An MCP server that works on your laptop still needs a reliable home before colleagues or customers can use it. Once you share that server, you need to decide where its tools execute, how each user signs in, and how you trace a failed or unauthorized call. Choosing the right infrastructure starts with separating the runtime that executes your tools from the gateway that controls access to them.
That distinction matters as remote Model Context Protocol (MCP) deployments evolve. The July 2026 MCP specification removes protocol-level sessions from Streamable HTTP, making client compatibility and application state explicit deployment decisions. Meanwhile, Cloudflare's September 2026 portal release brings approved remote servers behind one endpoint with activity logs, illustrating the access controls you may need alongside hosting.
We compare seven MCP server infrastructure platforms for managed hosting, API-to-MCP conversion, and self-hosted deployment, with the tradeoffs in authentication, runtime limits, and pricing that determine which fits your stack.
MCP Server Infrastructure Platforms at a Glance
| Tool | Best for | Pricing model | Standout |
|---|---|---|---|
| Cloudflare | Public, internet-facing remote MCP servers on Workers | Workers Free, then Paid from $5/mo. Portals via Cloudflare One | Agents SDK createMcpHandler. Streamable HTTP. Access MCP server portals |
| AWS Bedrock AgentCore | AWS shops hosting MCP servers and wrapping Lambda or OpenAPI as tools | Consumption. Runtime vCPU and memory hours. Gateway per invocation | Runtime hosts MCP. Gateway turns Lambda and OpenAPI into MCP tools |
| Vercel | Teams already shipping Next.js who want MCP as a Function | Hobby $0; Pro from $20/month plus seats and usage | mcp-handler adapter. Streamable HTTP. Fluid compute. OAuth metadata routes |
| Prefect Horizon | Managed Python FastMCP deployment; marketed as FastMCP Gateway | Personal free; Developer $35/developer/month plus usage; Enterprise quote | GitHub CI/CD to a live /mcp URL. OAuth 2.1. Registry, gateway, remix |
| Speakeasy | API companies that generate, host, and govern MCP for customers | Custom Enterprise pricing for the AI Control Plane | OpenAPI to hosted MCP. Gateway endpoints. Catalog, remote, and tunneled servers |
| Kong | Existing Kong deployments exposing APIs or proxying MCP servers | AI Gateway Enterprise. Quote | AI MCP Proxy and OAuth2 plugins. REST-to-MCP conversion. Passthrough to upstream MCP |
| Docker | Self-hosted isolated containers. Runs and governs servers, does not generate them | Toolkit with Docker Desktop. OSS Gateway free. Enterprise Gateway quote | MCP Catalog, Toolkit profiles, open-source MCP Gateway. Optional Enterprise Gateway |
How We Evaluated These Tools
We compared official product documentation and published pricing, checked on October 15, 2026, against five deployment criteria:
- Hosting responsibility: Whether you get a managed runtime, generated MCP endpoints, a gateway for existing services, or containers you operate yourself.
- Protocol compatibility: Support for Streamable HTTP, legacy clients, and the application state your tools need across calls.
- Identity and permissions: How users authenticate, how tool access is restricted, and which controls require an enterprise plan.
- Operations: Deployment and rollback workflows, request-duration limits, isolation, and logs you can use to investigate failures.
- Total cost: Published subscriptions, compute and invocation charges, log retention, and separately priced governance features.
The 7 Best MCP Server Infrastructure Platforms
The strongest option depends on the infrastructure you already run and whether you need hosting, API conversion, or control over existing servers.
1. Cloudflare
Cloudflare suits teams deploying remote MCP servers on Workers, especially when they already use Cloudflare for application delivery or employee access. Its Agents SDK provides createMcpHandler for new stateless servers using Streamable HTTP. Workers OAuth Provider or Access can handle authentication, while MCP server portals give employees one endpoint for approved remote servers. Hosting and portal governance are separate services, so decide which you need before comparing costs.
