Hosted MCP Servers for Claude, Cursor and Codex: Checklist

POST a JSON-RPC initialize request to https://mcp.moltlinestudio.com/ before you trust any vendor comparison. Most hosted MCP platform pages show logos and tool counts, not transport details.

That gap matters because the 2025-03-26 MCP spec (https://modelcontextprotocol.io/specification/2025-03-26/basic/transports) defines stdio and Streamable HTTP as the two standard transports. Streamable HTTP uses a single endpoint per server. If you cannot POST to that endpoint, your client integration will fail regardless of how many tools the platform advertises.

This post gives you a four-test checklist to compare hosted MCP servers for Claude, Cursor and Codex. You will learn how to verify a direct Streamable HTTP endpoint. You will also check whether the server works with no signup. Then you will see what the paid tier actually unlocks and whether a public URL proves the result. Finally, we wire the same endpoint into all three clients and name the checklist's limits.

Moltline's catalog (/servers.html) is the worked example. It has 110 free tools, 50 premium tools behind a $19/month All-Access licence, and public audit URLs per server. Run those tests on one server before you compare platforms.

Run One Request Before You Compare Any Platform

curl -s https://mcp.moltlinestudio.com/<server> \
 -H 'content-type: application/json' \
 -H 'accept: application/json, text/event-stream' \
 -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Most hosted MCP server lists rank vendors on marketing claims. Almost none tell you what to run to check the claim yourself. This checklist does.

Run that request against a live server, such as the first server on /servers.html. No Authorization header was sent, so nothing was unlocked by a secret. The reply should be a JSON-RPC result object with a tools array. Each entry carries a name, description and inputSchema.

Before you compare platforms, learn two status codes:

• HTTP 401: the server wants credentials.

• HTTP 402: a payment gate.

Treat these as separate tests. A server can pass one and fail the other.

The four tests, in order:

1. Direct Streamable HTTP endpoint.

2. Keyless access.

3. Paid-tier scope.

4. Public audit URL.

This order matters. A marketing page cannot answer test one. A keyless tools/list can. For background on what else to inspect, see What to Look for When Evaluating an MCP Server.

One method note: the MCP spec states protocol semantics are identical on every transport. A passing tools/list is therefore evidence about the protocol, not only the transport. See the MCP transports specification.

Test 1: Does the Server Have a Direct Streamable HTTP Endpoint?

Test 1 checks the transport itself. The 2025-03-26 spec defines two standard transports, stdio and Streamable HTTP, and states clients SHOULD support stdio whenever possible (Transports, 2025-03-26).

Stdio means the client launches the server as a local subprocess and speaks JSON-RPC over stdin/stdout. A hosted server removes that launch step. That removal is the entire basis for the paste-a-URL claim. For the longer version of that trade-off, see stdio vs. Streamable HTTP: Which Should You Use?.

Streamable HTTP means each message is an HTTP POST to a single MCP endpoint, with replies arriving as a JSON object or a request-scoped SSE stream (Transports, 2026-07-28). A 200 response is not enough. Verify:

• One URL per server, not a shared gateway path.

• A documented protocol version header.

• Defined session id handling.

• Documented custom header behaviour.

The draft binding covers these details and is still a draft, so rules may change (draft Streamable HTTP binding).

Moltline's 22 hosted servers each get their own path at mcp.moltlinestudio.com/. The endpoint you test is the server you get. Pick one from the server list and POST to its path.

Limit: a passing endpoint test does not prove your installed Claude, Cursor or Codex version supports remote Streamable HTTP. That is a separate test, covered later.

Test 2: Does It Work With No Signup?

Keyless means one thing here: no Authorization header, no API key, no account, no trial expiry, and real tool output in return. Vendors stretch "free" past that, so verify it.

Send the same tools/list POST twice against the same endpoint, first without your auth header, then with it.

curl -s https://mcp.moltlinestudio.com/<server> \
 -H 'content-type: application/json' \
 -H 'accept: application/json, text/event-stream' \
 -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Compare the two tools arrays. If the authenticated call returns more, the free tier is a demo. The anonymous request saw a subset.

Moltline's worked example: 22 hosted servers expose 160 tools. 110 are free forever, with no account, no API key and no signup. The other 50 need the $19/month All-Access licence.

Failure signatures to expect

• 401 with a WWW-Authenticate header: credentials required.

• 402: payment gate.

• 403: policy block.

• 200 with an empty tools array: the server is up but gated. Fail this test, do not pass it.

Code meanings are documented in MDN's HTTP status reference.

Keyless matters for agent wiring. A keyless URL drops into a Claude, Cursor or Codex config with no secret in a plaintext file and nothing to rotate. See MCP Servers With No API Key: 10 That Actually Work (Tested) for the same pattern.

Copy an endpoint from this server's page and repeat the test in under a minute.

Test 3: What Does the Paid Tier Actually Unlock?

Test 2 proved keyless access. This test prices the rest. Ask the buyer's question: what changes the moment you pay?

For Moltline, one $19/month All-Access licence unlocks the other 50 premium tools on top of the 110 free ones. Payment is in cryptocurrency, through NOWPayments at checkout or as 19 USDC on Base when an agent buys the month over x402. The free tier keeps working unchanged.

Run this:

curl -i https://moltlinestudio.com/api

Trimmed sample; re-run to capture your own:

HTTP/2 402
content-type: application/json

402 is the payment gate, separate from 401. The body carries the x402 challenge: price, network, asset. An agent reads it and settles on-chain with no human in the loop. HTTP semantics are shared across versions, so no bespoke client is needed (RFC 9110).

