惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Y
Y Combinator Blog
美团技术团队
H
Hacker News: Front Page
Spread Privacy
Spread Privacy
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
T
Tenable Blog
Simon Willison's Weblog
Simon Willison's Weblog
T
The Exploit Database - CXSecurity.com
Cisco Talos Blog
Cisco Talos Blog
A
Arctic Wolf
C
CXSECURITY Database RSS Feed - CXSecurity.com
Application and Cybersecurity Blog
Application and Cybersecurity Blog
A
About on SuperTechFans
F
Fortinet All Blogs
量子位
GbyAI
GbyAI
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
The Hacker News
The Hacker News
AWS News Blog
AWS News Blog
Forbes - Security
Forbes - Security
Help Net Security
Help Net Security
I
InfoQ
有赞技术团队
有赞技术团队
W
WeLiveSecurity
Google DeepMind News
Google DeepMind News
Engineering at Meta
Engineering at Meta
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
S
Secure Thoughts
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
Webroot Blog
Webroot Blog
酷 壳 – CoolShell
酷 壳 – CoolShell
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
博客园_首页
C
Check Point Blog
T
Troy Hunt's Blog
Security Archives - TechRepublic
Security Archives - TechRepublic
Latest news
Latest news
P
Proofpoint News Feed
Jina AI
Jina AI
Last Week in AI
Last Week in AI
Martin Fowler
Martin Fowler
雷峰网
雷峰网
博客园 - Franky
L
LangChain Blog
罗磊的独立博客
Blog — PlanetScale
Blog — PlanetScale
Google DeepMind News
Google DeepMind News
D
Docker
G
GRAHAM CLULEY
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Build an MCP Server with TypeScript: 2026 Tutorial
Jangwook Kim · 2026-05-01 · via DEV Community

The Model Context Protocol has crossed 97 million monthly SDK downloads and over 10,000 public server implementations. Every major AI platform — Claude, Cursor, Windsurf, OpenAI — now speaks it natively. If you build a TypeScript MCP server today, your tools work everywhere those clients run.

This tutorial walks through building a working MCP server from scratch, covering tools, resources, the stdio transport, and how to wire it into Claude Desktop. Effloow Lab ran this exact build in a local sandbox using @modelcontextprotocol/sdk@1.29.0 and Node.js v25.9.0 — all code here is from that run.

What You'll Build

By the end of this tutorial you'll have:

  • A TypeScript MCP server with two custom tools and one resource
  • A compiled binary ready for stdio-based clients
  • A Claude Desktop configuration that loads your server on launch
  • A foundation you can extend with real APIs, databases, or local files

The server exposes a word_count tool and a to_slug tool — deliberately simple examples chosen to demonstrate input validation with Zod, response formatting, and the full JSON-RPC lifecycle without distracting you with business logic.

Prerequisites

  • Node.js v18 or later (tutorial uses v25.9.0)
  • npm v8 or later
  • TypeScript 5.x installed or available via npx
  • Claude Desktop (optional, for live testing)

Step 1 — Initialize the Project

Create a fresh directory and scaffold the package.json:

mkdir my-mcp-server && cd my-mcp-server

Enter fullscreen mode Exit fullscreen mode

Write package.json manually rather than using npm init, because you need "type": "module" set from the start:

{
  "name": "my-mcp-server",
  "version": "1.0.0",
  "type": "module",
  "scripts": {
    "build": "tsc",
    "start": "node dist/index.js"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.11.0"
  },
  "devDependencies": {
    "typescript": "^5.8.3",
    "@types/node": "^22.0.0"
  }
}

Enter fullscreen mode Exit fullscreen mode

The "type": "module" field is not optional. The MCP SDK is ESM-only — if you leave this out, Node.js treats your compiled output as CommonJS and the imports fail at runtime.

