What a Custom MCP Server Costs to Build and Run

A custom MCP server costs between $15,000 and $220,000 to build, depending on scope, plus 10 to 30 percent of the build cost every year to keep it running. That is the honest range after reading vendor pricing pages, build-versus-buy analyses, and the protocol's own specification. This post breaks down where those numbers come from, what the running costs actually are, and how to decide whether you should build one at all.

What an MCP server actually does

The Model Context Protocol is the open standard that lets an AI model like Claude call external tools and read external data in a structured way. An MCP server is the piece of software that exposes those tools: it might let Claude look up a customer in your CRM, create a ticket in your helpdesk, or run a query against your data warehouse.

Two facts matter for the cost discussion. First, the ecosystem already ships a large public catalog. Anthropic maintains a repository of reference servers with over 91,000 GitHub stars, and the official MCP Registry lists published servers you can install today. Second, the protocol is young and still moving. The 2026 MCP roadmap from the project's lead maintainer lists transport scalability, agent communication, and enterprise readiness as the active work areas, which means the specification your server is built against will keep changing.

So the real question is rarely "what does an MCP server cost to write." It is "what does it cost to own."

The three options: use, buy, or build

Before pricing a custom build, be clear about the three ways to get an integration.

• Use an existing server. For popular SaaS tools, a server often already exists in the registry or the reference repository. Your cost is configuration time plus hosting. If what you need is covered, stop here.
• Buy a managed connector or gateway. Vendors sell hosted integrations and MCP gateways that handle auth, rate limits, and monitoring for you. You pay a subscription and accept their roadmap.
• Build a custom server. You write and operate the integration yourself, or pay an agency to. This is what the rest of the post prices.

A useful default comes from DesignKey's build-versus-buy analysis: the public catalog now covers the large majority of common integration needs, so custom builds are justified for internal systems, proprietary data, and niche workflows, not for connecting Salesforce to Claude.

What a custom build costs

Published estimates disagree, mostly because "an MCP server" can mean very different scopes. Here are the bands that hold up across sources.

• A focused, single-system server: $15,000 to $45,000. DesignKey puts a single-purpose server connecting one internal system at one to four weeks of work, $15,000 to $45,000 at agency rates. Reflekt Lab, an agency that publishes its prices, charges $2,300 to $4,700 for a paid scoping phase and starts first-workflow builds at $17,500.
• A production-grade internal product: $80,000 to $220,000. That is DesignKey's band for a server exposing several internal systems, with audit logging, SSO, role-based access, and versioning, typically eight to sixteen weeks with two engineers plus a part-time platform lead.
• An enterprise gateway: $250,000 and up. Centralized auth, policy enforcement, and observability across many teams, sixteen to thirty-two weeks.

General market guides land lower: $3,000 to $8,000 for a simple single-tool server, $8,000 to $25,000 once you add auth and permissions, and $35,000 to $90,000 for a multi-system server with write access, per the ranges Reflekt Lab collected. Truto's analysis goes the other way, quoting $50,000 to $150,000 per integration per year as a fully loaded industry figure once you count development, QA, monitoring, and support. The gap is not one side lying. The low numbers describe the code; the high numbers describe owning the integration as a product.

For broader context on how agencies price AI builds, see our AI agent development cost and pricing guide.

A worked example: three years of one integration

Take a mid-size company that wants Claude to read and write its internal CRM and ticketing system. Three realistic paths, using only the sourced numbers above.

• Lean agency path. Paid scoping at $3,500, a first-workflow build at $17,500, then $470 per month in running costs plus about $75 per month of hosting. Three-year total: $40,620. This gets one workflow done properly, with the agency carrying protocol churn.
• Production internal product. A $120,000 build inside DesignKey's band, maintenance at 15 percent of build per year ($18,000), and $1,200 a year of hosting. Three-year total: $177,600. This buys several systems, write access, SSO, and audit logging, built to be run for years.
• The support-heavy pattern. Truto's worked example is an $80,000 build with $15,000 a year in support: $125,000 over three years for one complex integration.

Two things to notice. First, year one is never the whole story; by year three, running costs are 30 to 60 percent of the total. Second, in-house builds follow the same shape. Replace the agency fee with your own fully loaded engineering rate multiplied by the same timelines: one to four weeks for the simple case, eight to sixteen weeks with two engineers for the production case, and an ongoing maintenance allocation forever.

The costs nobody quotes upfront

This is where budgets break. Four recurring items.

• Authentication. The MCP authorization specification is built on OAuth 2.1 with PKCE, plus a stack of supporting RFCs for token handling, server metadata, and protected resource discovery. Getting that right, per Kong's analysis of DIY MCP infrastructure, means an auth matrix across tools, auth methods, environments, and token types, and every piece of it needs testing.
• Security posture of what you connect to. A Fudan University study of 7,973 live remote MCP servers, published in May 2026, found that 40.55 percent exposed tools with no authentication at all, and that every one of the 119 OAuth-enabled servers they could test had at least one implementation flaw. Security researchers at Astrix found 5,205 open-source servers of which 88 percent require credentials, and 53 percent of those rely on long-lived static secrets like API keys rather than OAuth. Your custom server sits inside this ecosystem, so its security budget includes vetting every third-party server you connect to it.
• Protocol churn. The specification moves. The roadmap's top priority is reworking transport so servers can scale horizontally, and enterprise features like audit trails and SSO-integrated auth are being defined right now, mostly as extensions. Each spec revision means SDK upgrades and regression testing. Maintenance estimates run 10 to 20 percent of build cost per year (DesignKey) to 15 to 30 percent (the guides Truto cites).
• Governance and observability. Kong's hidden-cost list includes per-tool access policies, audit logging, usage dashboards, and the sprawl that appears when several teams build servers independently. None of this is in the first invoice, and all of it arrives by the second year.

