Remote MCP Deployment Options

GBrain's MCP server runs via gbrain serve (stdio transport). To make it accessible from other devices and AI clients, run gbrain serve --http (built-in HTTP transport with OAuth 2.1 + bearer auth, works on both PGLite and Postgres brains — see DEPLOY.md) behind a public tunnel. Here are your tunnel options.

ngrok (recommended)

ngrok provides instant public tunnels. The Hobby tier ($8/mo) gives you a fixed domain that never changes.

# 1. Install ngrok
brew install ngrok

# 2. Start the built-in HTTP transport
gbrain serve --http --port 8787
# See docs/mcp/DEPLOY.md for token setup

# 3. Expose via ngrok
ngrok http 8787 --url your-brain.ngrok.app

See the ngrok-tunnel recipe for full setup including auth token configuration and fixed domain setup.

Tailscale Funnel

Tailscale Funnel gives you a permanent public HTTPS URL with automatic TLS. Free tier available. Best for private networks where you control both endpoints.

# 1. Install Tailscale
brew install tailscale

# 2. Expose your MCP server
tailscale funnel 8787
# Your brain is now at https://your-machine.ts.net

Fly.io / Railway (always-on)

For production deployments that need to run 24/7 without your machine:

• Fly.io: $5-10/mo, global edge, fly deploy
• Railway: $5/mo, git push deploy

Both run Bun natively. No bundling, no Deno, no cold start, no timeout limits.

Comparison

	ngrok	Tailscale	Fly.io/Railway
Cost	$8/mo (Hobby)	Free	$5-10/mo
Fixed URL	Yes (Hobby)	Yes	Yes
Works when laptop is off	No	No	Yes
Cold start	None	None	None
Timeout limits	None	None	None
Full remote operation surface (100+ ops, minus localOnly)	Yes	Yes	Yes
Setup time	5 min	10 min	15 min

Note: gbrain serve --http is the built-in HTTP transport. OAuth 2.1 plus bearer auth against the access_tokens table, default-deny CORS, two-bucket rate limit, body cap, per-request audit log. Works on both PGLite and Postgres brains. See DEPLOY.md and SECURITY.md for env vars and tunables.