Skip to content
Agents tracked: 440 Downloads (7d): 202M down 19.5% GitHub stars: 10.4M Releases (7d): 607 Agent status: 1 with issuesSince last limit reset: Claude 28d · Codex 0d Updated Oct 21, 2026

Starter kit for an MCP server for your own service

A recipe for a TypeScript MCP server that gives coding agents tools over your own HTTP API, over stdio or HTTP, read-only or with writes you allow, tested in memory and with the MCP Inspector. With exact versions, a plan with checks and the traps a test build ran into.

New to kits? Read how to use a kit.

How the kit fits together

Your agent reads the brief, builds with these parts and checks its own work before you ship. Click a part to see why it was picked.

File for your agent

AGENTS.md

The plan your agent follows, a step at a time, with a check that must pass before the next step. It also holds the stack with exact versions, the licenses and the known traps.

File for your agent

first-prompt.txt

The first message you paste into your agent. It points the agent at AGENTS.md and tells it to stop after step 1 and report.

File for your agent

.mcp.json

The MCP servers the brief lists, set up for Claude Code. The kit builder writes the same setup for Cursor, Codex or Copilot.

File for your agent

CREDITS.md

The license record of every third-party file. The brief tells the agent to add a row for every file it brings in.

You bring this

Your coding agent

The kit works with any of these. Pick yours in the kit builder and the setup files change to match.

Library knowledge

Context7

4.3.0MIT

SDK version 2 renamed the imports and replaced server.tool() and new StdioServerTransport(); models still write version 1 from memory.

By Upstash · In 1,266 of 29,413 sampled repos · v4.3.0 on npm · Agent can use it through MCP

Tool and asset data

AgentGid

If the agent needs another library, it asks AgentGid for one that fits your constraints.

By AgentGid · Agent can use it through MCP

Runtime

Node.js 22.19 or newer

official source

The SDK, the Inspector and the test runner each set a lowest Node version; 22.19 satisfies all three.

Nothing to install

MCP SDK

MCP TypeScript SDK (server)

2.3.1Apache-2.0

Speaks the protocol: lists tools, checks arguments against their schemas, and turns errors into results the model can read. Version 2 is the stable line; the single @modelcontextprotocol/sdk package is version 1.

In 563 of 4,663 JS/TS agent projects (12%) · #1 of 67 in agent, MCP and tool libraries · v2.3.1, October 5, 2026 (npm registry) · Apache-2.0 · Installs from a package registry

Schemas

Zod

4.6.7MIT

One Zod schema per tool gives the JSON Schema the model sees, checks the arguments and types the handler.

In 1,502 of 4,663 JS/TS agent projects (32.1%) · #1 of 36 in forms, validation and schemas · v4.6.7 (npm registry) · MIT · Installs from a package registry

Language

TypeScript

7.0.2Apache-2.0

Types catch a tool whose handler and schema disagree before an agent does.

In 3,311 of 4,663 JS/TS agent projects (71%) · #1 of 23 in languages, types and runtimes · v7.0.2 (npm registry) · Apache-2.0 · Installs from a package registry

Tests

Vitest

5.0.4MIT

Calls every tool through a real MCP client in memory: schemas, errors and results are tested the way a host sees them.

In 1,230 of 4,663 JS/TS agent projects (26.3%) · #1 of 42 in testing · v5.0.4 (npm registry) · MIT · Installs from a package registry

Manual and CLI check

MCP Inspector

MIT, moving to Apache-2.0official source

Starts the built server as a host would and lists and calls its tools from the command line.

Free · MIT, moving to Apache-2.0 (the MCP project's licensing transition) · A tool for you, not for the agent

When the agent is done

7 checks

  • npm run build compiles with tsc and no errors; npm test passes.
  • Tests connect a real Client to the server in memory and call every tool: valid arguments give the expected result and structuredContent; invalid arguments give isError: true with a message that says what to fix; an API failure gives isError: true with a safe message and no URL, key or stack trace in it.
  • The tools work against a fake API that the tests start on 127.0.0.1 with node:http, so no real service or key is needed.
  • MCP_INSPECTOR_SECRET_STORE=memory npx -y @modelcontextprotocol/inspector@2.10.1 --cli node dist/index.js -e API_BASE_URL=http://127.0.0.1:4010 -e API_KEY=fake-key --method tools/list lists every tool with its description and schema, and a tools/call on the search tool returns results while the fake API runs (npm run fake-api).
  • Nothing but protocol messages goes to stdout: a test spawns node dist/index.js, sends initialize, and the first line it reads back parses as JSON-RPC.
  • Every tool has a description that says when to use it, .describe() on every argument, and readOnlyHint: true on tools that only read.
  • README.md has the lines that connect the server to Claude Code, Cursor, VS Code and Codex.
After the agent

Left to you

  • Put the real API's base URL and key into .env and try the server from your agent on real data: decide then whether the tool descriptions make the agent pick the right tool.
Files for your agentAgent tools (MCP)CodeArt, sound and contentChecksOptional, off by default

What you get

The result

A TypeScript MCP server with tools over your own HTTP API (search and get), tested in memory and with the MCP Inspector, plus the lines that connect it to your coding agent.

