Formatho Runtime · v0.3
The self-hosted MCP server for AI agents
Give Claude Code, Cursor, and Claude Desktop a permissioned toolset — 26 deterministic developer, security, and EVM tools — running in a Docker container on your infrastructure. API keys, policies, rate limits, metadata-only audit. Payloads never leave your network.
docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime GitHub What is a self-hosted MCP server?
A self-hosted MCP server is an implementation of the Model Context Protocol that runs as a container on infrastructure you control, instead of a vendor's cloud. AI agents — Claude Code, Cursor, Claude Desktop, elizaOS — connect to it over stdio or HTTP and receive a catalog of tools they can call.
Self-hosting matters because tool calls carry your data. When the server runs on your host, connections terminate on your network, you decide which tools each agent may call, and the audit log lives on your disk. It is the right choice for any team whose agents touch code, tokens, or customer data — which is to say, most engineering teams.
Self-hosted vs cloud-hosted MCP
Both give agents tools. The difference is where your payloads go and who holds the keys.
| Formatho Runtime (self-hosted) | Cloud/registry-hosted MCP | |
|---|---|---|
| Where payloads live | Your host, inside the container — never uploaded | Vendor infrastructure; payloads transit their API |
| Network egress | None — tools are pure functions with no outbound access | Depends on vendor; requests leave your network |
| Authentication | API keys you issue and revoke per client | Vendor account, often shared across users |
| Audit trail | Metadata-only log on your Docker volume | Vendor logs, if any — not under your control |
| Cost at scale | One container on hardware you already run | Per-seat or per-call pricing as agents scale |
| Setup | One docker run command, zero configuration | Account signup, API key management, rate ceilings |
How it works
01
AI Agent
Claude Code, Cursor, Claude Desktop — or any MCP client, inside your infrastructure.
02
MCP Server
One Docker image. Streamable HTTP + stdio transports, no SaaS in the middle.
03
API keys & policy
Per-client keys, allow/deny policies, and rate limits on every tool.
04
Tool Registry
Every tool declares permissions, version, and schemas. 26 deterministic tools shipped.
05
Audit Log
Every invocation logged as metadata. Payloads never recorded.
Connect your agent
The same server, four ways in. Pick your client; everything below is copy-paste ready.
Claude Code
One command registers the runtime as an MCP server:
claude mcp add formatho -- \ docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime
Cursor
Add the server to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"formatho": {
"command": "docker",
"args": ["run", "-i", "--rm",
"-v", "formatho-audit:/data",
"formatho/formatho-runtime"]
}
}
}Claude Desktop
In Settings → Developer → Edit Config, add to claude_desktop_config.json:
{
"mcpServers": {
"formatho": {
"command": "docker",
"args": ["run", "-i", "--rm",
"-v", "formatho-audit:/data",
"formatho/formatho-runtime"]
}
}
}elizaOS agents
Point @elizaos/plugin-mcp at the HTTP endpoint — all 26 tools become agent actions:
# in your elizaOS project elizaos plugins add @elizaos/plugin-mcp # MCP endpoint: http://localhost:8787/mcp # Also see the free native plugin: /eliza-tools
Any MCP client (HTTP)
Run the gateway and point clients at the Streamable HTTP endpoint:
docker run -p 8787:8787 -e FORMATHO_HOST=0.0.0.0 \ -v formatho-audit:/data formatho/formatho-runtime # MCP endpoint: http://localhost:8787/mcp # REST gateway: http://localhost:8787/api/tools/*
Full quickstart, the security model, and the tool-development guide live in the GitHub repo — image on Docker Hub — listed in the MCP Registry as com.formatho/runtime.
Quick start
- 1
Pull and run the image: docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime (stdio transport, zero configuration).
- 2
Register it with your agent — claude mcp add formatho for Claude Code, or the mcpServers entry for Cursor and Claude Desktop.
- 3
Ask your agent to use a tool — convert, hash, decode — and watch the invocation land in the metadata-only audit log.
- 4
When you need network reach, API keys, or rate limits, switch to the Streamable HTTP deployment and set policies per key.
Built for teams handing tools to agents
The runtime is what a browser tool site looks like when the audience is an engineering team and the user is an AI agent.
API keys & permissions
Issue a key per client or per team. Allow and deny tool access with the policy engine; revoke instantly.
