Hosting an MCP Connector for ChatGPT and Claude on a VPS or Dedicated Server

The Model Context Protocol (MCP) is an open standard that lets an AI assistant such as ChatGPT or Claude call your own tools and data through a defined interface. A remote MCP connector is a small web service you host and the assistant connects to over HTTPS. You can run one on Ultra Web Hosting two ways: on a managed cPanel account, where you build the connector and we configure the server-level pieces it needs, or on a VPS or dedicated server with root, where you run and configure everything yourself. This guide covers both, including the streaming, OAuth, and token-storage details that make an MCP connector work.

01. What an MCP Connector Is, and the Two Hosting Models

A remote MCP connector has three parts: a public HTTPS endpoint (for example https://mcp.yourdomain.com/mcp) that speaks the MCP Streamable HTTP transport; an OAuth layer so only your authorized ChatGPT or Claude workspace can connect; and the connector logic, the MCP tools you define, which call an upstream API (a CRM, database, or SaaS) over outbound HTTPS using credentials stored on the server.

MCP's Streamable HTTP transport keeps HTTP connections open and streams events back as they happen. That one requirement, streaming without buffering or early timeouts, is what shapes how you host it:

If you are choosing a plan, article #481 compares the tiers. Section 02 is the managed path; Sections 03 onward add the root-server detail.

02. Managed cPanel: What You Build, What We Configure

On a managed cPanel account you do not touch the server. You build and deploy the connector; we set the parts that need root. This is how we set an MCP connector up for managed clients.

What you do:

1. Run the connector as a Node app in cPanel's Setup Node.js App (see article #487). Build your MCP tools against an official MCP server SDK and expose the endpoint path (for example /mcp).
2. Put your upstream credentials in the app's environment variables in the Setup Node.js App panel, never in your code.
3. Create a MySQL database in cPanel for the rotating upstream tokens (see Section 06), and add a database user to it (article #122).
4. Connect to your account over a jailed SSH key to deploy and manage your code. We authorize your public key on your account; the hostname and port are in your SSH access email.

What we configure for you, from a support ticket:

• Unbuffered streaming for your connector endpoint, so MCP streams are not held back or cut off. This is a server-level reverse-proxy setting a jailed account cannot change.
• Outbound HTTPS to your upstream API, if it is not already open.
• SSL for the connector hostname.

Sections 05 through 08 (OAuth, token storage, outbound access, and connecting the assistant) apply to both models. If you are on a managed account, you can skip the root-server detail in Sections 03 and 04.

03. Root Server: Run It Yourself

On a VPS or dedicated server with root, an MCP connector is a NodeJS service you run and front yourself. First stand up the base deployment described in the companion guide, "Running a Persistent NodeJS Service on a VPS or Dedicated Server": a systemd-managed Node app bound to localhost, nginx with a Let's Encrypt certificate in front, the firewall opened for 80 and 443 and your SSH port, and secrets in a root-owned environment file. Everything below adds the MCP-specific pieces on top of that base.

Use an official MCP server SDK rather than writing the protocol by hand. The MCP TypeScript SDK provides a Streamable HTTP transport you mount on an Express route; define your tools against it and point the route at /mcp.

04. The Critical Part: Unbuffered Streaming

This is the single most common thing that breaks a remote MCP connector. By default a reverse proxy buffers responses, so streamed events are held back until the response is complete. The assistant sees nothing, then times out. On a managed account we set this for you (Section 02). On a root server you configure it in nginx yourself, by adding a dedicated location to your server block:

server {
    listen 443 ssl;
    server_name mcp.yourdomain.com;
    # ssl_certificate / ssl_certificate_key added by Certbot

    location /mcp {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;

        # --- Streaming essentials ---
        proxy_buffering off;              # send bytes through as they arrive
        proxy_cache off;
        proxy_set_header Connection '';   # keep the upstream connection alive
        chunked_transfer_encoding on;

        # Do not cut off long-lived or idle streams
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;

        # Standard forwarding headers
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Test and reload after editing:

nginx -t && systemctl reload nginx

05. Protect Access with OAuth

A remote MCP endpoint is on the public internet, so it must require authentication. This applies to both models. Both ChatGPT and Claude connect to remote connectors as OAuth clients: when you add the connector, the assistant walks the user through an OAuth sign-in, then presents a bearer token on every MCP request. The current MCP authorization specification is built on OAuth 2.1.