Compare the tiers:

The licence buys tools, not guarantees. No uptime commitment, no SLA, no tenant isolation, no audit logging. Moltline Studio is one person who builds and runs every server. No marketplace or reseller layer.

If the 110 keyless tools cover your task, stop there. Buy the licence only when a named premium tool blocks your build. Test 4 checks whether the grade is public.

Test 4: Is There a Public Way to Check the Result?

Test 3 told you what the paid tier unlocks. Test 4 asks whether anyone outside the vendor can confirm it. A vendor's own claim about its own server is not evidence. A public, openable result URL is. If the grade is unpublished, the vendor is asking you to trust a screenshot.

Moltline's 22 hosted servers are MCPize-audited. Grades run A+ to B+, and the catalogue sits at A, 94/100. Each server's MCPize result URL is published next to its grade. Open one entry on /servers.html and follow the audit link before you read the product copy. That link is the evidence; the marketing page is not.

Other free public checks:

• A free 21-check agent-readiness checker at moltlinestudio.com/agent-check.html

• A SKILL.md linter

• 138 SKILL.md agent skills open on GitHub at GarphenGate/moltline-oss

• Bundles distributed through Agensi

How to Run the Check walks through the agent-readiness score without an account.

Be honest about what a grade proves. It covers spec conformance and configuration checks at one point in time. It does not prove uptime, output quality, or that your installed client version behaves the same way. The MCP security guidance lists confused deputy, token passthrough and SSRF as real concerns, and a conformance grade does not clear them.

Failure rule: if an audit result URL 404s or the grade is not published, that is a fail on this test. Do not accept a screenshot in place of a link. If it clears, the next question is whether your client connects to it.

Wiring the Same Endpoint Into Claude, Cursor and Codex

A published grade tells you the endpoint passed on audit day. It says nothing about your installed client.

The MCP specification pages describe transports, not client support. These sources contain no published evidence that Claude, Cursor or Codex each connect to a remote Streamable HTTP server exactly as the spec describes. Test per client and record the result. The Streamable HTTP binding is the reference for what the server should do.

The steps that work across all three:

1. Add the URL as a remote MCP server in the client.

2. List the tools.

3. Call one read-only tool, then compare the returned tool list against your earlier curl tools/list output.

Claude and Cursor take the URL through remote server or connector settings. Codex CLI takes it as a config entry pointing at the endpoint. Check your installed version before assuming either path.

Three breakage points to check when it fails:

• The client sends only text/event-stream in Accept while the server replies with JSON, or the reverse.

• A session id is not echoed back on the next request.

• A proxy strips the protocol version header.

Keep a reproducible log:

Client behaviour changes between releases. A pass without a version and a date is not reproducible.

For a known-good endpoint, start with Connect, then test your client against a specific server page.

What This Checklist Cannot Prove

Those client tests leave three gaps open. The checklist proves reachability and gating, not reliability. A keyless tools/list that answers today says nothing about uptime, latency or behaviour under load. One 200 response is one data point.

The same gap applies to output quality. A tool can be listed, documented and schema-valid, then return wrong or shallow results on your data. The checklist cannot see that. You have to call the tool with a real input and read the output.

Three things no endpoint test settles

• Reliability. Nothing here measures load behaviour. A pass today is a single sample, not a trend.

• Tool quality. Discovery and correctness are different properties. A well-formed schema still permits a useless answer.

• Client compatibility. Nothing in the MCP transport specification confirms that your installed Claude, Cursor or Codex build connects to a remote Streamable HTTP server as described. Treat every pass as dated, and record the client version beside the result.

Version drift and grade scope

The transport binding sits in a spec that still changes between revisions. Re-fetch the pages before quoting exact wording or header rules in your own documentation.

A grade is a point-in-time check, not a certification. MCPize grades cover spec conformance and configuration on audit day. They do not assert SOC 2, audit logging or tenant isolation.

Free-tier counts are published as they stand today: 22 servers, 160 tools, 110 free forever. Re-run the keyless request before you build a dependency on a specific tool count. Tool discovery inside Claude Code also shifts between releases, and the community write-up on how Claude Code sees available tools covers that client side.

Next Step: Run the Four Tests on One Server

The checklist only matters if you run it. Pick one server from the server index and fire the keyless request:

curl -s https://mcp.moltlinestudio.com/<server> \
 -H 'content-type: application/json' \
 -H 'accept: application/json, text/event-stream' \
 -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Keep the reply. That JSON is your baseline for every later comparison.

Then open that server's MCPize result URL and read the grade before you read the product page. The grade is the check; the marketing copy is not.

If a 402 comes back where you expected a tool list, you have hit the payment gate. Read the challenge from /api first, then decide whether the 50 premium tools justify the $19/month All-Access licence. Free MCP tools you can paste in right now is the cheaper starting point if the 110 free tools already cover your task.

Log the client name, version, negotiated protocol version and date next to each result. A pass without those is not reproducible, and client behaviour shifts between releases.

If a server fails Test 1 or Test 2, stop there. Four tests, ten minutes, no vendor ranking needed.

Conclusion

Four tests, ten minutes. That is the whole comparison method.

• A direct streamable HTTP endpoint plus a keyless handshake is the price of entry. If either fails, stop.

• The paid tier only matters once you know what it unlocks: 110 free forever tools against 50 premium ones behind the $19/month All-Access licence.

• Read the public MCPize result URL before the product page. An A+ to B+ grade is evidence; marketing copy is not.

• Log client name, version, negotiated protocol version and date beside every result. A pass without that is not reproducible.

Start with one server from the server index and run the curl request today. Keep the JSON. That baseline beats any vendor ranking.