HHostSSH

mcp-kit

HostSSH MCP Kit

Tooling to build, run, and roll out MCP servers — with your proprietary tool logic protected. Dependency-free Go (stdlib only); a server/client is one static binary, 100% ours.

The model: protected server + thin client

  MCP host (Claude / agent)
        │  stdio (JSON-RPC)
        ▼
  hsmcp client  ──HTTPS + Bearer token──▶  your MCP server (on the fleet)
  (THIN: no IP)                              (PROTECTED: holds the tools)

Your tools' implementation lives only in the server, deployed on the fleet behind a token. The thin client is a stdio↔HTTP bridge you hand to any MCP host — it forwards JSON-RPC and carries no tool logic, so your IP never ships.

Build a server (the scaffold)

agent/cmd/hsmcp/main.go is the starter — it registers one echo tool. Replace it with your own, using internal/mcpkit:

s := mcpkit.NewServer("my-mcp", "1.0.0")
s.Register(mcpkit.Tool{
    Name: "my_tool", Description: "…",
    InputSchema: map[string]any{"type": "object", "properties": map[string]any{ /* … */ }},
    Handler: func(ctx context.Context, a map[string]any) (text string, isError bool) {
        // proprietary logic here — stays server-side
    },
})
s.ServeStdio(os.Stdin, os.Stdout)      // local dev
// or: http.ListenAndServe(addr, s.HTTPHandler(token))  // remote/protected

Run + roll out

# local dev (stdio)
hsmcp serve

# protected, remote (deploy this on the fleet)
hsmcp serve --http :7000 --token "$HSMCP_TOKEN"

Deploy the HTTP server as a normal HostSSH app — it's build→run→route-able:

hostssh deploy --name my-mcp --source <repo> --domain mcp.example.com --port 7000 \
  --env HSMCP_TOKEN=<secret>

Connect any MCP host through the thin client

Point Claude (or any MCP host) at the remote server via the thin bridge — no IP on the client:

// claude_desktop_config.json (or any MCP host config)
{
  "mcpServers": {
    "my-mcp": {
      "command": "hsmcp",
      "args": ["client", "--url", "https://mcp.example.com", "--token", "<secret>"]
    }
  }
}

What's here / next

  • ✅ internal/mcpkit — protocol (initialize/tools.list/tools.call/ping), tool registry, stdio + HTTP transports, the thin-client bridge. Panic-isolated.
  • ✅ cmd/hsmcp — serve (stdio/HTTP) + client (thin bridge).
  • ⬜ Next: hsmcp new <name> generator, an mcp-server deploy template, a control-plane MCP registry, and growing the agent's own MCP tool surface.