Install dependencies:

npm install

Enter fullscreen mode Exit fullscreen mode

Expected output:

added 95 packages in 438ms
found 0 vulnerabilities

Enter fullscreen mode Exit fullscreen mode

Verify the SDK version installed:

cat node_modules/@modelcontextprotocol/sdk/package.json | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).version))"
# 1.29.0

Enter fullscreen mode Exit fullscreen mode

Step 2 — Configure TypeScript

Create tsconfig.json in the project root. The module settings here are precise — "Node16" for both module and moduleResolution is required to correctly resolve .js extension imports that the SDK uses internally:

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "Node16",
    "moduleResolution": "Node16",
    "outDir": "./dist",
    "rootDir": "./src",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true
  },
  "include": ["src/**/*"]
}

Enter fullscreen mode Exit fullscreen mode

If you use "moduleResolution": "node" (the old default), TypeScript can't resolve the SDK's .js extension imports and compilation fails with Cannot find module errors.

Create the source directory:

mkdir src

Enter fullscreen mode Exit fullscreen mode

Step 3 — Write the MCP Server

Create src/index.ts:

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";

// Initialize the server with a name and version.
// These appear in the MCP initialize handshake.
const server = new McpServer({
  name: "my-mcp-server",
  version: "1.0.0",
});

// Tool 1: count words in a text string
server.tool(
  "word_count",
  "Count the number of words in a text string",
  { text: z.string().describe("The text to analyze") },
  async ({ text }) => {
    const count = text.trim().split(/\s+/).filter(Boolean).length;
    return {
      content: [{ type: "text", text: `Word count: ${count}` }],
    };
  }
);

// Tool 2: convert a title to a URL-friendly slug
server.tool(
  "to_slug",
  "Convert a title string into a lowercase URL slug",
  { title: z.string().describe("The title to convert") },
  async ({ title }) => {
    const slug = title
      .toLowerCase()
      .replace(/[^a-z0-9\s-]/g, "")
      .trim()
      .replace(/\s+/g, "-");
    return {
      content: [{ type: "text", text: slug }],
    };
  }
);

// Resource: expose server metadata at a custom URI
server.resource("info", "info://server", async () => ({
  contents: [
    {
      uri: "info://server",
      text: JSON.stringify({
        name: "my-mcp-server",
        version: "1.0.0",
        tools: ["word_count", "to_slug"],
      }),
      mimeType: "application/json",
    },
  ],
}));

// Connect to stdin/stdout and start listening
const transport = new StdioServerTransport();
await server.connect(transport);
console.error("[MCP] Server started on stdio");

Enter fullscreen mode Exit fullscreen mode

A few things to note in this code:

server.tool() signature: name → description → Zod input schema → async handler. The SDK converts your Zod schema to JSON Schema automatically, so clients receive a standard schema for their UI and validation.

console.error() for debug output: MCP uses stdout exclusively for JSON-RPC messages. Anything you log to stdout breaks the protocol. Always use console.error() or write to a log file when debugging.

Top-level await: The await server.connect(transport) call works because Node.js supports top-level await in ESM modules ("type": "module").

Step 4 — Compile and Test

Compile the TypeScript:

npx tsc

Enter fullscreen mode Exit fullscreen mode

Expected: no output, exit code 0. Check that dist/index.js was created:

ls dist/
# index.js

Enter fullscreen mode Exit fullscreen mode

Now test it by sending raw JSON-RPC messages through stdin. Effloow Lab used a Node.js test harness rather than shell pipes because macOS doesn't ship GNU timeout:

