# Plan Remote MCP Client Deployments

Remote MCP delivery requires careful tenant isolation, authentication, and host configuration. This guide outlines token-scoped tools, Cloudflare routing, and Linux deployment workflows.

## Install

```bash
npx skillstore add nexaiguy/nex-mcp-client-delivery
```

## Metadata

- Status: approved
- Slug: nexaiguy-nex-mcp-client-delivery
- Version: 1.0
- Author version: 1.0
- Skillstore revision: r1
- Version status: invalid
- Tree hash: c24ec1712ad51b4264ad8db98e59956f81cf4cb90b30e04f0e9aadb917a409c2
- Author: nexaiguy
- GitHub username: nexaiguy
- License: MIT
- Repository: https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-mcp-client-delivery
- Ref: 3ddfdca559084abffbfdd188f2ba14b597dcfd9c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 77
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/nexaiguy-nex-mcp-client-delivery
- Manifest: https://skillstore.pages.dev/api/skills/nexaiguy-nex-mcp-client-delivery/manifest

## Capabilities

- Explains deriving tenant identity from authenticated tokens rather than tool arguments.
- Shows a Python inventory tool example with a read scope and bounded result count.
- Outlines Cloudflare Tunnel routing to a loopback service endpoint.
- Describes systemd provisioning, deployment backups, and health-check workflows.
- Lists illustrative authorization and audit-log tests for deployment review.

## Use Cases

- Plan Client Inventory Access: Use the inventory example to design tenant-scoped, read-only tools before implementing a client MCP endpoint.
- Prepare Linux Deployment Requirements: Identify service accounts, loopback ports, tunnel routing, backups, and health checks needed for a Raspberry Pi deployment.
- Review Tenant Authorization Controls: Turn the documented token, scope, and audit-log expectations into an implementation review checklist.

## Prompt Templates

### Understand the Delivery Guide

```
Summarize this MCP delivery guide. Separate included documentation from missing implementation files, and explain the main deployment components.
```

### Plan a Read-Only Endpoint

```
Plan a read-only inventory MCP endpoint for [client] on [Linux host]. Use token-derived tenancy and loopback tunnel routing. Identify missing implementation prerequisites.
```

### Review Tool Authorization

```
Review [tool design] against this guide. Check tenant derivation, read/write scopes, input limits, token audience, expiration, and audit redaction. Do not assume tests passed.
```

### Prepare a Controlled Rollout

```
Create a rollout review for [deployment]. Require source review and approval before privileged setup. Include isolation tests, backup checks, tunnel validation, health checks, and rollback criteria.
```

## Limitations

- Only SKILL.md is included; server source, deployment scripts, and configuration templates are absent.
- Security guarantees and displayed test results cannot be verified from the supplied files.
- The described server does not support SSE progress streaming.
- The described in-memory sessions require a single worker unless an external session store is added.

## Best Practices

- Review the actual setup and deployment source before approving privileged commands.
- Derive tenant identity from validated tokens and test cross-tenant denial and scope restrictions.
- Verify secret redaction, health checks, backups, and rollback behavior in an isolated environment.

## Anti Patterns

- Treating the public guide as a complete, executable deployment package.
- Running referenced setup commands with root privileges before obtaining and reviewing their source.
- Accepting illustrative test results as proof of production security.

## Security Audit

- Audited at: 2026-11-02T11:40:35.214\+00:00
- Summary: Thirty-one static findings are false positives involving Markdown, illustrative addresses, configuration guidance, and tenant authorization code. One finding remains confirmed: the guide recommends running an unavailable setup script with root privileges, preventing review of its host changes. No evidence found of credential exfiltration or prompt injection in the supplied guide; implementation and test claims cannot be verified.

## Stats

- Views: 0
- Downloads: 0
- Favorites: 0
- Popularity score: 0