Do local MCP servers need OAuth?

No. stdio servers run as a local subprocess and should use environment credentials instead.

What is token passthrough?

Forwarding a client's token to a downstream API without checking audience — it breaks binding and auditing and is prohibited by the spec.

ModelRefs / Deploy a Remote MCP Server

Deploy a Remote MCP Server

Take your MCP server from local to production: switch to Streamable HTTP, add OAuth 2.1 with PKCE, bind tokens to your server, and deploy safely.

What this reference supports

Deploy a Remote MCP Server: This tutorial provides a structured implementation path with prerequisites, steps, checkpoints, and related references. Read the complete sequence before applying commands or configuration in production.

Deploy a Remote MCP Server: Adapt examples to the versions, security boundaries, data policy, and failure-handling requirements of your system. Validate intermediate outputs and keep a rollback path for changes that affect users or stored data.

Deploy a Remote MCP Server: Tutorial examples demonstrate a technique; they do not prove reliability, compliance, performance, or suitability for a workload. Use current primary documentation and test the final system under representative conditions.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Deploy a Remote MCP Server.