// test.mjs
import { spawn } from "child_process";

const proc = spawn("node", ["dist/index.js"], {
  stdio: ["pipe", "pipe", "pipe"],
});

const messages = [
  { jsonrpc: "2.0", id: 1, method: "initialize", params: {
    protocolVersion: "2024-11-05",
    capabilities: {},
    clientInfo: { name: "test", version: "1.0" },
  }},
  { jsonrpc: "2.0", method: "notifications/initialized", params: {} },
  { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} },
  { jsonrpc: "2.0", id: 3, method: "tools/call", params: {
    name: "word_count",
    arguments: { text: "Hello World from MCP" },
  }},
  { jsonrpc: "2.0", id: 4, method: "tools/call", params: {
    name: "to_slug",
    arguments: { title: "Build MCP Server TypeScript 2026" },
  }},
];

let output = "";
proc.stdout.on("data", (d) => { output += d; });
messages.forEach((m) => proc.stdin.write(JSON.stringify(m) + "\n"));

setTimeout(() => {
  proc.kill();
  output.trim().split("\n").forEach((line) => {
    const { id, result } = JSON.parse(line);
    console.log(`[${id}]`, JSON.stringify(result).slice(0, 120));
  });
}, 2000);

Enter fullscreen mode Exit fullscreen mode

Run it:

node test.mjs

Enter fullscreen mode Exit fullscreen mode

Actual output from Effloow Lab's sandbox run:

[1] {"protocolVersion":"2024-11-05","capabilities":{"tools":{"listChanged":true},"resources":{"listChanged":true}},"serverInfo":{"name":"my-mcp-server","version":"1.0.0"}}
[2] {"tools":[{"name":"word_count","description":"Count the number of words in a text string","inputSchema":{"$schema":"http://...
[3] {"content":[{"type":"text","text":"Word count: 4"}]}
[4] {"content":[{"type":"text","text":"build-mcp-server-typescript-2026"}]}

Enter fullscreen mode Exit fullscreen mode

The server negotiates protocol version 2024-11-05, lists both tools with their auto-generated JSON Schemas, and returns correct results from both tool calls.

Step 5 — Connect to Claude Desktop

Claude Desktop loads MCP servers from a JSON config file. On macOS:

~/Library/Application Support/Claude/claude_desktop_config.json

Enter fullscreen mode Exit fullscreen mode

On Windows:

%APPDATA%\Claude\claude_desktop_config.json

Enter fullscreen mode Exit fullscreen mode

Add your server to the mcpServers object. Replace /absolute/path/to with your actual project path:

{
  "mcpServers": {
    "my-mcp-server": {
      "command": "node",
      "args": ["/absolute/path/to/my-mcp-server/dist/index.js"]
    }
  }
}

Enter fullscreen mode Exit fullscreen mode

Fully quit Claude Desktop and relaunch it. The command + args pattern tells Claude Desktop to spawn your server as a subprocess and communicate over stdio — the same lifecycle you just tested manually.

After relaunch, open a new conversation and ask Claude something like "count the words in this sentence". Claude will route the call to your word_count tool and return the result.

If you have multiple servers, add them as separate keys in mcpServers. Each runs as an isolated subprocess.

Step 6 — Add a Prompt Template

Beyond tools and resources, MCP supports prompts — reusable message templates that appear in the client's prompt picker. Add one to src/index.ts:

import { z } from "zod";

// Prompt: generate a writing brief from a topic
server.prompt(
  "writing_brief",
  "Generate a structured writing brief from a topic",
  { topic: z.string().describe("The topic to write about") },
  async ({ topic }) => ({
    messages: [
      {
        role: "user",
        content: {
          type: "text",
          text: `Create a concise writing brief for the following topic: "${topic}". Include: target audience, key points to cover, suggested structure, and tone of voice.`,
        },
      },
    ],
  })
);

Enter fullscreen mode Exit fullscreen mode

Rebuild and restart Claude Desktop to pick up the new prompt. It will appear in Claude's / prompt menu.

Step 7 — Switch to Streamable HTTP (Optional)

The stdio transport is ideal for local tools and Claude Desktop integration. When you want your server accessible over the network — for remote clients, Docker deployments, or shared teams — you switch to the Streamable HTTP transport introduced in MCP protocol version 2025-03-26.

