---
title: Hosted MCP
description: Call shebang's MCP server over HTTPS, with either an shb_ key or sherlock OAuth, and what's different from the local server.
---

# Hosted MCP

Instead of running `shebang-mcp` as a local stdio process, point any
MCP-over-HTTP-capable harness straight at:

```
https://api.shebang.pro/mcp
```

It's the same tools, the same schemas, the same behavior as the stdio
server (see [tools reference](/mcp/tools-reference)) — with one
difference: **no local filesystem.** `store_upload_file` reads a path off
whatever disk the MCP server process can see; over stdio that's your own
machine, but the hosted server runs inside shebang's own infrastructure,
so a `path` there would name a file on shebang's side, not yours. The
hosted endpoint omits `store_upload_file` entirely and registers
`store_upload_content` in its place — upload by supplying the bytes
directly (`contentBase64` or `text`) instead of a path. Every other tool
is identical between the two servers.

## Authentication

The hosted endpoint accepts either credential, on the same header:

- An `shb_…` key, same as everywhere else — `Authorization: Bearer
  shb_...`.
- A sherlock OAuth access token, obtained via the authorization-code flow
  (PKCE) against `auth.shebang.pro` — the same kind of token your own app
  would use to call a database's Data API as a signed-in user.

Both are checked by the same code path, so a tool call never knows or
cares which kind of credential it received; a token's home project (if
its OAuth client has one) scopes it exactly like an app key bound to
that project.

A request with neither credential gets `401` with a `WWW-Authenticate:
Bearer` header naming
`https://api.shebang.pro/.well-known/oauth-protected-resource` — RFC 9728
protected-resource metadata — so a compliant OAuth client can discover
the authorization server with no manual configuration at all.

## Set up a harness

**Claude Code** discovers and registers itself with no key ever leaving
your machine:

```
claude mcp add --transport http shebang https://api.shebang.pro/mcp
```

On first use, Claude Code calls `/mcp`, gets the `401` above, fetches the
protected-resource document, follows `authorization_servers` to sherlock's
own discovery document, finds its dynamic client registration endpoint,
registers itself as a public OAuth client (PKCE, `S256` only), and opens
your browser to sherlock's consent screen. Approve there and every
following call carries the issued access token automatically — nothing
to copy, paste, or store yourself.

**Any other HTTP-capable MCP harness** that also does this discovery
dance needs no more than the URL above. One that doesn't (or that you'd
rather point at a plain key) can skip OAuth entirely and use a generic
config with an `shb_…` key instead:

```json
{
  "mcpServers": {
    "shebang": {
      "url": "https://api.shebang.pro/mcp",
      "headers": {
        "Authorization": "Bearer shb_..."
      }
    }
  }
}
```

Mint that key the same way as for the local server — see
[your first key](/getting-started/your-first-key) — or register an OAuth
client by hand with the `oauth_create_client` tool (or dynamic
registration directly against sherlock) if your harness supports OAuth
but not zero-configuration discovery.

## Next

[Hosted MCP (getting started)](/getting-started/hosted-mcp-oauth) — the
shorter landing version of this page. [API reference](/api) — the
`401`/`403` shapes, the `api.shebang.pro` rewrite, and the
protected-resource document's exact response body.