MCP hosting with agent-mcp-host

agent-mcp-host is a CLI binary installed on $PATH. It is the operator tool of the agent-* family: it runs every mounted tool's MCP server behind ONE https origin, with ONE OAuth 2.1 authorization server and a separate login per tool. Each tool stays a full MCP server in its own binary — the host mounts it behind a path (/<name>/mcp) and reverse-proxies to it.

Run agent-mcp-host usage for the full LLM-optimized reference card.

Mental model

• One origin (e.g. https://hub.tailnet.example) fronts N tools.
• Each tool is a mount: --mount slack=agent-slack serves https://<host>/slack/mcp. A person adds one Claude connector per tool.
• The host owns pairing (who may connect), OAuth (token minting), and the browser enrollment pages. Tools validate the host's Ed25519 tokens and mint nothing themselves (delegate mode). A slack token is useless at /lin/mcp by construction.