Self-host a shared Graphify MCP server

The open-source MCP server usually runs on your machine over stdio, one per developer. Run it over HTTP instead and one server can answer every teammate and agent. This recipe runs it in Docker with an API key, behind TLS, and refreshes the graph without a restart.

What you’ll build

A Graphify MCP server on HTTP at /mcp, protected by an API key.
A Docker container that runs as a non-root user and reads a mounted graph.
Agents connected to it from Claude Code and other MCP clients.

Setup

git clone https://github.com/Graphify-Labs/graphify
cd your-repo
uv tool install graphifyy
graphify extract . --code-only

You’ll serve graphify-out/graph.json. Generate a long random key and keep it in your secret manager:

export GRAPHIFY_API_KEY="$(openssl rand -hex 32)"

Step 1: Run it locally over HTTP

uv tool install "graphifyy[mcp]"
graphify-mcp graphify-out/graph.json --transport http --port 8765

The server reads GRAPHIFY_API_KEY and logs api-key required. It binds to 127.0.0.1 by default. Check that the key is enforced:

curl -s -o /dev/null -w "%{http_code}\n" -X POST http://127.0.0.1:8765/mcp
# 401

Requests must send the key as Authorization: Bearer <key> or X-API-Key: <key>. Without one, the server returns 401 with {"error": "unauthorized"}.

Step 2: Build the Docker image

The repository includes a Dockerfile. It installs the mcp extra on python:3.12-slim, runs as user 10001, and serves /data/graph.json on port 8080:

cd graphify
docker build -t graphify-mcp .

Step 3: Run the container

docker run -d --name graphify-mcp \
  -p 127.0.0.1:8080:8080 \
  -e GRAPHIFY_API_KEY \
  -v "$PWD/../your-repo/graphify-out:/data:ro" \
  graphify-mcp

Inside the container the server binds 0.0.0.0, so it can take traffic from Docker. Publishing on 127.0.0.1 keeps it off the network until a proxy sits in front. If you start it on 0.0.0.0 without a key, the server prints a warning that the graph is exposed unauthenticated. Don’t ignore it.

Step 4: Put TLS in front

Never send the key over plain HTTP. Put a reverse proxy such as Caddy in front:

graph.internal.example.com {
  reverse_proxy 127.0.0.1:8080
}

For single sign-on, put an identity-aware proxy in front as well, and keep the API key as a second check.

Step 5: Connect your agents

claude mcp add --transport http graphify https://graph.internal.example.com/mcp \
  --header "Authorization: Bearer $GRAPHIFY_API_KEY"

For clients configured with JSON:

{
  "mcpServers": {
    "graphify": {
      "type": "http",
      "url": "https://graph.internal.example.com/mcp",
      "headers": { "Authorization": "Bearer ${GRAPHIFY_API_KEY}" }
    }
  }
}

Ask your agent: “Use graphify to find what calls the payment retry handler.”

Step 6: Refresh the graph

The server checks the graph file’s modification time and size, and reloads when they change. Rebuild in CI and copy the new graph.json into the mounted folder. No restart needed.

When it goes wrong

Every request returns 401. The key doesn’t match, or the proxy strips the Authorization header. Try X-API-Key, or call the container directly to rule out the proxy. HTTP transport needs the mcp extra. Install graphifyy[mcp]. The Docker image already has it. Requests are rejected for the Host header. When bound to a specific address, the server only accepts that address and localhost as the Host. Bind 0.0.0.0 behind your proxy, as the image does. Behind a load balancer, sessions drop. Start with --stateless so any instance can serve any request.

Production patterns

Rotate the key like any other secret, and give each team its own server and key.
Mount the graph read-only, as in Step 3.
Use --path to serve at a path other than /mcp.
Graphify, the hosted product, runs this for you with sign-in, team access and automatic rebuilds. See Connect cloud coding agents.

Complete example

export GRAPHIFY_API_KEY="$(openssl rand -hex 32)"
(cd your-repo && graphify extract . --code-only)
(cd graphify && docker build -t graphify-mcp .)
docker run -d --name graphify-mcp -p 127.0.0.1:8080:8080 -e GRAPHIFY_API_KEY \
  -v "$PWD/your-repo/graphify-out:/data:ro" graphify-mcp
curl -s -X POST http://127.0.0.1:8080/mcp \
  -H "Authorization: Bearer $GRAPHIFY_API_KEY" \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

What you built

One MCP server, behind TLS and an API key, that serves your code graph to every teammate and agent, and picks up new graphs without a restart.

Next steps

Shared HTTP server

Reference for running the MCP server over HTTP.

Shared team graph

Keep the graph that you serve up to date.

Try it in Graphify

We build and host the graph for you. Start with a 14-day Pro trial, then keep up to 3 repositories on Free. No card required.

Essentials

Team

Agents

Data

CI and Ops

Self-host a shared Graphify MCP server

What you’ll build

Setup

Step 1: Run it locally over HTTP

Step 2: Build the Docker image

Step 3: Run the container

Step 4: Put TLS in front

Step 5: Connect your agents

Step 6: Refresh the graph

When it goes wrong

Production patterns

Complete example

What you built

Next steps

Shared HTTP server

Shared team graph

Try it in Graphify

​What you’ll build

​Setup

​Step 1: Run it locally over HTTP

​Step 2: Build the Docker image

​Step 3: Run the container

​Step 4: Put TLS in front

​Step 5: Connect your agents

​Step 6: Refresh the graph

​When it goes wrong

​Production patterns

​Complete example

​What you built

​Next steps

Shared HTTP server

Shared team graph

Try it in Graphify

What you’ll build

Setup

Step 1: Run it locally over HTTP

Step 2: Build the Docker image

Step 3: Run the container

Step 4: Put TLS in front

Step 5: Connect your agents

Step 6: Refresh the graph

When it goes wrong

Production patterns

Complete example

What you built

Next steps