Moving local AI projects onto public URLs turns a laptop's invisible safeguards into explicit decisions about identity, permissions, resilience, and cost.

I have been building locally with AI over the past year and I wanted to start moving what I had truly online. Taking something from prototype to hosted is normal work in my day to day. Doing it with no platform team behind me is a different story, because everything that machine had been covering for was suddenly mine to build.

Your machine in every case, is the boundary. On your own laptop you’re the whole system whether you meant to be or not, it’s your logins, network and various local dependencies. Point a public URL at the same code and it’s doubtful to work (well safely). In a company a separate team is usually overseeing the security model and the various components.

Looking at the local projects I was planning to put online they all had different reasons that were stopping them. I wanted to concentrate on MCPs I had built and a web app to understand the problems.

One of the MCP servers had no auth at all, and I mean literally nothing. Its whole security model was the OS permission to spawn the process and the fact that it only listened on localhost. On a laptop the safeguard is that nobody else can reach it, and I’d left auth out on purpose since it’s just friction there. That’s the right call for a proof of concept and completely wrong the moment it’s accessible. Hosting isn’t swapping one auth method for another as every step of that, from no auth to a key to a real login, is now mine to decide, where before it just wasn’t a question.

Then there’s the MCP I’d already done “properly”. It ran full OAuth, shipped and working, short-lived signed tokens and scopes and all of it. To connect Claude to it, though, I still had to paste in two static credentials by hand, because it was registered as a single known client with no dynamic registration. Proper OAuth that still needs two keys pasted in every time is not what “we moved to OAuth” makes it sound like, and it bothered me enough that I didn’t want to leave it there.

The web app was different again. What guards it isn’t really auth, it’s an origin allowlist and some rate limits, which trust where a request came from rather than who sent it. That’s cheap and it ships, but it’s a long way from a key or a login.

The one that pushed it hardest wasn’t even mine. Someone I’d spoken to runs most of his small-business comms through Claude Code on his Mac, WhatsApp, email, etc. He’d wired it in far enough that it was auto-replying on WhatsApp, and people working for him had been happily chatting with “him” until he noticed and turned it off. What he actually said he was worried about, though, was losing the Mac. My own work is in git, so losing the laptop would have cost me a machine and not the work, but he had no version of that. Same problem either way, scaled to one login on one machine: the machine is the boundary, and for him losing it loses the lot.

I’ve heard some version of his worry a few times now. After years of everything moving to the cloud because it was safer there, a lot of people have ended up with everything local again, on one machine, and no answer to what happens if it’s gone. Which is the same single-machine problem I was hitting from the other end, just moving out of it instead of stuck in it. Also yes there are cloud sync methods for local files but for many just starting in this area that is an additional oversight which could bite them later.

The other thing that only worked because it was local was the money.

Locally, the AI calls just rode whatever I was already logged into, no separate key, just my own session paying for it. Inference never showed up as a cost, because there was nothing to meter and nobody but me making the queries. Host the same tool and suddenly I am the budget line. Every request is now my money, and an open endpoint means strangers spending it.

In a company this is the easy part. There’s a budget, someone owns it, and a runaway loop is an annoyance with money behind it. On a personal project there’s nothing to absorb it, so the safeguards we would spend time discussing at work are my problem alone. I’m the one designing the caps and working out whether to push inference back onto users or let them bring their own local model, and I only started looking at that yesterday, so I don’t have the answer of who pays. The tools requiring inference and an AI API key behind them make hosting a question about money.

The moment any of this is on a public URL it’s on the internet, and things on the internet get probed almost immediately, regardless of preparation. Nothing I built locally was ready for that, and it was just the price of being reachable at all.

What’s still open

None of this is done, which is sort of the point. The inference question is still open, I’m working out how to make it usable without paying for everyone else’s usage. The bigger one is that I’ve ended up needing a real permission model across these, the sort of issue that in a company you’d be handed and hand off to a team who own the auth layer or use an existing pattern. On my own there’s no team to hand it to. I know what needs building and I’ve done this shape of work, it’s just that the part a platform team would normally absorb is now mine to design and own.

Since writing this I’ve sorted that OAuth item mentioned earlier. It now runs a proper identity provider through WorkOS instead of hand-pasted keys, which is what finally made me learn WorkOS properly. I’m not paying for the full production tier, $99 a month for a custom domain is overkill here, but it’s the real tool sized to what this actually is.

I’m writing each of these up properly as the sites go live over the next few weeks. Step Out, the community project built during the Claude Impact Lab Hackathon, is live now so people can actually try it (although it’s limited real use calls sorry!). MoveSet which is where I’ve implemented WorkOS auth for its MCP connection, I’m still finishing in the background. The process is the interesting part on both, and it’s not something you can honestly cover until you’ve actually done it.