Best for: Teams that want a remote MCP URL on Cloudflare's edge, with Access as the identity layer for employees.
Key features:
- createMcpHandler on Workers. Streamable HTTP. SSE only for older clients
- Workers OAuth Provider, or Access, as the identity layer
- MCP server portals: approved servers, tool scope, Access logs, optional Gateway DLP routing
Why we like it: Cloudflare lets you publish a remote MCP endpoint without managing a container fleet, with Access available when employees need controlled access.
Notable limitations:
- Stdio-only catalog servers do not attach to a portal
- McpAgent templates still exist. Do not start a new server on that path
- Portals are a Cloudflare One/Access product. Workers Paid is not the same bill
Pricing: Cloudflare Workers pricing, checked October 15, 2026: Free tier available; Paid starts at $5/month with request and CPU allowances, then usage charges. MCP server portals use Cloudflare One/Access licensing, which you should price separately from Workers.
2. AWS Bedrock AgentCore
AWS Bedrock AgentCore fits teams that want MCP hosting and API access within their existing AWS environment. Runtime hosts your MCP server container, while Gateway exposes Lambda functions, OpenAPI services, Smithy services, or existing MCP servers as tools. Runtime requires a container serving Streamable HTTP at 0.0.0.0:8000/mcp. Its default stateless mode supports AWS routing; stateful mode is relevant to older protocol features, while MCP 2026-07-28 uses multi round-trip requests for elicitation and sampling.
Best for: Teams whose agents, APIs, and identity already live in AWS, and who want MCP on the same bill.
Key features:
- Runtime: MCP protocol on a dedicated agent runtime, session header injected when missing
- Gateway: Lambda, OpenAPI, and Smithy as MCP tools, plus passthrough MCP targets
- Workload identity and OAuth. microVM or Instances compute
Why we like it: AWS Bedrock AgentCore lets you reuse existing Lambda functions as tools and host custom MCP servers within the AWS environment your team already manages.
Notable limitations:
- Runtime deployment follows AWS container and session-routing requirements; a local stdio process cannot be uploaded unchanged
- Gateway and Runtime are separate meters. Budget both if you host and wrap
- Your server must meet the Runtime container contract, including its endpoint and architecture requirements
Pricing: AWS AgentCore pricing, checked October 15, 2026: Runtime microVM v1 lists $0.0895 per vCPU-hour and $0.00945 per GB-hour; v2 has different rates. Gateway lists $0.005 per 1,000 API invocations, $0.025 per 1,000 Search invocations, and $0.02 per 100 indexed tools per month. Include networking and observability charges when estimating the total.
3. Vercel
Vercel lets you deploy an MCP endpoint alongside a Next.js application using its mcp-handler adapter. The handler runs as a Function and accepts Streamable HTTP requests, typically at /api/mcp. Version 2 removes the legacy HTTP+SSE transport, so existing deployments need a compatibility check before upgrading. The adapter provides token-verification and OAuth metadata helpers, but you supply the authorization server and token-validation logic. Function duration limits still apply to long tool calls.
Best for: Next.js teams already on Vercel who want the MCP endpoint next to the app.
Key features:
- mcp-handler on Functions, Next.js, and other Fetch frameworks
- Streamable HTTP with support for modern and compatible legacy protocol requests
- Fluid compute, preview protection, Instant Rollback. OAuth metadata endpoint for spec-compliant auth
Why we like it: Vercel keeps the MCP endpoint in the same deployment workflow as your application, making it easier to review and roll back changes together.
Notable limitations:
- Stateless by design. Do not expect a sticky stdio session
- Raise maxDuration on Pro/Enterprise if tools wait on models. Hobby caps will cut a long call
- The mcp-handler adapter does not include an authorization server; you must provide one
Pricing: Vercel pricing, checked October 15, 2026: Hobby is $0/month; Pro starts at $20/month with included usage credit. Additional developer seats and Function usage can increase the bill. Compare Active CPU, provisioned memory, and invocation charges for your region.