When a custom build is the wrong choice

A decision checklist. If several of these are true, use the registry or buy a managed connector instead.

• A maintained server already exists for the system you want to connect, and its capabilities cover your workflow.
• Your data lives in mainstream SaaS with a public API, and you need standard read or write operations, nothing exotic.
• Nobody on your team will own the server after the build. A custom server without an owner becomes unpatched infrastructure.
• The workflow is read-only and low-volume. A $40,000 build to save someone twenty minutes a week never pays back.
• You cannot describe the workflow precisely. If the scoping conversation keeps changing what the server should do, you are buying discovery at build prices. Fix the process first, or pay a small scoping engagement to fix it.

If you are earlier in the journey and still working out whether you need custom agents at all, our guide on building custom AI agents for business covers the earlier decisions. And if the real need is moving data between mainstream SaaS tools on a schedule, a workflow built on n8n or Make is usually cheaper than any MCP server; that is the territory our business automation service covers.

When building your own server is worth it

The case for custom is real, and it is narrower than vendors on either side admit.

• Internal systems with no public connector. Your in-house ERP, your SACCO core banking system, your claims platform. Nobody is selling a server for these.
• Proprietary workflows that carry your edge. If the integration encodes how your firm prices, underwrites, or reviews, owning it is the point.
• Compliance and data residency. When data cannot leave your VPC or your jurisdiction, a self-hosted server with audited auth is often the only architecture a regulator accepts.
• Volume that makes subscriptions silly. Per-seat and per-call pricing on managed connectors scales with usage. A custom server's cost barely moves.

The pattern behind all four: the system or the workflow is specific to you. That specificity is what you are paying $80,000 to $220,000 for, and it is also why no off-the-shelf product will ever quite fit.

How to buy a build without getting burned

If you decide to build, this sequence keeps the risk where it belongs. If your own engineers are doing the work rather than an agency, our developer guide to building custom AI agents covers the technical groundwork before you price anything.

1. Check the registry and the reference repository first. Make the vendor prove no existing server covers your case before accepting a custom quote.
2. Pay for scoping separately. A $2,300 to $4,700 scoping engagement that ends in a written spec, an auth design, and acceptance criteria is the cheapest insurance in this market. Walk away from any agency that will only quote a full build.
3. Build one workflow end to end. The first deliverable should be a single workflow in production in two to four weeks, not a platform. It validates the vendor and gives you a real running-cost number.
4. Put auth and security in the acceptance tests. Require OAuth 2.1 with PKCE where users are involved, per the specification, and require a review of every third-party server the build connects to, given what the Fudan and Astrix data says about the ecosystem.
5. Price the maintenance before signing. Get an annual figure, 10 to 30 percent of build depending on how fast the upstream systems change, and decide who owns protocol upgrades when the spec moves.
6. Keep the escape hatch. Source code, deployment scripts, and documentation in your repositories, so a vendor exit is a handover, not a hostage negotiation.

Frequently asked questions

How much does a custom MCP server cost? A focused single-system server runs $15,000 to $45,000 to build. A production-grade internal product with SSO, audit logging, and several systems runs $80,000 to $220,000. Budget another 10 to 30 percent of the build cost per year for maintenance and hosting.

How long does it take to build an MCP server? A basic single-system connector takes two to three weeks of engineering. A focused production server takes one to four weeks after scoping. A production-grade internal product with multiple systems takes eight to sixteen weeks with a small team.

Can I just use an existing MCP server instead of building one? Often, yes. The official registry and Anthropic's reference repository cover most mainstream SaaS tools, and the public catalog now handles the large majority of common integration needs. Custom builds make sense for internal systems, proprietary workflows, and strict compliance requirements.

What does an MCP server cost to maintain? Estimates range from 10 to 20 percent of the build cost per year up to 15 to 30 percent, depending on how quickly the systems it connects to change and how fast the protocol evolves. Hosting itself is small, typically $50 to $100 a month.

Are MCP servers secure enough for production? The protocol has a solid authorization standard based on OAuth 2.1, but the live ecosystem is immature: a May 2026 study of nearly 8,000 servers found over 40 percent had no authentication at all. Treat security as a line item in the build, with vetting of any third-party servers you connect.

Is it cheaper to build an MCP server in-house? Only if your engineers have spare capacity and will own the result. The timelines are the same either way: one to four weeks for a single-system server, eight to sixteen weeks with two engineers for a production-grade one. Multiply those timelines by your fully loaded engineering rate, then add the same 10 to 30 percent annual maintenance. In-house builds most often go wrong on the maintenance side, when the original author moves on and nobody inherits the server.

Do I need OAuth on an internal MCP server? It depends on transport. The specification makes authorization optional, says STDIO servers should take credentials from the environment, and expects HTTP-based servers to conform to the OAuth profile. A remote server reachable over a network needs real auth regardless of what the spec permits.

Where to go from here

The expensive mistakes in this space are building something the registry already ships, and buying a build with no maintenance plan attached. If you have worked through the checklist and a custom server is the right call, our Claude implementation service includes MCP server design and delivery, and our custom builds practice handles the surrounding systems. Either way, start with scoping, not a quote.