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import express from "express";

const app = express();
app.use(express.json());

const server = new McpServer({ name: "my-mcp-server", version: "1.0.0" });
// ... register same tools and resources ...

const transport = new StreamableHTTPServerTransport({
  sessionIdGenerator: () => crypto.randomUUID(),
});

app.post("/mcp", async (req, res) => {
  await transport.handleRequest(req, res, req.body);
});
app.get("/mcp", async (req, res) => {
  await transport.handleRequest(req, res);
});

await server.connect(transport);
app.listen(3000, () => console.log("MCP HTTP server on :3000"));

Enter fullscreen mode Exit fullscreen mode

Streamable HTTP replaces the older HTTP+SSE transport. Clients send JSON-RPC via HTTP POST and receive streaming responses via Server-Sent Events on GET. The SDK's StreamableHTTPServerTransport handles both sides.

Troubleshooting

Error Cause Fix
ERR_REQUIRE_ESM Missing "type": "module" Add to package.json
Cannot find module '...' moduleResolution: node (classic) Set to Node16 in tsconfig
Claude Desktop shows no tools Server not restarted after config Fully quit and relaunch
Blank stdout output console.log used for debug Use console.error instead
Server exits immediately Missing await on connect() Ensure top-level await enabled

Understanding the MCP Architecture

MCP sits between AI clients (Claude, Cursor, Windsurf) and the tools, data, and services they need to use. Without MCP, each client writes its own integration layer for each tool. With MCP, you write the server once and every compliant client can use it.

The protocol uses JSON-RPC 2.0 over a transport layer. In the lifecycle you just ran through, the exchange looks like this:

  1. Client starts: spawns your server process via command + args
  2. Handshake: client sends initialize, server returns supported capabilities
  3. Discovery: client sends tools/list, resources/list, prompts/list
  4. Use: client sends tools/call with tool name and arguments; server runs your handler and returns content
  5. Shutdown: client closes stdin or sends shutdown request

The McpServer class handles all of this automatically. You only write the handlers.

What to Build Next

Now that the scaffolding is working, the useful extension points are:

File system access: register a resource that reads local files by path. MCP clients can then ask Claude to read or summarize files without you copy-pasting content.

Database queries: wrap a database client in a tool. The tool receives query parameters via Zod schema, runs the query, and returns formatted rows. No credentials leave the server process.

External API wrappers: turn any REST API call into a tool. The client describes the intent in natural language; Claude maps it to your tool's input schema.

Authentication: the SDK ships OAuth helpers for servers that need protected access. The 2025-03-26 protocol version includes auth flows built into the handshake.

Bottom Line

MCP's TypeScript SDK is genuinely straightforward to start with: five imports, one server instance, one tool registration, and you have a working integration point for every compliant AI client. The two configs that trip people up — "type": "module" in package.json and moduleResolution: Node16 in tsconfig — are easy to miss in older tutorials. Get those right and the rest follows cleanly.

Frequently Asked Questions

Q: Does my MCP server need to run continuously?

No. With stdio transport, Claude Desktop starts your server process when it launches and keeps it running only while the app is open. When Claude Desktop exits, the process is killed. The server doesn't need to be a background daemon.

Q: Can I use libraries other than Zod for schema validation?

Yes. As of SDK 1.11.0, MCP supports Standard Schema — any compatible library works including Valibot, ArkType, and others. Zod is the most common choice in the ecosystem and has the best documentation for MCP patterns.

Q: How do I debug tool calls during development?

Write debug output to console.error() — it goes to stderr, which MCP clients typically pipe separately. You can also run your server manually in a terminal and pipe test JSON-RPC messages via stdin to inspect request/response pairs directly.

Q: What's the difference between a tool and a resource?

Tools are actions the model can take — functions with inputs and outputs. Resources are data the model can read, referenced by a URI scheme (like info://server or file:///path). The practical difference: tools get called when the model wants to do something; resources get read when the model wants context.

Q: Can I ship my MCP server as an npm package?

Yes, and many public servers do. Add a bin entry to your package.json pointing at dist/index.js, and users can run your server via npx directly in their Claude Desktop config.