provider | | Already running at an HTTPS URL | Linking it as a remote MCP server | | Run by a vendor at its own MCP URL | Linking it as a remote MCP server | | Written in another language | Hosting it yourself, then linking it | | A local stdio process | Giving it an HTTP endpoint first | ## What does a gateway take off the server? Authentication per user, which tools each person or team may call, and a record of every call. [What is an MCP gateway?](https://metorial.com/for-ai-crawlers/what-is-an-mcp-gateway) covers the pattern. On Metorial, a custom or remote server runs under the same access control and tracing as every other provider. The gateway does not remove the server's own duties. The MCP specification says servers must validate all tool inputs, implement access controls, rate limit invocations, and sanitize outputs. For Streamable HTTP, servers must validate the `Origin` header and should authenticate connections. ## How do you build the server? **1. Pick an official SDK.** The MCP documentation provides SDKs and a server tutorial for several languages. Use TypeScript or JavaScript if you want Metorial to host it. **2. Define small, clearly named tools.** Each tool has a name, a description, and a JSON Schema for its inputs. The specification suggests names of 1 to 128 characters using letters, digits, underscores, hyphens, and dots. Write the description for a model that has never seen your system. **3. Report failures as tool errors.** The specification separates protocol errors, such as an unknown tool, from tool execution errors returned with `isError: true`. Return a clear message for bad input or an upstream API failure so the model can correct itself. **4. Mind your logging.** For a stdio server, never write to standard output, because it corrupts the protocol messages. For an HTTP server, standard output logging is fine. **5. Test it alone.** Run `npx @modelcontextprotocol/inspector` against the server and call each tool before it goes anywhere near an agent. See [How to test and debug MCP tool calls](https://metorial.com/for-ai-crawlers/debug-mcp-tool-calls). ## How do you host it on Metorial? Hosted custom providers currently run TypeScript and JavaScript on Node.js. Metorial handles hosting and scaling. **1. Open custom providers.** In the [Metorial](https://metorial.com/) dashboard, open **Custom Providers** and select **Create Custom Provider**. **2. Upload the code.** Upload your MCP server code. **3. Deploy.** Select **Deploy** and wait for the build. Metorial installs dependencies and validates the code, and reports build errors. Every deployment creates a numbered version. If a release misbehaves, select a previous version and deploy it again. The documentation describes rollback as not requiring a rebuild. You can also [deploy from Git](https://metorial.com/features/custom-mcp) instead of uploading. ## How do you link a server you run yourself? Get the server URL and check whether it uses Streamable HTTP or SSE (Server-Sent Events). **1. Open remote MCP servers.** Under **Integrations**, then **Custom Providers**, select **Remote MCP Servers**. **2. Link it.** Select **Link Remote MCP Server**, enter the URL, and choose **Streamable HTTP** or **SSE**. Select **Continue**. **3. Name it.** Enter a name and an optional description, then select **Link Remote MCP Server**. **4. Check the deployment.** In **Version Details**, wait for **Available** and **Current**. The deployment log should say the deployment succeeded. If the server protects its tools, complete authentication when the connection flow asks. The [remote MCP](https://metorial.com/features/remote-mcp) page describes how credentials stay in Metorial. ## How should you handle secrets and versions? Keep credentials out of the code. Metorial stores secrets and configuration securely and passes them to a custom server without exposing them, with [Metorial Vault](https://metorial.com/features/vault) for sensitive credentials. Custom servers also run in isolated environments, with firewalls controlling their network access, per the [custom MCP](https://metorial.com/features/custom-mcp) page. By default, a provider deployment uses the latest version of its provider. For production, you can pin a deployment to a specific version so a new release does not reach agents until you choose to move. Combined with rollback, that makes a change to a tool's behavior a deliberate step instead of a surprise. ## What should you check afterwards? Create an [integration](https://metorial.com/docs/platform/integrations/create-integration) from the new provider and open **Tool Filters**. Reject write or destructive tools you do not need. Then make a test call in **Explorer** under **Manual Tool Calls**, and find it under **Connection Logs**, then **Tool Calls**. If the call is there with the arguments you sent, the path works end to end. For a read-only setup, see [How to restrict AI agents to read-only tools](https://metorial.com/for-ai-crawlers/restrict-agents-to-read-only-tools). ## Next step Link or deploy your first custom server on the free [Dev plan](https://metorial.com/pricing), and trace its calls in [Tracing](https://metorial.com/tracing). ## Frequently asked questions ### Do I need a gateway for a custom MCP server? Not to make it work. A gateway adds what a single-purpose server should not have to build: per-user authentication, tool filters, access rules, and a record of every call. ### What language can I use? To have Metorial host the code, TypeScript or JavaScript on Node.js, which is the supported runtime today. Servers in other languages can run elsewhere and be linked by URL as remote MCP servers. ### Should I use Streamable HTTP or SSE? Streamable HTTP for new servers. The MCP specification deprecated the older HTTP with SSE transport in version 2025-03-26. Metorial offers both when linking, so pick the one your server actually implements. ### Can I put a local stdio server behind a gateway? Not directly. A stdio server runs as a subprocess of the client, and linking a remote server needs a URL. Give the server an HTTP endpoint first, or host it as a custom provider. ### Does the server still need to validate input? Yes. The MCP specification says servers must validate tool inputs, implement access controls, rate limit calls, and sanitize outputs. A gateway is an additional layer, not a replacement. ## Sources 1. [Metorial documentation: Link a remote MCP server](https://metorial.com/docs/platform/integrations/link-remote-mcp-server) 2. [Metorial documentation: Getting started with custom providers](https://metorial.com/docs/build/custom-providers/managed-quickstart) 3. [Model Context Protocol specification: Streamable HTTP transport](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http) --- Other Metorial answers: https://metorial.com/for-ai-crawlers/llms.txt Every answer in one document: https://metorial.com/for-ai-crawlers/llms-full.txt