Share MCP servers with people you trust — peer to peer, no accounts, no cloud.
MCP servers — your notes, your code search, your scripts — run locally, wired into your AI client. The moment you want a friend's AI to use one of them, today's answer is heavyweight: host it on the internet, add OAuth, create accounts, trust a cloud middleman.
Register any MCP server under a name you pick, hand one person an invite, and their AI client — Claude Desktop, or anything that speaks MCP — mounts it as if it were local. Requests travel an encrypted connection straight between your two machines.
Nothing is published to the internet. Your server keeps running where it always did — on your machine.
No signup, no OAuth, no directory. Identity is a keypair on your device; names are nicknames you choose.
iroh/QUIC with NAT hole-punching: end-to-end encrypted, machine to machine. No server of ours in the trust path.
Register any MCP server under a name you pick.
Mint a one-time, expiring invite for that share.
Your friend redeems it — the machines now trust each other.
pair prints the exact command to wire it into their AI client.
$ mcpmesh serve notes -- npx -y @modelcontextprotocol/server-filesystem ~/notes $ mcpmesh invite notes One-time invite (expires in 24h): mcpmesh-invite:… ← send over any channel
$ mcpmesh pair mcpmesh-invite:… Paired with you — code: tango-fig-cabbage You can now use: you/notes To use in Claude Code, run: $ claude mcp add you-notes -- mcpmesh connect you/notes Their AI can now search your notes.
After pairing, both machines display the same short code. Read it to each other out loud — matching words mean the pairing is authentic. The invite channel doesn't need to be secure: tampering with an invite makes the codes mismatch.
Bob's AI thinks it's talking to a local MCP server. The proxy hands frames to a per-user daemon, which dials Alice's device directly and is vetted at her door before her real server hears a word.
No service is reachable until you run serve + invite, and every grant names exactly who gets access to exactly which service. Grants accumulate; none is implied.
Device keys never leave the machine. People are verified device→user bindings, so sharing with a person reaches all their paired devices — still with no registry anywhere.
mcpmesh pair --remove alice cuts a peer off from your services immediately. status shows everything you serve and reach; doctor health-checks the setup.
mcpmesh authenticates who you're talking to and encrypts the pipe — it does not vet what a peer's server says. Treat a peer's tool output like any content from that person.
Pairing is person-to-person. Roster mode layers team membership on the same machinery: an operator runs mcpmesh org create, members mcpmesh join, and membership lives in a signed roster document on any static web host.
The org root key signs the roster. The web host, the network, and the gossip layer are all untrusted transport — they can only fail to deliver, never forge.
A roster is a JSON file. Serve it from a bucket, a Pages site, a closet server — nodes poll the URL and gossip newer serials to each other.
Removing a member publishes a new roster serial; every node converges on it and cuts the member's live sessions everywhere.
mcpmesh-local/1) clients and plugins build on