# Set up hosted MCP

Owners and admins set the server up on the project's MCP page. The project needs a version first: the server is made from it, off, with its read tools on.

### 1. Set the base URL

Enter your API's base URL under **Your API**, such as `https://api.example.com/v1`. Every tool's path is added to it. [Refused hosts](refused-hosts) lists what isn't accepted. Changing to another host means proving that one too.

### 2. Prove the host is yours

The page shows the server's token, which starts with `l10v_`. Put it in a file at `https://<host>/.well-known/latitude10-verify.txt`, or in a TXT record at `_latitude10.<host>`, then choose **Check now**. The proof is checked again every 7 days, on the next call after that. If that check fails, every call is refused until **Check now** passes again.

### 3. Store the credential

If your API needs one, store the credential agents' calls should carry: a header, or a query parameter, with its name and value. A header that describes the request itself, such as `Host` or `Content-Type`, can't hold it.

Your API credential for hosted MCP is sealed with AES-GCM 256 under a Worker secret, with a fresh IV each time, and one module decrypts it.

It's sent only to your verified host and never shown again: replace it to change it. Remove it, and calls go out with no credential.

### 4. Choose the tools

Reads (`GET` and `HEAD`) are on to start with. Turn each write on yourself, within the cap [Keys and allow lists](keys-and-allow-lists) gives.

### 5. Create a key

Create an MCP key under **Agents' keys** and hand it to the agent. It's shown once, and it opens this server only. The page shows how to connect Claude Code, Claude or any MCP client:

```sh
claude mcp add --transport http <project> https://latitude10.tech/mcp/<workspace>/<project> --header "Authorization: Bearer <your l10m_ key>"
```

### 6. Pick the version, and turn it on

Under **Status**, the server serves the latest version, so each push changes its tools, or a version you pin, so pushes don't until you move the pin. Then choose **Turn on**. **Turn off** makes the server answer `404` at once.

## Where this comes from

- `app/hosted-mcp/_lib/server.ts`
- `app/hosted-mcp/_lib/upstream.ts`
- `app/hosted-mcp/_lib/credential.ts`
- `app/hosted-mcp/_lib/keys.ts`
- `app/workspace/actions.ts`
- `app/workspace/_lib/onboarding.ts`
- `app/workspace/[ws]/[project]/mcp/page.tsx`