7 files
Ready for your agent
  • AGENTS.md: the plan, with a check after every step
  • first-prompt.txt, install.txt, .mcp.json
  • CREDITS.md, CLAUDE.md, kit.json
10 parts
Every part is free or has a free tier
  • Server: Apache-2.0, MIT
  • Agent tools: MIT
0 of 0 asset sources allow commercial use with no credit needed.
9 / 9
Checks met in the last test build
  • Build 2, Oct 12, 2026
  • 8 things in the brief reported, 0 serious
  • Findings went back into recipe v0.3
The brief counts it as done when these 7 checks pass
  • npm run build compiles with tsc and no errors; npm test passes.
  • Tests connect a real Client to the server in memory and call every tool: valid arguments give the expected result and structuredContent; invalid arguments give isError: true with a message that says what to fix; an API failure gives isError: true with a safe message and no URL, key or stack trace in it.
  • The tools work against a fake API that the tests start on 127.0.0.1 with node:http, so no real service or key is needed.
  • MCP_INSPECTOR_SECRET_STORE=memory npx -y @modelcontextprotocol/inspector@2.10.1 --cli node dist/index.js -e API_BASE_URL=http://127.0.0.1:4010 -e API_KEY=fake-key --method tools/list lists every tool with its description and schema, and a tools/call on the search tool returns results while the fake API runs (npm run fake-api).
  • Nothing but protocol messages goes to stdout: a test spawns node dist/index.js, sends initialize, and the first line it reads back parses as JSON-RPC.
  • Every tool has a description that says when to use it, .describe() on every argument, and readOnlyHint: true on tools that only read.
  • README.md has the lines that connect the server to Claude Code, Cursor, VS Code and Codex.

Left to you, because no check can do it: Put the real API's base URL and key into .env and try the server from your agent on real data: decide then whether the tool descriptions make the agent pick the right tool.

The parts and why each was picked

Defaults for commercial use, free parts and Claude Code. Change them.

Server

Runtime
Node.js 22.19 or newer official source

The SDK, the Inspector and the test runner each set a lowest Node version; 22.19 satisfies all three.

Nothing to install

MCP SDK

Speaks the protocol: lists tools, checks arguments against their schemas, and turns errors into results the model can read. Version 2 is the stable line; the single @modelcontextprotocol/sdk package is version 1.

In 563 of 4,663 JS/TS agent projects (12%) · #1 of 67 in agent, MCP and tool libraries · v2.3.1, October 5, 2026 (npm registry) · Apache-2.0 · Installs from a package registry

Schemas
Zod 4.6.7

One Zod schema per tool gives the JSON Schema the model sees, checks the arguments and types the handler.

In 1,502 of 4,663 JS/TS agent projects (32.1%) · #1 of 36 in forms, validation and schemas · v4.6.7 (npm registry) · MIT · Installs from a package registry

Language

Types catch a tool whose handler and schema disagree before an agent does.

In 3,311 of 4,663 JS/TS agent projects (71%) · #1 of 23 in languages, types and runtimes · v7.0.2 (npm registry) · Apache-2.0 · Installs from a package registry

Installed along with them: MCP TypeScript SDK (client) 2.3.1, @types/node 26.6.5.

Checks

Tests
Vitest 5.0.4

Calls every tool through a real MCP client in memory: schemas, errors and results are tested the way a host sees them.

In 1,230 of 4,663 JS/TS agent projects (26.3%) · #1 of 42 in testing · v5.0.4 (npm registry) · MIT · Installs from a package registry

Manual and CLI check
MCP Inspector official source

Starts the built server as a host would and lists and calls its tools from the command line.

Free · MIT, moving to Apache-2.0 (the MCP project's licensing transition) · A tool for you, not for the agent

For your agent

Library knowledge
Context7 4.3.0

SDK version 2 renamed the imports and replaced server.tool() and new StdioServerTransport(); models still write version 1 from memory.

By Upstash · In 1,266 of 29,413 sampled repos · v4.3.0 on npm · Agent can use it through MCP

Tool and asset data

If the agent needs another library, it asks AgentGid for one that fits your constraints.

