Vectoralix
Vectoralix is a managed platform for publishing hosted Model Context Protocol servers. Upload files, sync Git repositories and attach sandboxed tools, then hand any AI client a versioned, rate-limited endpoint without running infrastructure yourself.
What is Vectoralix?
Vectoralix is a managed hosting platform for the Model Context Protocol, the standard that lets AI assistants read a knowledge base and call tools someone else has defined. Its premise is that most people who want an MCP server would rather not build one. The alternatives, as the documentation frames them, are writing the protocol layer yourself and then hosting, securing and maintaining it, or settling for a rigid third-party connector that reads a single document store and offers no custom tooling.
The described workflow has three steps. You bring content: typed documents, uploaded files, or a repository imported over OAuth from GitHub, Bitbucket or GitLab, organised with categories, groups and relations. You then attach tools. File Search exposes category listings, full-text search, file listings and related-content lookup. Code Execute runs user-authored JavaScript inside a hardened QuickJS sandbox with configurable timeouts and memory caps, debuggable in the dashboard. API URL proxies any third-party API with OAuth credentials, header, parameter and response mappings, and SSRF protection on by default. Create PDF queues Markdown-to-PDF artifacts. Each one can be exercised in a built-in Playground before anything ships. Finally you cut an immutable version, activate it, and share the endpoint.
Technically, every server answers on a dedicated MCP endpoint over Streamable HTTP, carrying JSON-RPC 2.0 messages, with a GET opening a server-sent event stream and a DELETE closing the session. Version content is also published as MCP resources in plain text, so clients that speak the resource side of the protocol read it directly. The active version is resolved on every request, which means activating a new one or rolling back takes effect on the next call with no client-side redeploy.
Access is decided per server: public servers accept anonymous traffic, private ones demand a Passport OAuth2 bearer token scoped to the organisation. Request logs, usage metrics and monthly quotas ship as standard, and a separate REST API covers what falls outside MCP, such as listing an organisation's servers, managing versions and rotating endpoint tokens. Documented clients include Claude Desktop, Claude Code and Cursor, plus custom clients built on the official TypeScript or Python SDKs.
What it does
- Publish a hosted MCP server without provisioning transport, JSON-RPC handling, version routing or quotas
- Turn uploaded files, typed documents and GitHub, Bitbucket or GitLab repositories into MCP resources
- Attach File Search, Code Execute, API URL and Create PDF tools to a server
- Test every tool live in the built-in Playground before anything is published
- Cut immutable versions, activate them, and roll back without client-side redeploys
- Serve a server publicly or lock it behind Passport OAuth2 bearer tokens
- Track request logs, usage metrics and monthly quotas per server
When to use Vectoralix / When not to
A quick filter to help you decide if Vectoralix is the right fit.
When to use Vectoralix
- Individual developers who want their own files, notes and scripts reachable from Claude Desktop, Claude Code or Cursor without writing a protocol layer.
- Development teams that need AI-readable access to internal docs, runbooks and repositories, with versioning and rollback built in.
- Platform and DevOps engineers looking for a hosted MCP control plane instead of provisioning transport, auth, quotas and request logging themselves.
- Freelancers and consultants who package domain knowledge into a product their clients' AI assistants can query directly.
- Organisations piloting MCP internally that also need a management REST API, request analytics and per-organisation access control.
When not to use Vectoralix
- Anyone needing EU or regional data residency: the service runs solely in AWS US East and openly states no regional residency is offered.
- Buyers who require a contractual uptime commitment, service credits or a named legal entity behind the contract, since none of the three exists.
- Life-critical, safety-critical or high-stakes decision systems, which the terms of service explicitly forbid without independent human review.
- Resellers wanting to expose Vectoralix as a generic MCP-hosting product to third parties, which requires prior written consent.
- Users located in the sanctioned regions the terms list, whose access may be blocked by IP geolocation.
How to use Vectoralix
A typical end-to-end flow, from setup to results.
- Register a free account from the site navigation; no credit card is required to start.
- Create an MCP server inside your organisation from the dashboard.
- Bring your content: upload files, type documents directly, or connect a GitHub, Bitbucket or GitLab repository over OAuth.
- Organise that content with categories, groups and relations so agents can navigate it precisely.
- Attach the tools your server needs: File Search, Code Execute, API URL or Create PDF.
- Test each tool live in the built-in Playground, without any external client.
- Decide the server's visibility: public and anonymous, or private behind a Passport OAuth2 bearer token.
- Cut an immutable version of content and tools, then activate it and keep a known-good fallback.
