Sponsor MCPSafe10 founding slots
Registry/SDK MCP Server

SDK MCP Server

v1.30.0
Verified

The official TypeScript SDK for Model Context Protocol servers and clients

NOASSERTION
other
other
13.5Kstars
198.0Mdownloads
2.2Kforks
Scanned Oct 2, 2026
WebsiteRepositoryGITHUB
Automated scan (limited checks) · 2026-10-02

This grade comes from an automated MCPSafe scan of the server's JavaScript, TypeScript and Python source on 2026-10-02. It read the whole repository (254 files). It checks for leaked credentials, shell or code injection from function inputs, unsafe deserialization, malware signatures, install-time scripts, and weak password handling. It does not check for path traversal, server-side request forgery, prompt injection in tool descriptions, network exposure, SQL injection, cross-site scripting, or vulnerable dependencies. It has not been manually reviewed, and the code may have changed since the scan.

A92%
Scanned 1w ago

Very Good Security

Vulnerabilities Found
0Crit
0High
1Med
0Low
1Info

Trust Score 76

Review required
Trust grade B

Trust is stricter than security: it combines reviewed security, MCP capability risk, supply-chain metadata, quality, popularity, freshness, and penalties for unknowns.

Security
92
MCP risk
52
Supply chain
80
Maintenance
57
Docs
93
Freshness
80
Risk traits
Runs shell commands
Filesystem access
Network/API access
Requires secrets
Why it scores well
  • • Strong project quality signals
  • • Good documentation surface
  • • Solid supply-chain metadata
  • • Recently scanned
What reduces confidence
  • • Missing/unclear license
  • • MCP risk traits: Runs shell commands, Filesystem access, Network/API access

Security ScoreA

92
out of 100

Vulnerabilities Found

0
Crit
0
High
1
Medi
0
Low
1
Info
Last scanned: 10/2/2026

Quality ScoreB

80
out of 100
57
Maint.
100
Popular
93
Docs
78
Compat
Maintenance57%
Popularity100%
Documentation93%
Compatibility78%

Maintenance57

Unknown
Commit Frequency65%
Release Frequency70%
Issue Response25%

Popularity100

13.5K
Stars
198.0M
Downloads
2.2K
Forks
Stars Score100%
Downloads Score100%
Forks Score100%

Documentation93

README Quality90%

Available Documentation

API DocsExamplesChangelog

Compatibility78

MCP Spec Compliance80%
Transport Support75%

Features

TypeScript

Supported Transports

STDIO

Vulnerabilities(0)

This grade comes from an automated scan. Individual findings from automated scans are not published.

READMESDK MCP Server

View source

MCP TypeScript SDK

<!-- prettier-ignore -->

[!IMPORTANT]
This is the `main` branch — v2 of the SDK (@modelcontextprotocol/server, @modelcontextprotocol/client), implementing the 2026-07-28 MCP spec.
Have feedback? Please [open a v2 issue](https://github.com/modelcontextprotocol/typescript-sdk/issues/new?template=v2-feedback.yml) — it is the most useful thing you can do for the SDK right now. The v2 documentation starts with a ten-minute server tutorial.
v2 is the stable release line, released alongside the 2026-07-28 spec. v1.x continues to receive bug fixes and security updates for at least 6 months after v2's release. v1 documentation: ts.sdk.modelcontextprotocol.io · v2: `/v2/`.

<!-- prettier-ignore -->

[!WARNING]
We're limiting pull requests to 1 per new contributor while v2 settles after the [2026-07-28 spec](https://modelcontextprotocol.io/specification/2026-07-28) release.
Issues are the most useful feedback right now — we'll reopen PRs as v2 stabilizes.

![NPM Version - Server](https://www.npmjs.com/package/@modelcontextprotocol/server)

![NPM Version - Client](https://www.npmjs.com/package/@modelcontextprotocol/client) MIT licensed

<details>

<summary>Table of Contents</summary>

</details>

Overview

The Model Context Protocol (MCP) allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction.

This repository contains the TypeScript SDK implementation of the MCP specification. It runs on Node.js, Bun, and Deno, and ships:

  • MCP server libraries (tools/resources/prompts, Streamable HTTP, stdio, auth helpers)
  • MCP client libraries (transports, high-level helpers, OAuth helpers)
  • Optional middleware packages for specific runtimes/frameworks (Express, Fastify, Hono, Node.js HTTP)
  • Runnable examples (under `examples/`)

Packages

This monorepo publishes split packages:

  • `@modelcontextprotocol/server`: build MCP servers
  • `@modelcontextprotocol/client`: build MCP clients

Tool and prompt schemas use Standard Schema — bring Zod v4, Valibot, ArkType, or any compatible library.

