Smithery

Smithery is a hosted gateway and registry for MCP servers. Once Clone's MCP HTTP endpoint is live at https://<your-domain>/mcp, you can publish the URL to Smithery and end users install it from any MCP-aware client (Claude Code, Cursor, Claude Desktop, etc.) without touching their local config.

Publish

npx -y @smithery/cli mcp publish "https://<your-domain>/mcp" -n <namespace>/clone

Smithery then scans the endpoint, generates a server page, and exposes the install flow. Each end user provides their own CLONE_API_TOKEN in Smithery's config UI, and that token is forwarded as Authorization: Bearer … on every upstream request — so one Clone MCP instance serves many users without holding a shared key.

Per-user token forwarding

The Clone MCP server in HTTP mode (MCP_TRANSPORT=http) is multi-tenant by design. apps/mcp/src/http.ts reads the bearer off each request's Authorization header (or the configured CLONE_API_TOKEN env as a fallback for single-tenant deployments) and forwards it upstream. nginx's /mcp location explicitly forwards both Authorization and mcp-session-id:

proxy_set_header Authorization $http_authorization;
proxy_set_header mcp-session-id $http_mcp_session_id;

Static MCP card

apps/web/public/.well-known/mcp/server-card.json is a static MCP server card that Smithery can scan without authentication, so the listing renders even when the upstream API is briefly down. Update it whenever you change the server's name, description, or tool list.

Verifying the publish

curl -sS https://<your-domain>/mcp/health      # → 200 OK from the MCP server
curl -sS https://smithery.ai/api/mcp/<namespace>/clone  # check Smithery has indexed it

If Smithery's listing shows tools but install fails for end users, the most common cause is that proxy_buffering is on for /mcp — Streamable HTTP requires it disabled for the long-poll connection.