Rate limiting
Per-key and per-tool limits stop a runaway agent loop before it costs anything.
REST gateway
The same tools are exposed over plain REST — for scripts, CI, and systems that do not speak MCP.
Zero data egress
Tools are pure functions: no outbound network, no filesystem writes, no secret access — by construction.
Metadata-only audit
Tool, version, key, duration, byte sizes. What was called — never what was sent.
Listed in the MCP Registry
Published as com.formatho/runtime — versioned, with OCI package metadata on Docker Hub.
The catalog — 26 tools
Deterministic tools — the same math powering this site's browser tools, re-implemented headlessly and validated against identical ground truths. The public browser tools remain free; the runtime is how agents get them privately.
Data formats
JSON format/validate/minify, Base64+URL encoding, slugs, list conversion
Security & tokens
SHA-2 hashing, Keccak-256 hashing, HMAC, UUID/ULID, JWT decode, TOTP
Web3 / EVM
Function selectors, CREATE2, EIP-1967 proxy slots, storage slots, calldata decode, address checksum, v4 hook permissions
Developer
Timestamps, regex matching, case conversion, registry metadata
Security model
- Permissions by construction. The registry refuses to register any tool claiming network, filesystem, secret, or subprocess access. Tools are pure functions — there is nothing to escape.
- Audit without exposure. Every invocation logs tool, version, duration, and byte sizes. Payloads are never written to disk.
- Formatho Verified, not "audited". Per-tool checklists (source, dependencies, network behavior reviewed). The word audited is reserved for formal security audits.
- Small supply chain. Three runtime dependencies, all pinned: the MCP SDK, zod, and noble hashes.
What the runtime does not do
- No network tools. By design, no HTTP fetchers, web search, or API callers — tools are pure functions, so there is no egress channel to abuse.
- No filesystem or shell access. Tools cannot read your disk, write files, or spawn processes. The only write is the metadata audit log.
- No secrets handling. The runtime never reads environment secrets or credential stores; API keys gate access to tools, not to your infrastructure.
- Phase-1 catalog. 26 deterministic tools today — webhooks, database readers, and internal-API wrappers belong to enterprise engagements, not the public image.
- Verified, not audited. Every tool ships with a review checklist, but no formal third-party security audit has been performed yet.
Frequently asked questions
What is a self-hosted MCP server? ▾
An MCP (Model Context Protocol) server runs inside your own infrastructure — a container you start, on a host you control — and gives AI agents like Claude Code, Cursor, and Claude Desktop controlled access to tools. Nothing routes through a vendor: connections terminate on your network, and you decide which tools each agent may call.
How do I connect Claude Code to a self-hosted MCP server? ▾
One command: claude mcp add formatho -- docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime. Claude Code launches the container as a stdio MCP server and the Formatho tools appear in its tool list immediately.
How do I add an MCP server to Cursor? ▾
Add an mcpServers entry to .cursor/mcp.json (per project) or ~/.cursor/mcp.json (global) with the docker run command as shown above — Cursor connects on startup and the tools are selectable in agent mode.
Can agents send my data to a third party through this server? ▾
No — that is the point of the design. The tool registry refuses to register any tool that declares network, filesystem, secret, or subprocess access. Tools are pure functions over their inputs, so there is no channel for payloads to leave your environment.
What gets logged in the audit trail? ▾
Metadata only: which tool, which version, which API key, duration, and payload byte sizes. The content of requests and responses is never written to disk, keeping the audit useful for compliance without becoming a data-loss vector itself.
Self-hosted or the hosted tier — which should I use? ▾
Self-host when data must not leave your network or you want the policy engine under your control — it is one Docker command. The hosted tier (mcp.formatho.com) exists for trying the tools and for teams without container infrastructure; payloads transit the hosted endpoint, so regulated data belongs self-hosted.
What do I need to run it? ▾
Docker on any Linux, macOS, or Windows host. The stdio transport needs no ports or configuration; the Streamable HTTP deployment binds a port and supports API keys, policies, and rate limits. Image size is small and the dependency chain is three pinned packages.
Need your internal systems agent-ready?
We turn internal APIs and workflows into secure, MCP-accessible tools — deployed inside your infrastructure. That is what Formatho Runtime was built for.