---
title: Hosted MCP
description: Call shebang's MCP server directly over HTTPS, with OAuth instead of a saved key.
---

# Hosted MCP

Instead of running `shebang-mcp` as a local stdio process, point an
MCP-over-HTTP-capable harness straight at:

```
https://api.shebang.pro/mcp
```

It's the same tools, same schemas, same behavior as the stdio server —
with one difference: **no local filesystem.** `store_upload_file` (which
reads a path off disk) isn't registered on the hosted server; use
`store_upload_content` instead, supplying bytes directly (`contentBase64`
or `text`) rather than a path.

The hosted server exposes 39 tools: 38 that are always on, plus
`store_upload_content`. `store_upload_file` is local-only — it never
appears on the hosted server, since there's no filesystem to read from.

## Authentication

The hosted endpoint accepts either credential:

- An `shb_…` key, same as everywhere else:
  `Authorization: Bearer shb_...`.
- A sherlock OAuth access token, obtained via the authorization-code flow
  (PKCE) against `auth.shebang.pro` — the same kind of token your own app
  would use to call a database's Data API as a signed-in user.

A request with neither gets `401` with a `WWW-Authenticate: Bearer`
challenge naming
`https://api.shebang.pro/.well-known/oauth-protected-resource` (RFC
9728), so a compliant OAuth client can discover the authorization server
without any manual configuration.

## Set up a harness

For the exact steps to register a harness as an OAuth client and
complete the browser consent step, see
[MCP: hosted MCP](/mcp/hosted-mcp) — this page is just the landing
pointer to that full walkthrough.

## Next

Head back to [concepts](/concepts) for the vocabulary — projects,
keys, public ids, access modes — the rest of these docs assume.