You have two practical options:

• Delegate to an identity provider. Front the connector with an existing OAuth or OIDC provider (Auth0, Okta, Google, or your own) and validate the incoming bearer token in middleware before any MCP handler runs. This is the recommended path, because you are not writing your own token issuance.
• Implement the OAuth endpoints yourself. Only do this if you have a specific reason to. The protocol surface (authorization server metadata, dynamic client registration, PKCE) is easy to get subtly wrong, and mistakes here are security-critical.

Whichever you choose, reject any request to /mcp that does not carry a valid, unexpired token, before it reaches your tools.

06. Store Rotating Upstream Tokens

Separately from the OAuth that protects your endpoint, the connector needs its own credentials to call the upstream API. Many APIs issue short-lived access tokens with a refresh token, so the connector must persist the current tokens and refresh them on a schedule. It cannot rely on an in-memory value that is lost on restart. Use a database.

• Managed cPanel: create a MySQL database in cPanel and a database user (article #122). Store the connection details in the Node app's environment variables.
• Root server: you can run PostgreSQL or MySQL on the box, bound to localhost, and keep the connection string in the root-owned environment file.

Keep the rotating access and refresh tokens in a table, read them at call time, and write the new pair back whenever you refresh. That way a restart or redeploy never loses the upstream session. Keep static client credentials (client ID and secret) in environment variables, not in code.

07. Allow Outbound HTTPS

The connector calls the upstream API over HTTPS, so outbound port 443 must be allowed. On a managed cPanel account, if an outbound connection is blocked, open a ticket and we will allow it. On a root server, confirm 443 is present in TCP_OUT in /etc/csf/csf.conf (the companion NodeJS guide has the full firewall section), then reload with csf -r.

08. Connect ChatGPT or Claude

With the endpoint live, OAuth enforced, and streaming working, add it in the assistant:

• Claude: add a custom connector in settings and enter your MCP server URL (https://mcp.yourdomain.com/mcp). You are sent through your OAuth sign-in.
• ChatGPT: add a custom connector (available on plans that support them) pointing at the same URL, again completing the OAuth flow.

Before adding it, sanity-check the endpoint from your own machine. A well-formed MCP initialize call should return promptly and stream rather than hang:

curl -i https://mcp.yourdomain.com/mcp \
  -H "Authorization: Bearer YOUR_TEST_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

If this hangs with no output and then times out, streaming is still buffered. On a root server, revisit the nginx location in Section 04. On a managed account, open a ticket so we can check the server-side setting.

09. Troubleshooting

• Stream hangs then times out. Buffering is still on, or an upstream proxy such as Cloudflare is buffering. On a root server confirm proxy_buffering off; on a managed account open a ticket. Keep the MCP subdomain unproxied.
• Connection drops after about 60 seconds. The read or send timeout is too short for idle streams. Raise it on a root server, or ask us to on a managed account.
• 401 or repeated sign-in loops. Token validation or OAuth metadata is misconfigured. Check that the bearer token is accepted and not expiring immediately.
• Upstream calls fail only after a redeploy. Tokens were held in memory. Persist them in the database and reload them on startup.
• 502 Bad Gateway. The Node app is down or not listening on the expected port. On a root server check systemctl status myapp and journalctl -u myapp -f; on a managed account restart the app in Setup Node.js App and check its log.

Quick Recap: An MCP Connector in Six Steps

If you only remember six things from this guide, remember these:

1. Pick your model: managed cPanel (you build, we configure the server side) or a root server (you run everything).
2. Run the connector as a Node app exposing one MCP endpoint, built against an official MCP SDK.
3. Make streaming unbuffered: we set this for you on a managed account, or you set proxy_buffering off in nginx on a root server.
4. Require OAuth on the endpoint, ideally by validating tokens from an existing identity provider, and reject any request without a valid token.
5. Keep rotating upstream tokens in a database (cPanel MySQL or your own), read them at call time, and write refreshed tokens back.
6. Add the URL in ChatGPT or Claude, complete the OAuth flow, and verify an initialize call streams rather than hangs.

Last updated October 2026 · Browse all Getting Started articles