After 300 users broke things, we moved each user's MCP servers into their own VM

mintdump · reddit · 2026-11-03

An AI ops assistant for small teams shares an architecture postmortem: for months they ran users' stdio MCP servers (Postgres, filesystem, community ones) as processes on a shared backend pool. At 300 users, three things broke in one month:

A community server leaked memory and took down a node hosting 40 other users' servers;
A filesystem server was configured wider than intended and could see beyond one user's folder;
They pulled the latest npm version of every server at startup, so anything published that morning ran for every user.

New architecture: each user gets a small Linux VM; stdio servers run inside it next to the agent (still stdio, no extra network hop). A bad server only affects one user, and a filesystem server can safely see the whole machine since it only holds that user's data.

Practices they'd repeat: keep vendor-hosted remote servers remote; pin server versions and bake them into snapshots, never install from npm at runtime; keep OAuth refresh tokens on their side, giving the VM only short-lived tokens; servers restart with the machine, so state goes to disk.

Biggest lesson: MCP servers are just code you run on behalf of your users — once treated that way, most of the scary stuff disappeared.

Original post →

After 300 users broke things, we moved each user's MCP servers into their own VM

More from coding & agent