No Inbound Ports: Build MCP servers on customer data that Claude Code and Managed Agents reach, for forward deployed engineers (Deploy It There)

Forward deployed engineer is a job four news outlets priced four different ways in the same quarter. India Today reported on 2026-07-10 that it can pay up to a million dollars a year, The Economic Times reported the same role at $200,000 five weeks earlier, and neither figure is resolved to base pay or a whole package. Anthropic does not post the title at all. Its nearest posting names the phrase in a requirements bullet and states $315,000 to $380,000.

The Wall Street Journal's headline on the work, 2026-07-19: "The hottest job in tech isn't very glamorous." Unglamorous is the accurate part. You fly to somebody else's office, log into a network you do not control, and make their mess produce something.

Here is the part no job ad mentions. Your server works. Nobody can reach it.

The data lives on a network that will not accept an inbound connection, and the agent you flew out to connect runs elsewhere. Two Claude-family consumers can reach a server on that network, and they point opposite ways. Claude Code runs on your own machine, inside the building, and needs no tunnel. Anthropic's own runtimes cannot, so they arrive over a connection your side dials out, and the documentation is careful where summaries are not: "The phrase 'outbound-only' describes the connection, not the requests carried over it." Get those two the wrong way round in a review and there is no second meeting.

Across twenty chapters you build stockroom, an MCP server over an inventory-adjustment table that may not leave the network, and make it reachable from both directions, reviewable by a stranger, durable across a crash, and correct on both sides of a protocol revision that has not shipped. Docker Compose, then the vendor's Helm chart with workload identity federation, keyed by a certificate authority whose private key never leaves your side.

I did not run most of that, and each chapter says so where you meet it. No tunnel was provisioned for this book. No certificate was registered, no container was started, no cluster existed, no Managed Agents session was opened, and no Claude Code session ever ran against stockroom. The mcp package is absent from the machine that produced every printed output, so the server file is syntax-checked and never executed, and the TypeScript client never compiled. Seven of the twenty chapters stand on a research preview you request through a form, and until it is granted those seven are reading rather than doing. The other thirteen run on a laptop today, no access request. Twenty blocks are labelled illustrative where they sit, appendix A lists eight questions the book could not settle, and verify.sh prints NOT PROVEN for them instead of a tick.

Seventy-two commands did run, and their printed output was diffed against the run. A listener table reduced off my own laptop, checked in unedited, and a classifier that returns nonzero on a wildcard bind. A client killed mid-flight and resumed against a rig that refuses to pass unless the first process really died on a signal. Nine compatibility cells over stdio, four diffed against the specification's own wording and met, three recorded and never diffed because the specification declines to say what should happen, two not tabled at all. And one deliberate red run, because a runner that cannot fail proves nothing.