[{"data":1,"prerenderedAt":205},["ShallowReactive",2],{"seo-verification":3,"blog-how-to-deploy-an-mcp-server-on-a-vps-ma-en":6,"promo-bar-likely":204},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-how-to-deploy-an-mcp-server-on-a-vps-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":145,"ctaBody":146,"ctaButton":147,"ctaUrl":148,"relatedPosts":149},214,"how-to-deploy-an-mcp-server-on-a-vps",{"fr":12,"en":10,"ar":13,"es":14},"mcp-serveur-ia-auto-heberge-vps","كيفية-نشر-خادم-mcp-على-vps","desplegar-servidor-mcp-en-un-vps","Deploy a Self-Hosted MCP Server on a VPS","Complete guide to deploying, securing and integrating an MCP server on your VPS: nginx, TLS, authentication, troubleshooting and connection to Claude Desktop.",8,4,false,"2026-08-03T00:00:00+00:00","2026-10-20T23:18:06+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},1,"Artificial Intelligence","intelligence-artificielle","bg-purple-500\u002F10 text-purple-400","ia",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fmcp-serveur-ia-auto-heberge-vps-poster.svg","The MCP protocol (Model Context Protocol) has become the standard layer for connecting an AI agent to your tools: databases, file systems, internal APIs. Hosting this server on your own VPS gives you full control over the data processed, latency and costs. This guide covers installation, production security, integration with Claude Desktop and Cursor, and the most common errors.",[35,39,48,51,85,89,99,102,105,139,142],{"type":36,"title":37,"body":38},"h2","Why host your own MCP server","Third-party hosted MCP services introduce an external dependency: your data, prompts and contexts pass through infrastructure you do not control. On a VPS, the MCP server runs in your network, with your access rules and your chain of trust. This is the same logic as self-hosting a Git repository or a Docker registry: autonomy takes precedence over convenience.",{"type":40,"title":41,"items":42},"ul","What you gain by self-hosting",[43,44,45,46,47],"Data confidentiality: no context leaves your infrastructure.","No third-party round-trip: the MCP server and your application run on the same network or on neighbouring VPS instances.","Full customisation: in-house tools, proprietary connectors, tailor-made runtime environment.","Predictable cost: a fixed VPS subscription, with no per-call billing.","Version control: you decide when to update the server and its dependencies.",{"type":36,"title":49,"body":50},"Prerequisites before you start","You need a VPS with root access, a recent Linux distribution (Ubuntu 22.04 LTS or Debian 12 are recommended), Node.js 18+ or Python 3.11+ depending on the implementation chosen, and a domain name pointing to your server's IP. A plan with at least 1 vCPU and 2 GB of RAM is suitable for a moderately used MCP server. For heavy loads or multiple MCP servers in parallel, plan for 2 vCPU and 4 GB.",{"type":52,"title":53,"steps":54},"steps","Deploy an MCP server in 10 steps",[55,58,61,64,67,70,73,76,79,82],{"title":56,"body":57},"Update the system and install Node.js","Connect via SSH with your key and run `apt update && apt upgrade -y`. Install Node.js from the official NodeSource repository: `curl -fsSL https:\u002F\u002Fdeb.nodesource.com\u002Fsetup_20.x | bash - && apt install -y nodejs`. Verify with `node -v` and `npm -v`.",{"title":59,"body":60},"Create a dedicated user","Never run the MCP server as root. Create an application user: `useradd -m -s \u002Fbin\u002Fbash mcp && su - mcp`. All subsequent commands run under this user.",{"title":62,"body":63},"Clone and install the MCP server","Choose your implementation (see the 'Recommended open source MCP servers' section below). For `@modelcontextprotocol\u002Fserver-filesystem`: `npm install -g @modelcontextprotocol\u002Fserver-filesystem`. Test locally: `npx @modelcontextprotocol\u002Fserver-filesystem \u002Ftmp\u002Ftest`.",{"title":65,"body":66},"Create a systemd service file","Create `\u002Fetc\u002Fsystemd\u002Fsystem\u002Fmcp-server.service` with the directives `User=mcp`, `ExecStart=\u002Fusr\u002Fbin\u002Fnpx @modelcontextprotocol\u002Fserver-filesystem \u002Fhome\u002Fmcp\u002Fdata`, `Restart=always` and `Environment=NODE_ENV=production`. Enable and start: `systemctl enable --now mcp-server`.",{"title":68,"body":69},"Install nginx","Nginx acts as a reverse proxy in front of your MCP server. `apt install -y nginx`. Create a vhost in `\u002Fetc\u002Fnginx\u002Fsites-available\u002Fmcp` with a `location \u002F` that does `proxy_pass http:\u002F\u002F127.0.0.1:3000;` and the headers `proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr;`. Enable: `ln -s \u002Fetc\u002Fnginx\u002Fsites-available\u002Fmcp \u002Fetc\u002Fnginx\u002Fsites-enabled\u002F && nginx -t && systemctl reload nginx`.",{"title":71,"body":72},"Obtain a TLS certificate with Certbot","`apt install -y certbot python3-certbot-nginx && certbot --nginx -d your-domain.com`. Certbot automatically modifies your nginx vhost to redirect HTTP to HTTPS and sets up automatic renewal. Verify renewal: `certbot renew --dry-run`.",{"title":74,"body":75},"Enable Bearer authentication","Edit your nginx vhost to require a token in the HTTP header: `if ($http_authorization != 'Bearer YOUR_SECRET_TOKEN') { return 401; }`. Generate a strong token with `openssl rand -hex 32`. Keep this token: it will be entered in your AI client configuration.",{"title":77,"body":78},"Configure the firewall","Close all ports except 22, 80 and 443: `ufw allow 22\u002Ftcp && ufw allow 80\u002Ftcp && ufw allow 443\u002Ftcp && ufw enable`. The internal port of the MCP server (3000 by default) must never be exposed directly.",{"title":80,"body":81},"Test the endpoint with curl","`curl -H 'Authorization: Bearer YOUR_SECRET_TOKEN' https:\u002F\u002Fyour-domain.com\u002Fhealth`. You should get a status JSON. A 401 response indicates an incorrect token; a 502 response indicates the systemd service is not running (`systemctl status mcp-server`).",{"title":83,"body":84},"Enable nginx access logs","Add to your vhost: `access_log \u002Fvar\u002Flog\u002Fnginx\u002Fmcp_access.log; error_log \u002Fvar\u002Flog\u002Fnginx\u002Fmcp_error.log warn;`. These logs are essential for detecting unauthorised calls or request loops. Rotate them with logrotate to avoid filling the disk.",{"type":86,"title":87,"body":88},"tip","Always enable nginx access logs for your server","An MCP server receives machine-to-machine calls: without logs, you cannot detect unauthorised access attempts or integration bugs. Also configure `log_format` to record the truncated `Authorization` header (the first 8 characters are enough to identify the source without exposing the full token).",{"type":40,"title":90,"items":91},"Recommended open source MCP servers",[92,93,94,95,96,97,98],"`@modelcontextprotocol\u002Fserver-filesystem` — controlled access to the file system, reading and writing local files. Ideal for giving an agent access to a working directory.","`@modelcontextprotocol\u002Fserver-git` — clone, log, diff, commit via a local repository. Allows an agent to read history or create branches.","`@modelcontextprotocol\u002Fserver-fetch` — delegates outbound HTTP requests to the MCP server, bypassing client network restrictions.","`@modelcontextprotocol\u002Fserver-postgres` — connection to a PostgreSQL database: SELECT queries, schema, describe table. Do not expose for writing without auditing permissions.","`@modelcontextprotocol\u002Fserver-playwright` — control of a headless Chromium browser from the agent: screenshot, click, form filling.","`mcp-server-sqlite` (community) — lightweight alternative for local SQLite databases, without PostgreSQL dependency.","`mcp-obsidian` (community) — access to an Obsidian vault, useful for Markdown knowledge bases.",{"type":36,"title":100,"body":101},"Securing your MCP server in production","An MCP server exposed on the Internet is an attack surface. Four measures are non-negotiable before connecting an AI client to this server in production.\n\n**Bearer token authentication.