# Deploy a private MCP instance

Use your managed workspace to count words, copy the instance's MCP endpoint and control who can call it. Ask the operator for the HTTPS address, the installation CA certificate and your own caller token.

## Run Text stats

1. Open the managed Hub after configuring the operator-issued CA in your browser. Select **Deploy Text stats** on the managed home, or **Use Text stats** from a linked public catalog.
2. Enter your caller token. Confirm that **Text stats** is selected and **Private instance** is checked. Choose **Deploy instance**.
3. Select the new instance as the worker endpoint. Enter `Quarterly revenue increased.` and choose **Count words**. The instance returns `3`.
4. Copy the instance endpoint to a Streamable HTTP client. Send the bearer credential in the client header. The URL can be copied without the token. [Connect an MCP client](clients.md)

For a cleaning preview, select **Text cleaning** instead. Enter a short document and choose **Run preview**. Compare the original and proposed rows. Execution of a cleaning preview requires explicit approval tied to its digest.

## Private and shared instances

An authenticated caller can create an instance, list visible instances and open an individual MCP endpoint. An administrator can inspect instances within the host trust boundary. With `private: true`, access is limited to the creator and administrator. With `private: false`, other authenticated members can discover and use the instance. The hub checks ownership and visibility on each instance operation, including MCP requests. Keep bearer tokens in headers. Revoke a named key with `bin/daedro-mcp-hub revoke-key --config-dir "$PRIVATE_DIR" --name analyst-demo` when the user no longer needs access.

For these commands, first define the authenticated curl helper and `HUB_URL` on the operator host. Then select the caller credential in the shell session. [Authenticated curl setup](operations.md#send-authenticated-requests) The list response contains an `instances` array. The following requests deploy a private cleaning instance and list visible instances.

```sh
TOKEN_FILE="$PRIVATE_DIR/clients/analyst-demo.token"
hub -H 'Content-Type: application/json' --data-binary '{"profile":"cleaning","private":true}' "$HUB_URL/api/v1/instances"
hub "$HUB_URL/api/v1/instances"
```

Configure the MCP client for Streamable HTTP at `https://127.0.0.1:8792/mcp/instances/INSTANCE_ID` using the CA for this installation and your bearer token. The instance negotiates its own tools. The HTTP equivalents are `GET /api/v1/instances/INSTANCE_ID` and `POST /api/v1/instances/INSTANCE_ID/call`, with the same `{tool,arguments}` call envelope. The instance owner or administrator can delete it with `DELETE /api/v1/instances/INSTANCE_ID`. For a word-count tool, deploy profile `text-stats` and send `{"tool":"word_count","arguments":{"text":"Quarterly revenue increased."}}` to its call endpoint. The output contains `result.structuredContent.word_count` with the value `3`. You can also select the Text stats instance on the home page and click **Count words**.

## Finish the session

Remove the instance when you are finished with its workers. Clearing the browser session forgets the local token and inputs. A running instance keeps its own lifecycle. Users with a reviewed package can select its approved profile in the same form. [Upload and review packages](packages.md) · [Authentication and limits](operations.md)