Is MCP on by default on a self-hosted Nodaro?

No. Set MCP_ENABLED=true and MCP_PUBLIC_URL, route an MCP hostname to the API, and restart. On the compose stack, add both variables under the nodaro service's environment block, because the compose file does not pass them from .env.

Why does my MCP client get 405 wrong_mcp_host?

The client uses the app's main address, where the web server refuses MCP requests. Point the client at the MCP host instead, https://your-mcp-host/mcp, which must reach the API on port 9000 directly.

Which MCP clients can register with my install?

By default, 14 known clients, including Claude, Claude Code, Cursor, Cline, Continue, Goose, ChatGPT and Codex. Add names to MCP_DCR_ALLOWLIST, or set MCP_DYNAMIC_REGISTRATION=open to accept any client.

Can I put a CDN in front of the MCP host?

Not one that proxies traffic. MCP keeps long-lived Server-Sent Events connections open, and a proxying CDN breaks them. Point DNS straight at your server.

Enable MCP on self-hosted Nodaro — let Claude, Cursor and other AI clients use your install

Enable the MCP server of a self-hosted Nodaro so Claude, Cursor, ChatGPT and other MCP clients can use your install over OAuth, from its own MCP hostname.

The Nodaro MCP server lets AI clients such as Claude, Cursor, Cline, Continue, Goose and ChatGPT use the tools of your self-hosted install on a user's behalf. It is off by default. To enable it, you give MCP its own hostname, route that hostname to the API, and set two variables. Users then sign in to your install with OAuth from their client.

How MCP is served

The API serves MCP at the path /mcp, on port 9000 inside the nodaro container.
The web server on port 3000 refuses MCP requests. A request to /mcp on the app's main address answers 405 with the error wrong_mcp_host and the address of the real endpoint.
So MCP needs its own hostname, such as mcp.nodaro.example.com, whose traffic reaches the API directly.
Sign-in stays on your main domain. The OAuth discovery document /.well-known/oauth-authorization-server and the consent screen are served on PUBLIC_URL.

Enable MCP

Route an MCP hostname to the API

Create a DNS record for mcp.<your-domain> that resolves to your server. Do not proxy it through a CDN: proxies break the long-lived Server-Sent Events connections that MCP uses.

The compose file does not publish the API port. Publish it on the loopback interface, under the nodaro service:

  nodaro:
    ports:
      - "3000:3000"
      - "127.0.0.1:9000:9000"

Then give your reverse proxy a second site for the MCP host that forwards to 127.0.0.1:9000 instead of 127.0.0.1:3000. Keep response buffering off, as in the nginx example.

Add the MCP hostname as a custom domain of the backend service:

railway domain add mcp.your-domain.com --service backend

Or, in the Railway dashboard: Project › backend service › Settings › Domains › Add custom domain. Then add the CNAME record at your DNS provider.

Set the variables

MCP_ENABLED=true                              # required; the default is off
MCP_PUBLIC_URL=https://mcp.your-domain.com    # the hostname from step 1

On the compose stack, add both under environment: of the nodaro service: the compose file does not pass them from .env. Then run docker compose -f docker-compose.community.yml up -d.

MCP_PUBLIC_URL is the identity that the discovery endpoints advertise for the protected resource (RFC 9728), and the base of the upload links that tools return. Without it, your install advertises the Nodaro Cloud MCP host. If you serve MCP on your main domain instead of a subdomain, set it to the same value as PUBLIC_URL. Requests to /mcp must then still reach the API port directly.

Check the discovery endpoints

curl https://mcp.your-domain.com/.well-known/oauth-protected-resource
curl https://your-domain.com/.well-known/oauth-authorization-server

Both must return JSON with status 200.

Add the connector in your client

The MCP endpoint is https://mcp.your-domain.com/mcp. In Claude, open Settings › Connectors › Add custom connector and enter that URL. For other clients, see Connect a client and use your own MCP URL instead of Nodaro Cloud's.

Which clients can register

MCP clients sign in with OAuth. Supported clients register themselves with your install through dynamic client registration (RFC 7591). Two variables control it, and their defaults suit most installs:

Variable	Default	What it does
`MCP_DYNAMIC_REGISTRATION`	`allowlist`	`allowlist` accepts only the client names in `MCP_DCR_ALLOWLIST`. `open` accepts any client. `off` disables dynamic registration.
`MCP_DCR_ALLOWLIST`	14 known clients	The client names accepted in `allowlist` mode, comma-separated.

The default allowlist is: Claude, Claude Code, Cursor, Cline, Continue, Goose, ChatGPT, OpenAI, Lovable, Gemini, Gemini CLI, Codex, MCP Inspector and mcp-inspector. To add your own client, set the full list:

MCP_DCR_ALLOWLIST=Claude,Cursor,Cline,Continue,Goose,YourCustomClient

allowlist is the recommended mode.

What the clients can do

The MCP server covers the generation tools for image, video, audio, characters, locations and objects, and tools for the gallery, workflows, apps, saved components and models. Each user acts as their own account on your install. See the MCP tools reference and MCP troubleshooting.

MCP on a self-hosted install