4. Prefect Horizon
Prefect Horizon, now marketed as FastMCP Gateway, provides managed deployment for Python FastMCP servers. Connect a GitHub repository and the platform builds and deploys your server to a remote URL with managed OAuth, scaling, and monitoring. Preview deployments and rollback support the same workflow as your application code. Its registry, access controls, and Remix feature help organize tools across multiple servers, with enterprise governance reserved for higher-tier plans.
Best for: Python/FastMCP teams that want a live /mcp URL from a repo, without a Dockerfile.
Key features:
- Git-native CI/CD, previews, rollback, scale-to-zero
- Managed OAuth 2.1. Optional bring-your-own auth on paid tiers
- Registry, gateway, and remix on the same platform
Why we like it: Prefect Horizon takes a Python server from a repository to an authenticated endpoint without requiring a separate infrastructure project.
Notable limitations:
- Hosted path is Python MCP/FastMCP from git. Other languages are external servers you import
- RBAC, SSO, and SCIM sit on Enterprise
- Developer adds usage on top of the per-developer card. Model the meter before you autoscale agents
Pricing: Prefect's FastMCP Gateway pricing, checked October 15, 2026: Personal is free for one developer, 200 MCP servers, and one agent, with one-hour log retention. Developer is $35 per developer/month plus usage and includes seven-day logs. Enterprise has custom pricing for RBAC, SSO, SCIM, and custom domains.
5. Speakeasy
Speakeasy combines MCP server creation, hosting, and gateway controls within its AI Control Plane. You can generate tools from an OpenAPI specification, curate the exposed operations, and deploy a hosted endpoint. The gateway also connects catalog servers, remote MCP servers, and private servers through tunnels. This makes it useful when you want to expose existing APIs to agents and manage access to those tools in one place.
Best for: API companies that want customers (and internal agents) on a generated MCP server, not a hand-written Python runtime.
Key features:
- OpenAPI and TypeScript functions to hosted MCP. Immutable deployments, rollback
- Gateway endpoints, catalog, remote, and tunneled backends
- OAuth, API keys, team access, and tool-call logs
Why we like it: Speakeasy gives an existing API a path to hosted MCP tools and provides a gateway for distributing those tools to users and agents.
Notable limitations:
- Generated OpenAPI tools need curation so agents receive a relevant set of operations
- Public pricing page lists AI Control Plane as Enterprise quote. Confirm any self-serve host card in the dashboard
- Generated tools depend on the completeness of your API schema and the permissions of the underlying API
Pricing: Speakeasy's public pricing page, checked October 15, 2026, lists a tailored Enterprise plan for the AI Control Plane. The MCP Gateway product page also offers a free deployment entry point. Confirm its limits and the production quote before treating that entry point as a recurring budget.
6. Kong
Kong brings MCP endpoints into an existing API gateway deployment. Its AI MCP Proxy plugin can convert Kong-managed REST APIs into tools or forward requests to upstream MCP servers, while the AI MCP OAuth2 plugin handles authentication. The gateway serves the MCP endpoint, but your upstream API or custom server still executes the business logic. This is a strong fit when you already operate Kong and want its traffic policies and observability to cover MCP.
Best for: Enterprises with Kong (Konnect or Gateway Enterprise) that want MCP on the same policy plane as the REST estate.
Key features:
- AI MCP Proxy: conversion, listener, conversion-listener, passthrough-listener
- AI MCP OAuth2: protected-resource metadata, introspection, optional token exchange
- Kong auth, rate limit, and observability on the MCP route
Why we like it: Kong lets you expose tools from APIs already managed by the gateway and apply familiar authentication, rate limits, and logging.
Notable limitations:
- Enterprise plugin. Not on Gateway OSS alone
- Do not mix OAuth2 with conversion-listener on the same route (Kong's own breaking-change note)
- Consumer and Consumer Group plugin scoping is unsupported; configure tool ACLs for identity-based restrictions
Pricing: Kong's pricing and plugin pages, checked October 15, 2026, place these MCP capabilities in AI Gateway Enterprise. Request a quote for your Konnect or self-hosted deployment and confirm that it includes the MCP plugins you need; a published LLM proxy rate is not an MCP hosting price.