Middleware packages (optional)

The SDK also publishes small "middleware" packages under `packages/middleware/` that help you wire MCP into a specific runtime or web framework.

They are intentionally thin adapters: they should not introduce new MCP functionality or business logic. See `packages/middleware/README.md` for details.

  • `@modelcontextprotocol/node`: Node.js Streamable HTTP transport wrapper for IncomingMessage / ServerResponse
  • `@modelcontextprotocol/express`: Express helpers (app defaults + Host header validation)
  • `@modelcontextprotocol/fastify`: Fastify helpers (app defaults + Host header validation)
  • `@modelcontextprotocol/hono`: Hono helpers (app defaults + JSON body parsing hook + Host header validation)

Installation

Server

bash
npm install @modelcontextprotocol/server
# or
bun add @modelcontextprotocol/server
# or
deno add npm:@modelcontextprotocol/server

Client

bash
npm install @modelcontextprotocol/client
# or
bun add @modelcontextprotocol/client
# or
deno add npm:@modelcontextprotocol/client

Optional middleware packages

The SDK also publishes optional “middleware” packages that help you wire MCP into a specific runtime or web framework (for example Express, Fastify, Hono, or Node.js http).

These packages are intentionally thin adapters and should not introduce additional MCP features or business logic. See `packages/middleware/README.md` for details.

bash
# Node.js HTTP (IncomingMessage/ServerResponse) Streamable HTTP transport:
npm install @modelcontextprotocol/node

# Express integration:
npm install @modelcontextprotocol/express express

# Fastify integration:
npm install @modelcontextprotocol/fastify fastify

# Hono integration:
npm install @modelcontextprotocol/hono hono

Getting Started

Here is what an MCP server looks like. This minimal example exposes a single greet tool over stdio:

typescript
import { McpServer } from '@modelcontextprotocol/server';
import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
import * as z from 'zod/v4';

const server = new McpServer({ name: 'greeting-server', version: '1.0.0' });

server.registerTool(
    'greet',
    {
        description: 'Greet someone by name',
        inputSchema: z.object({ name: z.string() })
    },
    async ({ name }) => ({
        content: [{ type: 'text', text: `Hello, ${name}!` }]
    })
);

async function main() {
    const transport = new StdioServerTransport();
    await server.connect(transport);
}

main();

Ready to build something real? Follow the step-by-step tutorials:

For runnable, end-to-end examples beyond the tutorials, see:

  • `examples/README.md` — runnable, self-verifying client/server example pairs (one story per directory)

Documentation

Building docs locally

To work on the documentation site locally:

bash
pnpm docs:api      # Generate the API reference markdown (output: docs/api/)
pnpm docs:dev      # Start the VitePress dev server for the V2 site
pnpm docs:build    # Build the V2 site (output: docs/.vitepress/dist/)
pnpm docs:multi    # Build the combined V1 + V2 site (output: tmp/docs-combined/)

The docs:multi script builds the V2 site from the current checkout, checks out the v1.x branch via a git worktree to build the V1 site, and produces a combined site with V1 docs at the root and V2 docs under /v2/.

v1 (legacy) documentation and fixes

If you are using the v1 generation of the SDK, the v1 API documentation is available at `https://ts.sdk.modelcontextprotocol.io/`. The v1 source code and any v1-specific fixes live on the long-lived

`v1.x` branch. V2 API docs are at `/v2/`.

Contributing

Issues and pull requests are welcome on GitHub at <https://github.com/modelcontextprotocol/typescript-sdk>.

License

This project is licensed under the Apache License 2.0 for new contributions, with existing code under MIT. See the LICENSE file for details.

Embed Security Badge

Add this badge to your README or documentation

SDK MCP Server MCPSafe Security
[![SDK MCP Server MCPSafe Security](https://api.mcpsafe.org
/api/badge/sdk-mcp-server.svg)](https://mcpsafe.org/registry/sdk-mcp-server)
Need more customization options?Badge Documentation

Server Information

Source
GITHUB
Version
1.30.0
Language
other
License
NOASSERTION
Transport
STDIO
Added
Aug 11, 2026
Updated
Oct 1, 2026