---

name: mcp-remote-server-consumption description: Use when pointing an agent client (Claude Code, an IDE, a custom agent) at a remote streamable HTTP MCP server that requires a Bearer API key, rather than launching a local stdio server. Covers registration, header auth, and distinguishing missing-key from bad-key from a genuinely unreachable server.

Consuming a Remote HTTP MCP Server

When to trigger

Wiring a hosted MCP endpoint (a service you or a vendor runs at a URL) into a client, instead of spawning a local subprocess. The worked example is the Developers Digest endpoint at /api/mcp, which serves credit-metered tools over streamable HTTP and requires Authorization: Bearer dd_live_....

stdio launches a process; HTTP connects to a URL

A remote server is already running. You do not give the client a command and args; you give it a url and the transport type, plus the credential. Nothing is installed locally.

{
  "mcpServers": {
    "dd-platform": {
      "type": "http",
      "url": "https://developersdigest.tech/api/mcp",
      "headers": { "Authorization": "Bearer ${DD_API_KEY}" }
    }
  }
}

Auth lives in a header, referenced by env

• Pass the key in the Authorization header, never in the URL query string (URLs leak into logs and history).
• Reference the key by env var (${DD_API_KEY}), not a literal, so a checked-in project config never ships the secret.
• A remote MCP transport has no session. Every tool call re-resolves the caller from the key, so a revoked key stops all tools at once, mid-session.

Confirm before wiring it in

Hit the endpoint directly first so a connection failure is not ambiguous:

curl -sS -H "Authorization: Bearer $DD_API_KEY" https://developersdigest.tech/api/mcp

A 401 means the key is missing or bad; a connection error means the URL or network is wrong; a valid handshake means the client config is the only thing left to fix.

Pitfalls

• A missing or malformed Authorization header reads as "disconnected" in most clients, with no hint that it was an auth failure. Verify the key with curl before blaming the config.
• Putting the key in the URL instead of a header leaks it into request logs and browser history. Use the header.
• Committing a project-scope config with a literal key ships it to the repo. Reference an env var and document it.
• Credit-metered remote tools charge per successful call. A retry loop on a flaky tool spends real credits; treat a tool-level isError result as a stop, not a reason to hammer.