mcphostBLOCK
Hosted MCP runtime where the agent is the operator: sign up by tool call, publish your own tools.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
where agents host their own tools · mcphost.dev · status · llms.txt · llms-install.md
Find it in the registry: dev.mcphost/mcphost — connect with the one-URL quickstart at mcphost.dev.
Ship an MCP tool, not a deployment project.
mcphost lets an agent create the tool it needs, mid-task, without a human in the loop: sign up with one unauthenticated tool call, publish with the next, and the new tool is live immediately — no restart, no deploy, no review queue.
Measured (panel run 0.26.3-20260908T085001Z, 21 sessions): median time from signup to a tenant's first successful host.tool.publish is 30.7s; median time from signup to a successful call on that tenant's own tool is 42.4s.
Quickstart for agents
- Connect to
https://mcphost.dev/mcp-- paste that URL into your MCP
client's config. No signup call, no credentials, nothing to paste into a header.
- Make your first call.
host.quickstart()is read-only and hands back
a worked example before you commit to anything; any other host.*/ billing.* call creates your tenant right then, on this connection, with no signup call at all -- host.whoami() is the simplest:
host.whoami()
- Read
onboarding.urlonce, in that same response, and save it -- it's
this tenant's own address and its credential in one; reconnecting through it later is how you come back as this same tenant. onboarding.memory_hint names where agents conventionally keep it.
- Publish a tool.
host.quickstart()'s ownstarter_toolis a
ready-to-publish python spec; its publish_call is exactly:
host.tool_publish(nam
31dc3a959a36OBSERVED · 2026-10-11Trust audit
BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
KindError::Exec(m) => AppError::Internal(m),
other => KindError::Exec(other.to_string()),
other => Err(KindError::Exec(format!(
KindError::Exec(m) => ("exec", m.clone(), Value::Null),.map_err(|e| KindError::Exec(format!("dns resolver init: {e}")))?;BindPlan::Inherited { port, .. } => format!("http://127.0.0.1:{port}"),public_url: "http://127.0.0.1:0".to_string(),
let redirect_uri = "http://127.0.0.1/oauthconf-step-up-probe-cb";
const ACCESS_TOKEN: &str = "xoxp-test-access-token-abc123";
const REFRESH_TOKEN: &str = "xoxp-test-refresh-token-def456";
const ACCESS_TOKEN: &str = "xoxp-vaultst-ac01-access-token";
const REFRESH_TOKEN: &str = "xoxp-vaultst-ac01-refresh-token";
book.xlsx
csvs.zip
doc.docx
utf16be_bom.csv
utf16le_bom.csv
.burst-lane.toml
const SOURCE: &str = "import importlib\n\n\ndef main(args):\n importlib.import_module(\"mcphost_sdk\")\n return {\"ok\": True}\n";const DYNAMIC_SOURCE: &str = "import importlib\n\n\ndef main(args):\n name = \"mcphost\" + \".\" + \"dev\"\n importlib.import_module(name)\n return {\"ok\": True}\n";("echo", include_str!("../../docs/kinds/echo.md")),("http", include_str!("../../docs/kinds/http.md")),("python", include_str!("../../docs/kinds/python.md")),("wasm", include_str!("../../docs/kinds/wasm.md")),super::docs::parse_kind_doc(include_str!("../../docs/kinds/echo.md"))Gates applied: no_behavioural_pass.
31dc3a959a36full audit observations/trust-audit/mcp-server/j0yen__mcphost.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 31dc3a959a36 | BLOCK | F | 47 | first audit |
Questions
What is the mcphost MCP server?
Hosted MCP runtime where the agent is the operator: sign up by tool call, publish your own tools.
Is mcphost safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (47/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does mcphost need?
It reads DOCS_QA_EMBED_SECRET_VALUE, SECRET_SELF_KEY and SECRET_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mcphost run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (31dc3a959a36), read on 2026-10-11. The repository is watched and re-audited when it changes.