** Enter a unique token per client in the `Authorization` header. Immediately revoke a compromised token and generate a new one with `openssl rand -hex 32`. Do not reuse the same token for multiple clients: you will lose traceability.\n\n**nginx rate-limiting.** Add to your vhost: `limit_req_zone $binary_remote_addr zone=mcp:10m rate=30r\u002Fm; limit_req zone=mcp burst=10 nodelay;`. This limits to 30 requests per minute per IP, with a burst of 10. Adjust according to your actual usage.\n\n**Mandatory HTTPS and HSTS.** After installing Certbot, add in the HTTPS `server` block: `add_header Strict-Transport-Security \"max-age=31536000\" always;`. This prevents clients from connecting over plain HTTP even if they try.\n\n**Token rotation.** Schedule a rotation every 90 days via cron or your secrets management tool. Document each active token and its associated client in a private registry (not in the code repository).",{"type":36,"title":103,"body":104},"Integrating Claude Desktop and Cursor with your MCP server","Once the server is online and secured, connecting from an AI client takes less than two minutes.\n\n**Claude Desktop.** Open `~\u002FLibrary\u002FApplication Support\u002FClaude\u002Fclaude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows). Add an entry in the `mcpServers` key:\n\n```json\n{\n  \"mcpServers\": {\n    \"my-vps\": {\n      \"url\": \"https:\u002F\u002Fyour-domain.com\",\n      \"headers\": {\n        \"Authorization\": \"Bearer YOUR_SECRET_TOKEN\"\n      }\n    }\n  }\n}\n```\n\nRestart Claude Desktop. The server appears in the list of available tools.\n\n**Cursor.** In settings (`Cursor > Settings > MCP`), click 'Add server', choose the `HTTP` type, enter the URL and add the `Authorization` header. Cursor automatically injects MCP tools into the context of each conversation.\n\n**Verification.** Ask the agent to list available tools. If the filesystem server is active, the response should include `read_file`, `write_file` and `list_directory`. The absence of these tools indicates a configuration error — check the nginx logs first.",{"type":106,"title":107,"rows":108,"headers":134},"comparison","MCP vs REST API vs WebSocket for AI agents",[109,114,119,124,129],[110,111,112,113],"Communication model","Typed tool calls, dynamic schema discovery","Stateless HTTP request\u002Fresponse, OpenAPI contract","Persistent bidirectional channel, real-time events",[115,116,117,118],"Native integration with LLMs","Native: Claude, Cursor, Cline, Continue read the MCP schema directly","Requires a function-calling wrapper or plugin","Requires an adapter on the agent side",[120,121,122,123],"Deployment complexity","Low: one Node\u002FPython process, one nginx vhost","Low to medium: standard REST framework","Medium to high: connection management, reconnection, state",[125,126,127,128],"Suited for","Local tools, file access, databases, agent automation","Third-party integrations, webhooks, existing microservices","Push notifications, real-time collaboration, streaming",[130,131,132,133],"Versioning and evolution","Schema declared in the server, auto-discovered by the client","Explicit versioning in the URL or header","Application protocol to be managed manually",[135,136,137,138],"Criterion","MCP","REST API","WebSocket",{"type":36,"title":140,"body":141},"Troubleshooting: 4 common errors","**1. `MCP transport error: Failed to fetch`**\nThis message appears in Claude Desktop or Cursor when the client cannot reach the configured URL. Common causes: the systemd service is not running (`systemctl status mcp-server`), nginx has not been reloaded after modifying the vhost (`nginx -t && systemctl reload nginx`), or a firewall is blocking port 443 (`ufw status`).\n\n**2. `Connection refused on 127.0.0.1:3000`**\nThe MCP server did not start or crashed at startup. Check the systemd logs: `journalctl -u mcp-server -n 50`. Common causes are an invalid JSON configuration file, a missing npm dependency (`npm install` to re-run in the project directory) or a port already in use (`ss -tlnp | grep 3000`).