Skip to content

Connect Claude web

To use your self-hosted server from Claude web (or any remote MCP client), run it over HTTP. The server will not start on HTTP without authentication — you choose a bearer token or OAuth.

Signing on a remote server

A hosted server can't open your local browser, so:

  • Use a KMS signer for unattended signing, or
  • Use a remote-browser flow if your app serves a sign page and users bring their own wallet.

See the signing-modes matrix. Whichever you pick, keep spend caps on — there's no human approving each trade with a KMS signer.

Turn the server into its own single-owner OAuth authorization server:

export PRIMEDELTA_MCP_OAUTH_OWNER_SECRET=<a-strong-secret>
export PRIMEDELTA_MCP_PUBLIC_URL=https://mcp.example.com
primedelta-mcp --transport http --host 0.0.0.0 --port 8000

PRIMEDELTA_MCP_PUBLIC_URL must be the externally reachable https:// origin — OAuth metadata and redirects are built from it, so terminate TLS in front of the server. Then add it in Claude as a custom connector and complete the consent flow with your owner secret.

Option B — Bearer token (simpler clients)

export PRIMEDELTA_MCP_AUTH_TOKEN=<a-strong-secret>
primedelta-mcp --transport http --host 0.0.0.0 --port 8000

Callers send Authorization: Bearer <token>. Put TLS in front of it in production so the token isn't sent in the clear.

TLS

Neither option is safe over plain HTTP on the public internet. Terminate HTTPS with a reverse proxy (Caddy, nginx, a cloud load balancer) and point clients at the https:// URL. GET /healthz stays open for liveness checks.

Verify

Once connected, ask Claude for your session status — confirm the network, the signer, and that your caps and gates are what you expect before funding anything.

Harden it → Operator hardening