- Point an AI client at the endpoint: Claude Desktop, Claude Code and Cursor are documented step by step.
- For a custom client, instantiate a Streamable HTTP transport with the official TypeScript or Python SDK and inject the bearer token.
Pros & Cons
Pros
- Removes the whole protocol and hosting layer: nothing to provision, implement or maintain server-side.
- Immutable versions with an explicit fallback let you activate and roll back without breaking connected clients.
- The built-in Playground makes every tool testable before publication, with no external client needed.
- Guardrails are on by default: SSRF protection on the API proxy, and a QuickJS sandbox with timeouts and memory caps.
- Unusually thorough legal documentation for such a young service: privacy policy, terms, an Article 28 DPA and a named sub-processor list.
- No training on Customer Content, stated in the privacy policy, the terms and the DPA alike.
- Low-commitment entry: a permanent free tier with no card required, and paid plans starting at 4.49 USD per month.
Cons
- No legal entity has been formed: the contract is signed with a name that has no company form, no registration and no postal address.
- The privacy address published across four legal pages reads privacy@vectroralix.com, on a domain that is not the site's own.
- Hosting is confined to AWS US East, and the policy states that no EU or other regional residency is offered.
- No uptime commitment and no service credits are promised, and liability is capped at twelve months of fees or 100 USD.
- The free plan is deliberately thin: view-only access, 250 daily requests, 14-day retention and no custom tools or source integrations.
- The product is very new, with the domain registered in April 2026 and a single server listed in the public directory at review time.
- Documentation is still partial, scoped to the Get Started group, and no security certification such as SOC 2 or ISO 27001 is claimed.
Pricing & Plans
A permanent free plan is available and requires no credit card. The cheapest paid entry point is the Starter plan at 4.49 USD per month, followed by Pro at 14.99 USD and Ultra at 49.99 USD per month. All paid plans are billed by Lemon Squeezy, Inc. as Merchant of Record; displayed prices exclude VAT, GST and sales taxes, which are calculated at checkout. Subscriptions renew automatically and may be cancelled at any time, taking effect at the end of the current billing period.
- one view-only MCP server
- one private server
- 250 daily MCP requests
- code-execution tools included
- no custom tools
- no source integrations
- one solo organisation with a single member
- and 14-day data retention.
- three MCP servers
- three private servers
- 10
- 000 daily requests
- custom MCP tools
- two source integrations
- two organisations
- five members each
- ten MCP servers
- ten private servers
- 100
- 000 daily requests
- custom tools
- five source integrations
- five organisations
- fifteen members each
- unlimited servers
- private servers
- daily requests
- source integrations
- organisations and members
- plus API access
- advanced analytics
- priority support and continuous retention.
Data, GDPR & hosting
A consolidated view of how Vectoralix handles your data.
GDPR overview
GDPR implementation is documented rather than merely claimed. The privacy policy, terms and a full Article 28 Data Processing Addendum are all published and dated 9 May 2026, alongside a named sub-processor list. Lawful bases are tabulated purpose by purpose, and access, rectification, erasure, restriction, objection, portability, consent withdrawal and the right to complain are all set out, with a 30-day response commitment. Transfers to the United States rely on the 2021/914 Standard Contractual Clauses (Module Two), the UK IDTA and Swiss adjustments, plus the EU-US Data Privacy Framework where a sub-processor participates. Breach notification is promised within 72 hours. Two gaps are stated openly: no Data Protection Officer is appointed, and no Article 27 EU representative is designated.
Who owns the data?
Customers keep every right in their Customer Content: typed documents, uploaded files, Git-imported material, categories, groups, relations, Code Execute scripts and configurations. Vectoralix receives only an operational licence to host, copy, transmit, display, process, index, execute, proxy and back up that content in order to run the service, and it may sublicense that licence exclusively to the sub-processors named in the privacy policy. The licence ends when the content is deleted, subject to legally required retention. On roles, the customer is the controller of Customer Content and Vectoralix the processor, while Vectoralix acts as controller for account data, billing metadata and telemetry it collects directly. Feedback sent to the vendor is a separate case: it is licensed perpetually and irrevocably.
Reuse rights
Customers may use, export and reuse their own content freely: they own it, and the documentation advertises portability, machine-readable export and deletion on request. Vectoralix, for its part, processes that content only on documented customer instructions, and states in three separate documents that it does not use Customer Content to train AI or machine-learning models. Access by the vendor is restricted to operating the service, investigating suspected abuse, complying with the law, or acting on an explicit customer request. The privacy policy tabulates each purpose with its lawful basis under Article 6 GDPR, rules out automated decisions with legal effects under Article 22, and confirms that no personal information is sold or shared for cross-context behavioural advertising. Marketing emails are opt-in only. Customers remain responsible for holding the rights to whatever they upload or sync, and for any consent needed for personal data inside it.