\n\n**3. `Request timed out after 30000ms`**\nThe server responds but too slowly. On a filesystem tool, this happens if the directory being scanned is too large or the disk is full (`df -h`). For a postgres tool, check that the query is not doing a full scan on a table without an index. Increase the nginx timeout as a last resort: `proxy_read_timeout 120s;`.\n\n**4. `401 Unauthorized` systematically**\nThe token sent by the client does not match the one expected by nginx. Check the token accuracy in the client configuration (trailing space, quotes accidentally included). If you have just renewed the token server-side, restart nginx and reload the AI client configuration.",{"type":36,"title":143,"body":144},"Towards a complete AI environment on your VPS","An MCP server is one component among many in a self-hosted AI environment. On the same VPS, you can run a local model via Ollama, a vector database like Qdrant or Chroma, and an orchestrator like n8n or Flowise — each connected to the MCP server via dedicated tools. ServOrbit offers ready-to-use VPS templates for these environments, installable in a few clicks from the Marketplace, on infrastructure hosted in European data centres with dedicated IPv4 and root access.","Your MCP server deserves reliable infrastructure","Deploy your MCP server on a ServOrbit VPS: dedicated resources, static IPv4, on-demand snapshots. Starting at 99 DH\u002Fmonth.","View VPS plans","\u002Fvps-cloud",[150,168,186],{"id":23,"slug":151,"slugs":152,"title":156,"excerpt":157,"readTime":158,"views":23,"isPinned":19,"noindex":19,"publishedAt":159,"updatedAt":160,"category":161,"categories":162,"featuredImage":30,"bgImage":31,"posterImage":164,"relatedSolution":165},"how-to-host-open-webui-on-a-vps",{"fr":153,"en":151,"ar":154,"es":155},"heberger-open-webui","كيفية-استضافة-open-webui-على-خادم-vps","como-alojar-open-webui-en-un-vps","How to Host Open WebUI on a VPS","A complete guide to deploying Open WebUI on your own VPS. Keep control of your data, avoid cloud API costs, and access your LLMs from a clean web interface.",9,"2026-06-01T00:00:00+00:00","2026-11-09T20:55:18+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[163],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fheberger-open-webui-poster.svg",{"categorySlug":166,"appSlug":167},"artificial-intelligence","open-webui",{"id":169,"slug":170,"slugs":171,"title":175,"excerpt":176,"readTime":177,"views":23,"isPinned":19,"noindex":19,"publishedAt":178,"updatedAt":179,"category":180,"categories":181,"featuredImage":30,"bgImage":31,"posterImage":183,"relatedSolution":184},2,"deploying-dify-on-a-vps-ai-workflows-under-control",{"fr":172,"en":170,"ar":173,"es":174},"deployer-dify-vps","نشر-dify-على-vps-سير-عمل-الذكاء-الاصطناعي-تحت-السيطرة","desplegar-dify-en-un-vps","Deploy Dify on a VPS: Complete Guide from Installation to Plugins","Install Dify on a ServOrbit VPS: requirements, Docker Compose, offline plugins, known Docker limits, backup before upgrading, and troubleshooting.",15,"2026-02-11T00:00:00+00:00","2026-10-29T03:10:23+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[182],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fdeployer-dify-vps-poster.svg",{"categorySlug":25,"appSlug":185},"dify",{"id":187,"slug":188,"slugs":189,"title":193,"excerpt":194,"readTime":195,"views":169,"isPinned":19,"noindex":19,"publishedAt":196,"updatedAt":197,"category":198,"categories":199,"featuredImage":30,"bgImage":31,"posterImage":201,"relatedSolution":202},122,"host-hermes-agent-on-a-vps",{"fr":190,"en":188,"ar":191,"es":192},"heberger-hermes-agent-vps","استضافة-hermes-agent-على-خادم-vps","alojar-hermes-agent-en-un-vps","Host Hermes Agent on a VPS","Host Nous Research's Hermes Agent on your VPS: the self-learning open source AI agent that remembers you. Guide to the Docker build, LLM configuration and memory backup.",3,"2026-02-22T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[200],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fheberger-hermes-agent-vps-poster.svg",{"categorySlug":166,"appSlug":203},"hermes",true,1794270422119]