Remote MCP servers or local stdio installs

Versely does not give you a choice between a hosted generation stack and a fully local one. Generation runs on the hosted catalog either way. What you choose is how the client reaches https://mcp.versely.studio/mcp: an OAuth connector in a browser, an HTTP MCP entry with a vsk_ key that the CLI wrote into an agent config, or a local stdio process that still forwards to that same hosted URL.

The remote OAuth path is the one the MCP page documents: paste the URL into a connector UI, sign in, done. The CLI path is still a remote HTTP server; versely install writes a Bearer key into the agent config rather than spawning a process. The stdio path is a process on your machine: Versely's in-app Claude Desktop recipe runs npx -y mcp-remote against that URL with an API key in the command and in env. Same tools, same credits, different failure modes. Pick on those, not on a feeling that "local" means offline.

Three ways to reach one hosted server

Remote (Streamable HTTP + OAuth). The client speaks MCP over the network to https://mcp.versely.studio/mcp. Auth is the OAuth 2.1 handshake: dynamic client registration, PKCE, a consent screen, an access token whose aud is that URL, a refresh token that lasts 30 days. No Node binary on your laptop. No vsk_ key in a JSON file. The secret is a token the client holds in its session, scoped to the MCP resource, expired in an hour unless refreshed.

This is the shape claude.ai's Settings → Connectors flow uses. It is also the shape you want on a machine you do not want credentials sitting on.

Remote HTTP with a key (CLI-wired). After versely auth login, versely install detects agents and writes an HTTP MCP entry pointed at https://mcp.versely.studio/mcp, with Authorization: Bearer carrying a vsk_ key. Claude Code gets that shape in ~/.claude.json; Cursor and Codex get the same idea in their own configs. There is no local MCP process to spawn. The server is still the hosted one. The secret is now a long-lived key on disk, as powerful as the scopes you gave it.

Local stdio (a process, a key, a config file). The MCP client starts a command and talks to it on stdin/stdout. The in-app Claude Desktop recipe is exactly that: npx -y mcp-remote https://mcp.versely.studio/mcp --header Authorization:Bearer <key>, with VERSELY_AUTH set to the same Bearer value in env. The process is local. The server it proxies to is still the hosted one. You now also have Node, npx, and a cold start in the path.

Not in this comparison: an air-gapped MCP server that generates on your GPU. Versely does not ship that. If the box cannot reach mcp.versely.studio and api.versely.studio, none of the three will generate.

The comparison that actually decides it

	Remote OAuth connector	CLI-wired HTTP + vsk_ key	Local stdio (mcp-remote)
Who starts the server	Nobody on your machine	Nobody on your machine	Your agent, via command + args
Auth	Sign in, PKCE, 1-hour access token	vsk_ key in the agent config	vsk_ key in the command and env
Secret at rest	Refresh token in the client's store	Key in a JSON file	Key in a JSON file, plus whatever npx caches
Node / npx required	No	No	Yes, for the shim
Works in claude.ai (browser)	Yes	No	No (there is no local process to spawn)
Works on a headless box	Only if the client can refresh without a browser	Yes, once the key is on disk or in env	Yes, if Node can run
Blast radius if leaked	That client's token, 1-hour access, 30-day refresh	The key, until you revoke it	The key, until you revoke it
Scope	Whatever the consent screen granted	Whatever you set on the key at creation	Whatever you set on the key at creation
Survives a laptop reimage	Reconnect, sign in	Key is gone unless you stored it elsewhere	Same
Typical operator	A person in a chat client	A developer in Cursor / Claude Code / CI	Claude Desktop, or any agent that can only spawn a command

The row that surprises people is "works in the browser." A stdio server cannot run inside claude.ai. If your users live there, remote OAuth is not a preference. It is the only transport. The inverse is also true: a CI job has no one to click Allow on a consent screen, so a key in the environment is the transport. The CLI vs MCP vs API post is the same split, asked from the initiator's point of view rather than the transport's.