By AgentGid · Agent can use it through MCP

The plan your agent follows

The agent works one step at a time and does not start a step until the previous one meets its "Done when" lines. The full instructions, with code, are in AGENTS.md.

  1. Scaffold · done when:
    • npm run build and npm test run (no tests yet is fine).
    • The kit files listed under "Before you start" are still there.
  2. API client and fake API · done when:
    • A test starts the fake API on a free port and the client gets, searches and fails as expected.
  3. Tools · done when:
    • In-memory tests (InMemoryTransport.createLinkedPair() from @modelcontextprotocol/server, Client from @modelcontextprotocol/client) cover every tool: a hit, no hit, invalid arguments, a 500 from the fake API, and a check that no result text contains the key or the API's base URL.
    • Calling a tool that is not registered throws (ProtocolError: Tool ... not found) instead of returning isError: test that case with rejects.
  4. Stdio entry · done when:
    • A test spawns node dist/index.js, writes an initialize request to its stdin and reads one JSON-RPC response from stdout, with nothing before it.
    • The Inspector CLI lists and calls the tools (see Definition of done).
  5. Connect it to the agent · done when:
    • The README lines use /absolute/path/to/dist/index.js as a placeholder, say how to print the real one (realpath dist/index.js), and name every variable the server reads.
  6. Verify · done when:
    • Every line under Definition of done is true, and anything that could not be verified is named in PROGRESS.md.

Known traps

What test builds and the official docs showed going wrong with these parts. Each one is in the brief, so the agent reads it before it gets there.

  • SDK version 2 is a different package set: import from @modelcontextprotocol/server (and .../server/stdio), not from @modelcontextprotocol/sdk/server/mcp.js; use registerTool with a z.object schema instead of server.tool(); start stdio with serveStdio(factory) instead of new StdioServerTransport() plus connect. SDK v2 docs
  • TypeScript 6 and newer no longer include @types/* automatically; the SDK's published types reference Buffer, so tsc fails until "types": ["node"] is in tsconfig. SDK README, and measured with @modelcontextprotocol/server 2.3.1, TypeScript 7.0.2 and Node 22.22, Oct 12, 2026
  • Anything printed to stdout in a stdio server breaks the protocol: the host parses every stdout line as a JSON-RPC message. SDK v2 docs
  • The SDK turns an exception thrown in a tool handler into the result text the model reads, word for word: an error that contains a URL with a key in its query string hands the key to the model. SDK v2 docs, and measured with @modelcontextprotocol/server 2.3.1, TypeScript 7.0.2 and Node 22.22, Oct 12, 2026
  • Invalid arguments do not throw on the client: they come back as a normal result with isError: true and "Input validation error: ...". Tests that wait for an exception pass when they should fail. measured with @modelcontextprotocol/server 2.3.1, TypeScript 7.0.2 and Node 22.22, Oct 12, 2026
  • With an outputSchema, a result without structuredContent (or with the wrong shape) is turned into an error result. measured with @modelcontextprotocol/server 2.3.1, TypeScript 7.0.2 and Node 22.22, Oct 12, 2026
  • The MCP Inspector 2.10.1 needs Node 22.19 or newer; mode flags (--cli, --web, --tui) must come before the server command, and -e KEY=VALUE after it (--cli node dist/index.js -e API_KEY=fake-key --method tools/list). Put before the command, -e fails with "No servers found in config file". The CLI exits with code 5 when a tool result has isError: true, though it prints the result: scripts must not read that as the Inspector failing. npm registry, `--help`, and measured with Inspector 2.10.1, Oct 12, 2026
  • TypeScript 7 does not export typescript/bin/tsc: require.resolve('typescript/bin/tsc') fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Run tsc through npm scripts (pretest), or resolve typescript/package.json and join bin/tsc. measured with @modelcontextprotocol/server 2.3.1, TypeScript 7.0.2 and Node 22.22, Oct 12, 2026
  • Vitest 5 writes a small token file, vitest/.vitest-secret-token, into the user's data folder on the first npm test: $XDG_DATA_HOME or ~/.local/share on Linux, ~/Library/Application Support on macOS, %LOCALAPPDATA% on Windows. If you may not write outside the project, on Linux point XDG_DATA_HOME at a git-ignored folder inside it when you run the tests. Vitest 5.0.4 package source, `getUserDataDir()`

Checks on this kit

  • Note The kit uses SDK version 2 (2.3.1). Version 1 (@modelcontextprotocol/sdk) still installs and has the most examples online; do not mix the two in one project. Source

What happened when an agent built from it

The recipe was given to a fresh coding agent in a clean sandbox, twice. The agent got only the kit files. It had to build the project and write down everything in the brief that was wrong, missing or unclear.