7. Docker
Docker packages MCP servers as containers and manages them through MCP Toolkit and the open-source MCP Gateway. Toolkit, integrated into Docker Desktop, groups servers into profiles and connects them to AI clients. The Gateway starts and routes calls to isolated server containers, while a separate Enterprise Gateway adds organizational identity, policy, and audit controls. You operate the local or self-hosted runtime unless you arrange an enterprise deployment with Docker.
Best for: Teams that want local or self-hosted MCP with container isolation, and will pick servers from a catalog rather than generate them.
Key features:
- Catalog images with provenance. Profiles per project
- Open-source MCP Gateway: lifecycle, credentials, tool access, Dynamic MCP
- Enterprise Gateway: IdP, tool-level policy, secret-store injection, audit (invite-only)
Why we like it: Docker runs each server in a separate container with restricted privileges and resource controls, giving you a defined boundary between tool execution and your AI client.
Notable limitations:
- Default Desktop path is local/self-hosted, often stdio into the client. Remote HTTP is a Gateway/Enterprise configuration, not the Toolkit default
- Gateway on Engine without Desktop is a separate binary install
- Enterprise Gateway is sales-gated. Do not assume Desktop Toolkit includes org SSO
Pricing: Docker's MCP documentation and Enterprise Gateway page, checked October 15, 2026: the MCP Gateway is open source, while Desktop licensing and your hosting costs remain separate. Enterprise Gateway requires contacting sales and has no public fixed MCP price. Confirm deployment, identity, and audit requirements in the quote.
Deployment Comparison
| Platform | Managed vs self-hosted | Transport | Sessions |
|---|---|---|---|
| Cloudflare | Managed Workers. Portals on Cloudflare One | Streamable HTTP. SSE legacy. Stdio not in portals | Stateless createMcpHandler. McpAgent stateful path is deprecated for new servers |
| AWS Bedrock AgentCore | Managed Runtime and Gateway on AWS | Streamable HTTP at /mcp | Stateless default with AWS session routing; older protocol features may require stateful mode |
| Vercel | Managed Functions | Streamable HTTP. SSE removed in mcp-handler 2.x | Stateless. maxDuration caps long tool calls |
| Prefect Horizon | Managed git-push hosting. External servers optional | Remote HTTP /mcp behind the gateway | Gateway preserves MCP session routing |
| Speakeasy | Managed hosted servers, plus remote and tunneled | Remote MCP endpoints over Streamable HTTP | Platform hosts the protocol. Immutable deployments |
| Kong | Self-hosted Gateway or Konnect. You still run upstream APIs | MCP served or proxied through a Kong route | Proxy/listener. Not a sessionful app runtime |
| Docker | Self-hosted Desktop/Engine. Enterprise Gateway can be Docker-operated | Stdio to the client by default. HTTP/SSE for remote servers through the gateway | Gateway process plus one container per server |
Feature Comparison
| Platform | OAuth | RBAC and tool filtering | Audit |
|---|---|---|---|
| Cloudflare | Workers OAuth Provider. Access managed OAuth on portals | Portal tool policies. Access groups and device posture | Access logs of tool, prompt, and resource activity. Logpush on portals |
| AWS Bedrock AgentCore | AgentCore Identity / OAuth on Runtime and Gateway | IAM plus Gateway auth on ingress and egress | AWS CloudWatch/CloudTrail path. Confirm MCP-specific fields on the order |
| Vercel | You mount OAuth metadata and token routes. Not a portal | Your code. Deployment Protection on previews | Vercel logs and your app logs. No org MCP SIEM product |
| Prefect Horizon | Managed OAuth 2.1 with DCR. BYO auth on paid | Tool-level RBAC on Enterprise. Remix to shrink catalogs | Request logs. Retention 1 hour on Personal, 7 days on Developer |
| Speakeasy | Platform OAuth, API keys, or your IdP. DCR for clients | Team access, curated tools, gateway list/describe/execute | Tool logs, export to Datadog or OTel |