The other row that matters is blast radius. An OAuth access token is an hour, bound to aud=https://mcp.versely.studio/mcp, with the scopes you saw on the consent screen. A vsk_ key is until revoked_at is set, and it will call any route its scopes include from any client that holds it. Putting all on a key you then paste into claude_desktop_config.json is how a laptop backup becomes a publish credential. Create the key with generate and read if the agent is not supposed to post.

When the remote connector is the right default

Use it when a human is present and the client supports remote MCP. That is claude.ai today, and any other host that can do OAuth against /.well-known/oauth-authorization-server. Setup is the three steps on the MCP page. There is no key to rotate in a file: access lasts an hour, refresh lasts 30 days, and nothing long-lived is sitting in a JSON config.

It is also the right default when you do not want Node on the machine. npx -y mcp-remote is a supply chain and a cold-start. The remote URL is not.

Limits to take seriously: the authorize request expires in ten minutes, the code in five, the access token in one hour. A client that cannot refresh will look "disconnected" after an hour even though nothing is wrong with Versely. Reconnect. Do not reinstall. And because consent grants whatever the client asked for (falling back to read if it asked for nothing), a connector that only requested read will list tools and fail to generate. That is a scope problem, not a transport problem.

When a key-based path earns its keep

Use stdio when the agent can only spawn a command. Claude Desktop's documented recipe is that case. npx has to resolve on every spawn unless you pin it. The process can fail for reasons that have nothing to do with Versely (Node missing, npm down, a sandbox that blocks child processes). And you are still subject to the hosted server: if MCP is up and your key is revoked, the shim will start and then 401. A green "server running" in the agent log is not a successful tool call.

Use the CLI-wired HTTP path when the agent already speaks remote MCP and you need a key rather than a consent screen. Cursor, Claude Code, Codex, and the rest of the advertised list are why the CLI exists: those agents look for an mcpServers block, and versely install writes an HTTP one. Pair it with versely auth login so the key is minted in a browser once and then lives at ~/.versely/config.json (user-readable) or in VERSELY_API_KEY for CI.

Use a key, stdio or HTTP, when the job has to run without you. A scheduled agent on a box has no consent screen. It needs a credential that still works at 3am. That is not a Claude connector.

Skills sit on top of any of these paths. npx skills add AI-XLabs-Innovation/versely-skills installs eight procedures (generate, slideshow, movie, ugc, music, social, analytics, content-pipeline). They do not replace MCP and they do not pick a transport. An agent with skills and no credential still cannot generate.

If you already automate through chat, MCP-driven content automation is the workflow layer. This post is only the socket it runs over.

FAQ

Does local stdio generate faster because it is local?

No. The shim is a proxy. Image and video jobs still run on the hosted catalog, still return a request_id, still get polled. What you skip is the OAuth redirect, not the render.

Can I point stdio at a server I host myself?

The documented server is https://mcp.versely.studio/mcp. The OAuth audience is that URL. A self-hosted MCP that does not present that resource will not satisfy the hosted token, and Versely does not publish a "run the MCP server in Docker" path on the marketing site. If you need generation from your own code without MCP at all, that is the REST API on https://api.versely.studio/api/v1, with a key you store.

The CLI installed MCP into five agents. Do I also need the remote connector?

Only for the agents the CLI cannot see. claude.ai is the usual one: it is a website, it cannot hold a vsk_ key in a local config, it needs the connector URL. Your laptop's Cursor is the other way around. Running both against the same account is fine. They share a credit balance. They do not share a token.

Where should the API key live if I am not on OAuth?

In the Desktop config's command/args and VERSELY_AUTH env, which is what the in-app recipe writes. For the CLI-wired HTTP path, the key lives in ~/.versely/config.json after versely auth login, or in VERSELY_API_KEY for CI. Not in a committed mcp.json. Not in a screenshot of the guide. Rotate it if it leaked; the raw value is shown once at creation. The developer page is the index of the three setup paths if you need to start over.