Build 1 · brief v0.1 · Oct 12, 2026

9 of 9
lines of the definition of done met
14
things in the brief reported as wrong, missing or unclear
1
serious: could have left the HTTP endpoint open

The brief did not name SDK 2's HTTP functions and implied they check the host and origin themselves; they do not. The agent found the validators in the type definitions and called them. Smaller gaps: a missing script, Vitest failing with no tests, and where the Inspector takes environment variables.

Build 2 · brief v0.2 · Oct 12, 2026

9 of 9
lines of the definition of done met
8
things in the brief reported as wrong, missing or unclear
0
serious: stopped the build or shipped a flaw

Nothing stopped the build and nothing unsafe was shipped. The example entry point hid a missing API address behind an "Internal server error", Vitest also ran the clean copy's tests, and the HTTP port was fixed at 3000.

Result of the last build. A TypeScript MCP server with search, get and create tools over a fake notes API, served over stdio and over HTTP with a bearer token; 36 tests pass, the MCP Inspector CLI lists and calls the tools, and Claude Code connects to it. Its findings went back into the recipe, which is now at v0.3. That version has not been built again as a whole.

Checked again on Oct 19, 2026. AgentGid checks every recipe each week, without a model: 7 pinned packages all still exist on their registries, 1 of them has a newer release than the tested pin; 18 links in the brief: all open (2 refused automated requests, which some sites do). npm lines are checked pin by pin, not installed.

Not checked by anyone yet

  • A real API, and how well the tool descriptions steer a real agent
  • Loading the config lines in Cursor, VS Code and Codex
  • macOS and Windows

The kit files

Put them in an empty project folder, open your coding agent there and paste the first prompt (Claude Code first asks you to approve the MCP servers in .mcp.json). These are the files for Claude Code with the default answers; the kit builder writes them for Cursor, Codex, Copilot or another agent, and for other choices. Full guide: how to use a kit.

FileWhat it isSize
AGENTS.mdThe brief: what to build, stack and versions, licenses, plan with checks, known traps243 lines
CREDITS.mdThe license record of every third-party file28 lines
first-prompt.txtYour first message to the agent8 lines
install.txtInstall commands with exact versions4 lines
CLAUDE.mdOne line that imports AGENTS.md for Claude Code1 lines
.mcp.jsonThe MCP servers the brief lists, for Claude Code15 lines
kit.jsonThe kit as data: parts, versions, checks191 lines

Download all (.zip)

first-prompt.txt the agent stops after each step and reports
Read AGENTS.md from top to bottom before you do anything else. The kit files it lists are already in this folder.

Then do step 1 of the plan and stop. Report back with:
1. the commands you ran,
2. what each "Done when" check showed (a screenshot or the output),
3. anything in AGENTS.md that turned out to be wrong, missing or out of date.

Do not start step 2 until I reply.
Or let it run the whole plan
Read AGENTS.md from top to bottom before you do anything else. The kit files it lists are already in this folder.

Then work through the plan in order. After each step, run its "Done when" checks yourself and write one line in PROGRESS.md: the step, what you checked, and the result.
You may install the packages and download the files that AGENTS.md lists without asking. Stop and ask me only for what its "Before you start" section says needs a person.
When a check fails, fix the cause and run it again. If it still fails after two real fixes, stop and tell me what you tried.
Keep a list in PROGRESS.md of anything in AGENTS.md that turned out to be wrong, missing or out of date.
When every line of the Definition of done is true, stop and show me how to run it.
install.txt
node --version   # must print v22.19 or newer
npm init -y && npm pkg set type=module
npm install --save-exact @modelcontextprotocol/server@2.3.1 zod@4.6.7
npm install -D --save-exact typescript@7.0.2 vitest@5.0.4 @modelcontextprotocol/client@2.3.1 @types/node@26.6.5

Other versions of this kit

Where the agent runs

Over stdio the agent starts the server on the same computer: nothing listens on the network. Over HTTP one server serves agents on other machines and needs a token.

Same computer (this page) Other machines too

Can tools change data

Read-only servers cannot do damage when a model misreads a request. Write tools are off until the person turns them on.

Read only (this page) Also create and update

Other versions were not test-built as a whole: the kit says which parts differ from the tested one.

Ask for this kit from your agent

Agents connected to the AgentGid MCP server get the same kit without this page: list_recipes(), then plan_project({"recipe": "mcp-server", "answers": {"agent": "cursor"}, "files": true}). Every brief also tells the agent to ask AgentGid before it adds a part that is not listed.

Recipe mcp-server v0.3. Data snapshot Oct 12, 2026: versions, licenses and prices change, so check the linked pages before you ship.

Comments

  • Built something with this kit? Share what worked, what broke and what you changed.

Other kits