diff --git a/app/en/operate/deploy/on-prem/page.mdx b/app/en/operate/deploy/on-prem/page.mdx index a3e7631f4..e3705dbbc 100644 --- a/app/en/operate/deploy/on-prem/page.mdx +++ b/app/en/operate/deploy/on-prem/page.mdx @@ -1,6 +1,6 @@ --- title: "Hybrid MCP servers" -description: "Run MCP servers in your own environment and connect them to Arcade Cloud" +description: "Run a self-hosted MCP server worker in your own private network or VPC and connect it to Arcade Cloud. Hybrid worker deployment for on-premises and private cloud environments." --- import { Steps, Tabs, Callout } from "nextra/components"; @@ -10,7 +10,7 @@ import { Steps, Tabs, Callout } from "nextra/components"; -An on-premises MCP server deployment allows you to execute tools in your own environment while still leveraging Arcade's cloud Engine infrastructure. This gives you the flexibility to access private resources, maintain data security, and customize your environment while leveraging Arcade's MCP server management and federation capabilities. +A hybrid MCP server deployment — also called a self-hosted worker or hybrid worker — runs the MCP server on infrastructure you control (on-premises, private cloud, VPC, or any private network) while Arcade's cloud Engine keeps handling identity, routing, and governance. This gives you the flexibility to access private resources behind a firewall, keep sensitive data inside your network, and customize your environment while leveraging Arcade's MCP server management and federation capabilities. @@ -34,22 +34,24 @@ An on-premises MCP server deployment allows you to execute tools in your own env ## How on-premises MCP servers work -You can make your MCP server accessible to others by exposing it through a secure tunnel and registering it with Arcade. This allows remote users and services to interact with your tools without deploying to a cloud platform. +You can make your self-hosted MCP server accessible to Arcade Cloud by exposing it through a secure tunnel and registering it as a worker. This allows remote users and services to interact with your tools without deploying to a cloud platform. -The on-premises MCP server model uses a bidirectional connection between your local environment and Arcade's cloud engine: +The on-premises MCP server model (a hybrid worker deployment) uses a bidirectional connection between your local environment and Arcade's cloud engine: -1. You run the Arcade MCP server in your environment (on-premises, private cloud, etc.) +1. You run the Arcade MCP server in your environment (on-premises, private cloud, VPC, or any private network) 2. Your MCP server is exposed to Arcade's cloud engine using a public URL 3. The Arcade cloud engine routes tool calls to your MCP server 4. Your MCP server processes the requests and returns responses to the engine ## Benefits of on-premises MCP servers -- **Resource access**: Access private databases, APIs, and other resources not accessible from Arcade's cloud +- **Resource access**: Reach private databases, internal APIs, and other resources sitting behind your firewall that aren't accessible from Arcade's cloud - **Data control**: Keep sensitive data within your environment while still using Arcade's capabilities - **Custom environments**: Use specific dependencies or configurations required by your tools - **Compliance**: Meet regulatory requirements by keeping data processing within your infrastructure +If you need to connect external AI clients to a self-hosted Arcade runtime without any tunnel — using outbound-only network egress from your VPC — see [Warp Pipes](/operate/deploy/warp-pipes) instead. + ## Setting up an on-premises MCP server @@ -254,14 +256,7 @@ Open a **separate terminal** and create a tunnel using one of these options: Once you have a public URL, register your MCP server in the Arcade dashboard to make it accessible through the Arcade API. - - This flow uses the **Arcade** server type, for a server built with the Arcade - SDK that Arcade authenticates with a shared secret. To register a server that - speaks plain MCP over HTTP — a vendor's or a partner's — pick **Remote MCP** - instead and follow [Remote MCP servers](/operate/governance/remote-mcp-servers). - - -1. **Navigate to the MCP Servers page** in your [Arcade dashboard](https://app.arcade.dev/servers) +1. **Navigate to the MCP Servers page** in your [Arcade dashboard](https://api.arcade.dev/dashboard/servers) 2. **Click "Add Server"** @@ -294,7 +289,7 @@ You can now test your MCP Server by making requests using the Playground, or an -1. **Go to the [Arcade Playground](https://app.arcade.dev/playground/chat)** +1. **Go to the [Arcade Playground](https://api.arcade.dev/dashboard/playground/chat)** 2. **Select your MCP server** from the dropdown diff --git a/app/en/operate/deploy/warp-pipes/page.mdx b/app/en/operate/deploy/warp-pipes/page.mdx index 2925bcf58..9eba263d2 100644 --- a/app/en/operate/deploy/warp-pipes/page.mdx +++ b/app/en/operate/deploy/warp-pipes/page.mdx @@ -83,9 +83,9 @@ For Claude, through the Messages API or managed agents, use **Arcade Auth** or * ## Connect to internal MCP servers -Your internal MCP servers live at private hostnames or IP addresses. Configure the runtime's SSRF allowlist through your Helm values to tell the runtime which internal addresses it's permitted to call, then register each MCP server URI as a worker. +Your internal MCP servers live at private hostnames or IP addresses. Configure the runtime's SSRF allowlist (an IP allowlist for outbound egress) through your Helm values to tell the runtime which internal addresses it's permitted to call, then register each MCP server URI as a worker. -The runtime calls these servers directly over your private network, by their internal addresses. No inbound ports, and no tunnel, are required. +The runtime calls these servers directly over your private network, by their internal addresses. Your firewall stays closed to inbound traffic — the runtime only makes outbound egress calls — so no inbound ports, and no tunnel, are required.