Formatho Runtime · v0.3
The self-hosted MCP server for AI agents
Give Claude Code, Cursor, and Claude Desktop a permissioned toolset — 26 deterministic developer, security, and EVM tools — running in a Docker container on your infrastructure. API keys, policies, rate limits, metadata-only audit. Payloads never leave your network.
docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime GitHub How it works
01
AI Agent
Claude Code, Cursor, Claude Desktop — or any MCP client, inside your infrastructure.
02
MCP Server
One Docker image. Streamable HTTP + stdio transports, no SaaS in the middle.
03
API keys & policy
Per-client keys, allow/deny policies, and rate limits on every tool.
04
Tool Registry
Every tool declares permissions, version, and schemas. 26 deterministic tools shipped.
05
Audit Log
Every invocation logged as metadata. Payloads never recorded.
Connect your agent
The same server, four ways in. Pick your client; everything below is copy-paste ready.
Claude Code
One command registers the runtime as an MCP server:
claude mcp add formatho -- \ docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime
Cursor
Add the server to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"formatho": {
"command": "docker",
"args": ["run", "-i", "--rm",
"-v", "formatho-audit:/data",
"formatho/formatho-runtime"]
}
}
}Claude Desktop
In Settings → Developer → Edit Config, add to claude_desktop_config.json:
{
"mcpServers": {
"formatho": {
"command": "docker",
"args": ["run", "-i", "--rm",
"-v", "formatho-audit:/data",
"formatho/formatho-runtime"]
}
}
}Any MCP client (HTTP)
Run the gateway and point clients at the Streamable HTTP endpoint:
docker run -p 8787:8787 -e FORMATHO_HOST=0.0.0.0 \ -v formatho-audit:/data formatho/formatho-runtime # MCP endpoint: http://localhost:8787/mcp # REST gateway: http://localhost:8787/api/tools/*
Full quickstart, the security model, and the tool-development guide live in the GitHub repo — image on Docker Hub — listed in the MCP Registry as com.formatho/runtime.
Quick start
- 1
Pull and run the image: docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime (stdio transport, zero configuration).
- 2
Register it with your agent — claude mcp add formatho for Claude Code, or the mcpServers entry for Cursor and Claude Desktop.
- 3
Ask your agent to use a tool — convert, hash, decode — and watch the invocation land in the metadata-only audit log.
- 4
When you need network reach, API keys, or rate limits, switch to the Streamable HTTP deployment and set policies per key.
Built for teams handing tools to agents
The runtime is what a browser tool site looks like when the audience is an engineering team and the user is an AI agent.
API keys & permissions
Issue a key per client or per team. Allow and deny tool access with the policy engine; revoke instantly.
Rate limiting
Per-key and per-tool limits stop a runaway agent loop before it costs anything.
REST gateway
The same tools are exposed over plain REST — for scripts, CI, and systems that do not speak MCP.
Zero data egress
Tools are pure functions: no outbound network, no filesystem writes, no secret access — by construction.
Metadata-only audit
Tool, version, key, duration, byte sizes. What was called — never what was sent.
Listed in the MCP Registry
Published as com.formatho/runtime — versioned, with OCI package metadata on Docker Hub.
The catalog — 26 tools
Deterministic tools — the same math powering this site's browser tools, re-implemented headlessly and validated against identical ground truths. The public browser tools remain free; the runtime is how agents get them privately.
Data formats
JSON format/validate/minify, Base64+URL encoding, slugs, list conversion
Security & tokens
SHA-2 + Keccak-256 hashing, HMAC, UUID/ULID, JWT decode, TOTP
Web3 / EVM
Function selectors, CREATE2, EIP-1967 proxy slots, storage slots, calldata decode, v4 hook permissions
DeFi math
Exact EIP-4626 vault share/asset math with spec rounding
Developer
Timestamps, regex matching, case conversion, slugs, registry metadata
Security model
- Permissions by construction. The registry refuses to register any tool claiming network, filesystem, secret, or subprocess access. Tools are pure functions — there is nothing to escape.
- Audit without exposure. Every invocation logs tool, version, duration, and byte sizes. Payloads are never written to disk.
- Formatho Verified, not "audited". Per-tool checklists (source, dependencies, network behavior reviewed). The word audited is reserved for formal security audits.
- Small supply chain. Three runtime dependencies, all pinned: the MCP SDK, zod, and noble hashes.
Frequently asked questions
What is a self-hosted MCP server? ▾
An MCP (Model Context Protocol) server runs inside your own infrastructure — a container you start, on a host you control — and gives AI agents like Claude Code, Cursor, and Claude Desktop controlled access to tools. Nothing routes through a vendor: connections terminate on your network, and you decide which tools each agent may call.
How do I connect Claude Code to a self-hosted MCP server? ▾
One command: claude mcp add formatho -- docker run -i --rm -v formatho-audit:/data formatho/formatho-runtime. Claude Code launches the container as a stdio MCP server and the Formatho tools appear in its tool list immediately.
How do I add an MCP server to Cursor? ▾
Add an mcpServers entry to .cursor/mcp.json (per project) or ~/.cursor/mcp.json (global) with the docker run command as shown above — Cursor connects on startup and the tools are selectable in agent mode.
Can agents send my data to a third party through this server? ▾
No — that is the point of the design. The tool registry refuses to register any tool that declares network, filesystem, secret, or subprocess access. Tools are pure functions over their inputs, so there is no channel for payloads to leave your environment.
What gets logged in the audit trail? ▾
Metadata only: which tool, which version, which API key, duration, and payload byte sizes. The content of requests and responses is never written to disk, keeping the audit useful for compliance without becoming a data-loss vector itself.
Self-hosted or the hosted tier — which should I use? ▾
Self-host when data must not leave your network or you want the policy engine under your control — it is one Docker command. The hosted tier (mcp.formatho.com) exists for trying the tools and for teams without container infrastructure; payloads transit the hosted endpoint, so regulated data belongs self-hosted.
What do I need to run it? ▾
Docker on any Linux, macOS, or Windows host. The stdio transport needs no ports or configuration; the Streamable HTTP deployment binds a port and supports API keys, policies, and rate limits. Image size is small and the dependency chain is three pinned packages.
Need your internal systems agent-ready?
We turn internal APIs and workflows into secure, MCP-accessible tools — deployed inside your infrastructure. That is what Formatho Runtime was built for.