Data retention & training
Hosting summary
Vectoralix runs on Amazon Web Services in US East, Northern Virginia, and the privacy policy states plainly that no EU-region or other regional residency is currently offered: data from the EEA, the United Kingdom and Switzerland is transferred to the United States under the 2021/914 Standard Contractual Clauses, the UK IDTA and Swiss adjustments. Cloudflare provides edge delivery, DDoS mitigation and TLS termination, processing request metadata in transit without retaining content. The remaining sub-processors are all United States based: Lemon Squeezy for payments, Resend for transactional email, Google Analytics loaded only after consent, and OpenRouter for on-demand model calls made by customer-published tools. Declared safeguards include TLS 1.2 or higher in transit, AES-256 at rest, Argon2 or bcrypt password hashing, encrypted OAuth and Passport tokens, VPC and IAM isolation, SSRF protection, QuickJS sandboxing, periodic backups, key rotation and access logging. No external security certification is claimed.
Where Vectoralix works
Country-level availability.
Not available in
Things to keep in mind
Risks and trade-offs to weigh before adopting Vectoralix.
- You are contracting with a name, not a company: the terms, privacy policy and DPA all state that no legal entity has been formed, which leaves recourse uncertain if something goes wrong.
- The privacy contact printed on four legal pages uses a domain that is not the site's own, so GDPR requests sent there may simply never arrive.
- Section 22 of the terms leaves governing law and competent jurisdiction blank, so the forum for a dispute is genuinely undetermined.
- Making a server public means anonymous AI clients, and the model providers behind them, can read whatever content you exposed; the terms place that consequence squarely on you.
- The API URL and Code Execute tools call upstream services with your credentials, so their costs, rate limits and terms of service become your responsibility.
- On the free plan, content is kept for only 14 days from upload, which is easy to forget until something you needed has gone.
- Handing an assistant a well-indexed corpus makes it fluent about your organisation, which can quietly encourage taking its answers on trust rather than checking the underlying documents.
Setup & Integrations
Technical difficulty
Low for anyone already comfortable with the MCP vocabulary. There is no infrastructure to provision and no protocol to implement: content, tools, versions and visibility are all configured in the dashboard, and the quick start promises a working MCP request in roughly ten minutes. The real prerequisites are conceptual rather than operational, namely understanding servers, versions, tools and resources, and having a compatible client. Two tools raise the bar: Code Execute expects you to write JavaScript, and API URL expects OAuth credentials with header, parameter and response mappings.
Deployment
Integrations
Behind Vectoralix
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What does Vectoralix actually host for me?
Is there a free plan, and does it need a card?
Which AI clients can connect to a Vectoralix server?
Is my content used to train AI models?
Where is my data stored?
Can I keep a server private?
What happens if I publish a bad version?
How old is the age requirement, and who runs the service?
Should you pick Vectoralix?
Vectoralix answers a narrow question well: how to publish a real Model Context Protocol server without operating one. Within that scope the product is complete rather than skeletal. Content management, four built-in tools, a Playground that lets you exercise each of them before publication, immutable versions with an explicit fallback, per-server public or private access, request logs and usage metrics are all present, and the client documentation walks through Claude Desktop, Claude Code, Cursor and custom SDK integrations one by one.
The legal groundwork is more careful than the product's age would suggest. A privacy policy, terms of service, an Article 28 Data Processing Addendum and a named sub-processor list are all published and dated the same day, transfer mechanisms are spelled out, and the commitment not to train on Customer Content is repeated in three separate documents.
The reservations are real and worth weighing. No legal entity has been formed, so the counterparty to the contract is a name rather than a company; the governing-law clause is literally left blank; the privacy address published on four legal pages carries a misspelled domain; hosting is United States only with no EU residency on offer; there is no uptime commitment; and the public directory listed a single server at review time. This is an early product with mature paperwork, not a mature product.
For an individual developer or a small team wanting to expose docs, runbooks or a repository to their AI clients, the risk of trying it is low: the free tier is permanent, no card is required, and the paid entry point is 4.49 USD per month. For an organisation with residency requirements, procurement checks or an uptime expectation, the gaps above will decide the matter before the features do.
- Choosing a selection results in a full page refresh.
- Opens in a new window.