Transports¶

stdio (default)¶

neon-mcp (or neon-mcp --transport stdio) serves one client over standard input and output — the usual setup for Claude Code, Claude Desktop, Codex CLI, OpenCode and Antigravity. Only MCP framing goes to stdout; logs go to stderr. The configured token is used for every NEON request, and neon_download_files is available.

Streamable HTTP (stateless)¶

neon-mcp --transport http serves¹:

Every response carries X-Request-Id (yours, if you sent a well-formed one). Request bodies are capped at 1 MiB.

Host and origin checks¶

DNS-rebinding protection is on automatically for loopback binds. For a public deployment set server.public_base_url (its host and origin join the allow-lists) and optionally server.allowed_hosts / server.allowed_origins; a request with any other Host gets 421. Behind a proxy that rewrites Host, set server.dns_rebinding_protection = false.

Per-request NEON tokens¶

Callers send their own NEON token in X-API-Token (configurable with server.request_token_header). It is honoured only when server.public_base_url starts with https:// — i.e. TLS terminates in front of the server — or when server.allow_insecure_header_token is set for development; otherwise the header is stripped and one warning is logged. Over HTTP the token is sent only to NEON's token-only endpoints, and the operator's configured token is not used for anonymous callers unless server.share_config_token_over_http is set.