| Kong | AI MCP OAuth2 plugin. Existing Kong auth plugins | Tool ACLs support Consumers and Consumer Groups; plugin placement cannot be scoped to them | Kong analytics and AI audit logs on the route |
| Docker | Per-server OAuth in Toolkit. Enterprise Gateway uses your IdP | Profile membership. Enterprise: group-scoped tools and policy | Gateway tracing. Enterprise: SIEM-ready events |
Strategic Decision Framework
| Critical question | Why it matters | What to evaluate | Red flags |
|---|---|---|---|
| Do you need a host, or a gateway in front of servers you already run? | Cloudflare, AgentCore Runtime, Vercel, and Horizon host code. Kong serves or proxies MCP endpoints for upstream services. Docker runs containerized servers; Speakeasy combines generation and hosting. | Who owns the process, who owns /mcp, who issues tokens. | A gateway purchase with no execution plan for the tools, or shared credentials with no caller-level controls. |
| Which transports are actually supported in production? | A stdio connection is local to its client; remote access requires an HTTP transport or an adapter. Legacy HTTP+SSE support varies. | Streamable HTTP on the public URL. Stdio-only catalog entries. Portal/gateway fallback. | Stdio-only support sold as remote MCP. |
| What happens on a long tool call, or the 10,000th call this month? | Compute, memory, and tool-call charges scale differently, and request-duration limits can interrupt long jobs. | maxDuration, cold start, Gateway per-call meters, Horizon usage, Speakeasy request definition. | Usage pricing that scales with tool calls, with no published pause or cap. |
| Can you leave this cloud without rewriting every tool? | Workers, AgentCore, and Vercel Functions are not interchangeable containers. | Can you export a container? Is the server FastMCP/Python you can push elsewhere? | Lock-in to one cloud with the tools defined only in that vendor's console. |
Problems & Solutions
- You chose a gateway but still have nowhere to run custom tools. Identify what needs to execute before buying the gateway. Use Workers, AgentCore Runtime, Vercel, or Horizon for hosting, or expose an existing API through Speakeasy, AgentCore Gateway, or Kong. Add gateway controls around the resulting endpoints.
- Every user shares the same API token. Use an identity layer such as Access, AgentCore Identity, Horizon OAuth, Speakeasy OAuth, or Kong AI MCP OAuth2 to identify callers and restrict their tools. Keep a caller-linked activity record so you can revoke access and investigate individual actions.
- A long-running tool exceeds the host's request limit. Check the configured maximum duration and plan limits before moving the workload. On Vercel, evaluate the Pro or Enterprise duration allowance; for work that cannot fit a request, use background processing or a runtime suited to the job and return a result handle.
- A remote client cannot connect to a stdio-only server. Run the server behind an HTTP-capable gateway or adapt it to a supported remote transport before adding it to a portal. Verify authentication and client compatibility on the actual endpoint.
The Bottom Line
Choose Cloudflare Workers when you want a remote MCP endpoint on the edge and can add Access or portal controls as your rollout grows. If your tools and identity already live in AWS, AgentCore keeps hosting and API conversion in that environment. Vercel is a practical fit when the MCP endpoint belongs beside a Next.js application, while Prefect Horizon suits Python FastMCP teams that want managed deployment from GitHub.
Speakeasy is worth considering when your starting point is an OpenAPI specification and you want generated tools with managed hosting and gateway controls. Kong fits an existing API gateway estate, especially when you want to expose upstream services through familiar policies. Docker gives you control over containerized execution on your own infrastructure, with Enterprise Gateway available when centralized identity and audit requirements justify a separate purchase. Start with where the tools must run, then compare the access controls and total operating cost around that choice.
