The MCP TypeScript SDK lets you build one plugin server that every AI app can call

Video: A plugin for every AI app? Try the MCP TypeScript SDK

Oct 25, 2026 · based on the channel Jabran Qamar Khan

The MCP TypeScript SDK is the official open-source TypeScript library for the Model Context Protocol: it lets you build an MCP server that exposes tools, resources and prompts to AI assistants and agents, plus MCP clients that connect to such servers. You install it from npm as @modelcontextprotocol/server (and @modelcontextprotocol/client for the client side), write your handlers in TypeScript, and the same server can then be consumed by hosts such as VS Code with GitHub Copilot, Claude Code and Cursor. The code lives in the official MCP TypeScript SDK repository, which is where you can read the source, file issues and track releases.

The point is to stop shipping a separate plugin for every AI app your users happen to run. Instead of writing one integration for Copilot, another for Claude Code and a third for Cursor, you expose your actions once over MCP and any MCP-capable host can list and call them. The SDK runs on Node.js, Bun and Deno, and it builds both halves of the conversation: the server that owns your logic and the client that a host embeds.

What the TypeScript SDK gives you beyond the raw protocol

MCP itself is a protocol, so in theory you could hand-write JSON-RPC messages; the SDK exists so you do not have to. It handles the transport, the message framing and the schema plumbing, and it gives you three registration primitives that map to the three things a host can show a user.

1. Tools are actions the model can call. You register them with server.registerTool and pass a Zod input schema. The SDK derives the JSON Schema the model sees, validates incoming arguments before your handler runs, and returns a validation error to the model when the arguments are wrong.
2. Resources are read-only data the application attaches to the conversation, registered with registerResource.
3. Prompts are templates a person picks explicitly, registered with registerPrompt.

The call flow is the same in every host: the host's MCP client lists what your server offers, the model chooses a tool by its name, description and schema, the SDK checks the arguments and runs your handler, and the result travels back to the model. Because the schema is declared once in Zod, you get runtime validation and the model-facing description from a single source.

Local stdio or one Streamable HTTP endpoint

The SDK supports two transports, and the choice is mostly about where your server runs.

serveStdio(createServer) is for a host that launches your server as a child process on the same machine. That is the simplest setup for a developer tool: the host starts the process, speaks over standard input and output, and stops it when done. One practical rule from the tutorial: log with console.error, never console.log, because stdout is the protocol channel and stray output corrupts it.

createMcpHandler(createServer) is for remote use. It exposes one Streamable HTTP endpoint that many clients can share, and it plugs into Express, Hono, Fastify or Cloudflare Workers through the provided app helpers. A single deployed endpoint can then serve every user who has an MCP-capable assistant, which is the whole reason the protocol is worth the effort.

One server registered in VS Code, Claude Code and Cursor

The SDK guide demonstrates the multi-host claim with a single launch command, npx tsx src/index.ts, registered in three places. In VS Code the server is added to the MCP configuration and requires GitHub Copilot in Agent mode. In Claude Code it is added as an MCP server entry. In Cursor it goes into the MCP settings file. The same process, the same tool names, the same schemas; only the host's configuration file differs.

That is the practical answer to plugin proliferation: your integration work happens once, and each new MCP-capable client your users adopt becomes configuration rather than a new project. The trade-off is that you inherit the lowest common denominator of what hosts support, which brings us to the caveats.

The catch: you host it, you secure it, and the spec still moves

The SDK gives you a server, not a service. You deploy it, you pay for it, and you are responsible for its security posture.

Authorization is the sharpest edge. The SDK can verify access tokens with requireBearerAuth, but it never issues them, so you need an identity provider in front. Its HTTP handler checks no Host header, Origin header or token by itself; those checks belong in front of the handler. The Express, Hono and Fastify app helpers add the header checks on localhost, which is fine for development and not a production control.

The MCP specification is explicit about what servers must do: validate all tool inputs, implement proper access controls, rate limit tool invocations and sanitize tool outputs. It also states that tools represent arbitrary code execution, and that clients should validate tool results before passing them to the model. Treat every tool as a public, untrusted entry point.

The protocol is still changing. Spec revision 2026-07-28 removed the initialize handshake and protocol sessions, which is a structural change for anyone who built against the earlier flow. SDK v2 has been stable since 2026-07-27 and brought new packages, a migration guide and a codemod; v1 continues to receive fixes for at least six months after v2. Clients also differ in which features and protocol versions they support, so test against the hosts you actually care about rather than assuming parity.

Licensing is the easy part: Apache 2.0 for new code, with older code still MIT while the MCP project relicenses. There is no paid tier, and hosting is your own cost.

Who should use it, and who should not

The SDK fits TypeScript developers who want one server serving their users' MCP-capable assistants and who are prepared to host and secure it. If you already run a backend and understand bearer tokens and rate limiting, the remaining work is mostly schema design.

If you would rather not operate a server, Composio offers ready-made hosted app tools with managed user logins: open-source SDKs, a hosted platform, a free Hobby plan and a paid Pro tier. If your own application only needs to call MCP servers rather than expose one, the Vercel AI SDK includes a lightweight MCP client, which is a smaller dependency than the full server stack.

Try it in five steps

You need Node.js 20 or later in an ES module project.

1. Install the packages: npm install @modelcontextprotocol/server zod tsx.
2. Create src/index.ts and register one tool with server.registerTool and a Zod schema.
3. Log with console.error only.
4. Run the inspector: npx @modelcontextprotocol/inspector npx tsx src/index.ts.
5. Connect, open the Tools tab, pick your tool and run it with sample arguments.

The inspector is the fastest feedback loop, because it shows exactly what the model would see: the tool's name, description and derived JSON Schema, plus any validation error your handler returns.

Reference links

• SDK repository: https://github.com/modelcontextprotocol/typescript-sdk
• Documentation (v2): https://ts.sdk.modelcontextprotocol.io/v2/
• First server tutorial: https://ts.sdk.modelcontextprotocol.io/v2/get-started/first-server
• Authorization guide: https://ts.sdk.modelcontextprotocol.io/v2/serving/authorization
• MCP specification 2026-07-28: https://modelcontextprotocol.io/specification/2026-07-28
• Alternative, Composio: https://github.com/ComposioHQ/composio

Bottom line

The MCP TypeScript SDK turns the plugin-per-app problem into one server with a Zod-checked tool surface, served over stdio for local hosts or Streamable HTTP for everyone else. It is mature enough to ship against, with v2 stable and a documented migration path, but it deliberately leaves hosting, identity and rate limiting to you, and the spec is still moving under your feet. Start with the inspector, add a bearer-token check before you expose anything publicly, and keep your tool inputs validated. For the full walkthrough, see the video breakdown by Jabran Qamar Khan, and start from the MCP TypeScript SDK repository to clone the examples and read the migration guide.

Source: A plugin for every AI app? Try the MCP TypeScript SDK · Markdown version