Best for
- Developers using TypeScript
- Teams needing quick iteration and automatic discovery of tools/resources/prompts
- Projects wanting built-in authentication for MCP servers (JWT, API Key, OAuth 2.1)
M
MCP Framework
Community
Framework / SDK
A TypeScript framework for building MCP servers elegantly
This is a framework for building MCP servers or agents, not a server you connect a client to.
- Category
- Dev Tools #339 of 438
- Stars
- ★ 931 Popular
- Transport
- stdio (local process) · SSE · Streamable HTTP
- Runtime
- Node.js
- Credentials
- No credential needed
- License
- MIT
- Last commit
- ⚠
42FMRS · D
mcp-framework is a comprehensive TypeScript MCP framework offering automatic discovery, multiple transports, and authentication options, suitable for quickly building MCP servers. Documentation is thorough and the project is actively maintained by QuantGeekDev, but requires TypeScript knowledge and careful security configuration in production.
Strongest · Documentation 13/20 Weakest · Reliability 3/20
Why each score
- Reliability 3/20
- Only the README and repo metadata were supplied; no source files, tests, or CI workflows could be inspected. The README claims automatic discovery, stdio/SSE/HTTP-stream transports, and build-time/runtime validation, but none of these behaviors is verifiable from the evidence, so the score stays close to the bottom of the happy-path-plausible range. No committed tests or CI runs covering the server handshake or tool listing exist in the supplied material, and small inconsistencies in the code samples (odd alias, formatting issues) further reduce confidence.
- Security and permissions 7/20
- No red-line risk is visible from the supplied material: no malware, credential theft, covert exfiltration, or destructive defaults; installation examples contain only placeholder env vars, never real secrets. The optional JWT, API-key, OAuth 2.1, and custom auth providers are a sound credential-handling design. Deductions: auth is opt-in by default, the experimental HTTP transport scaffolds CORS as wildcard by default (disclosed but not mitigated by default), and the actual implementation cannot be inspected to confirm least-privilege scoping or data boundaries. Score 7.
- Maintenance 7/20
- MIT license is present in both README and repo metadata, and the repository is not archived. Beyond that, the supplied evidence shows no commit history, releases, changelog, issue-response pattern, dependency update record, or security response channel (no SECURITY.md). Stars and issue counts are discovery signals and do not add points. Activity may be real, but with no versioning or response evidence the score stays moderate. Score 7.
- Documentation 13/20
- The README is layered and unusually complete: quick start, CLI reference, Zod schema development with enforced descriptions, validation strategies, all three transports with full options, JWT/API key/OAuth 2.1/custom auth with env vars and client usage, an env-var table, and Claude Desktop/Claude Code config examples. Limitations such as the CORS wildcard scaffold and the experimental HTTP transport are disclosed. Deductions: no troubleshooting section, no rate/cost/operational limits, no reviewable CI or test artifacts supporting the claims, a very thin projects section, and minor sample-code inconsistencies. Score 13.
- Setup experience 12/20
- The README documents a short path to a working client connection: global npm install of the CLI, mcp create, mcp add tool, npm run build, node dist/index.js, then paste the provided JSON into Claude Desktop (macOS and Windows paths given). This is clear and few-step with client examples. However, the static calibration caps setup at 15 without verifiable execution evidence such as committed tests or CI, and none is supplied; Linux configuration is not shown, global-install fragility is unaddressed, and the generated server has not been observed running. Score 12.
Static review · not runListed 2026-08-07
Read the FMRS scoring method →Fit and risk
What it can accessUses the network
Not for
- Developers not using TypeScript
- Edge cases requiring non-standard transports or heavy custom authentication
- Users wanting complete control over server internals
Required permissions
- File system access (for logging, if enabled)
- Network access (for SSE/HTTP transports and authentication services)
Risks and side effects
- Token leakage risk when relying on external OAuth providers
- Wildcard CORS may increase cross-origin attack surface
- Skipping tool validation may lead to incomplete documentation
Setup
Before you start
Runtime：Node.js
JWT_SECRET
Secret used to sign/verify JWTs; generate and store it yourself.
API_KEY
Key checked against the X-API-Key header; generate it yourself.
OAUTH_CLIENT_SECRET
Client secret for the introspection endpoint, obtained when registering with the authorization server.
Other optional settings (12)
MCP_ENABLE_FILE_LOGGING
Set to true to enable file logging; defaults to false, nothing external needed.
MCP_LOG_DIRECTORY
Directory for log files, defaults to logs.
MCP_DEBUG_CONSOLE
Set to true to show debug-level messages in the console; defaults to false.
MCP_SKIP_TOOL_VALIDATION
Set to true to skip tool description validation during build (not recommended).
DOCS_BASE_URL
Docs site URL for the docs MCP server, e.g. https://docs.myapi.com; taken from your documentation site.
OAUTH_AUTHORIZATION_SERVER
OAuth 2.1 authorization server URL from your identity provider (Auth0, Okta, etc.).
OAUTH_RESOURCE
Protected resource identifier URI, i.e. your MCP server's address.
OAUTH_JWKS_URI
Authorization server's JWKS public key endpoint for local JWT validation.
OAUTH_AUDIENCE
Expected audience claim of tokens, configured on your authorization server.
OAUTH_ISSUER
Expected issuer claim of tokens, configured on your authorization server.
OAUTH_INTROSPECTION_ENDPOINT
Token introspection endpoint provided by your authorization server.
OAUTH_CLIENT_ID
Client ID for the introspection endpoint, obtained when registering with the authorization server.
- Install the framework globally: npm install -g mcp-framework
- Create a new MCP server project: mcp create my-mcp-server
- Navigate to your project: cd my-mcp-server
- Your server is ready to use; build with npm run build.
Check that it works
Run npm run build, then start the server with node dist/index.js and add it to a client like Claude Desktop; the tools you defined (or search_docs/get_page/list_sections for the docs server) should appear in the client's tool list.
Troubleshooting
- If build fails with tool validation errors, ensure every Zod field has a description using .describe()
- If server won't start, check environment variables like MCP_ENABLE_FILE_LOGGING
- If using OAuth auth, ensure all OAuth environment variables (e.g., OAUTH_JWKS_URI) are set
Things to try
Once connected, you can ask your AI assistant things like:
- Search the documentation for the authentication setup section
- Use get_page to fetch the full markdown of that docs page
- List the section structure of the documentation site
Use cases
Rapidly scaffold MCP server prototypes
Create custom tools, resources, and prompts for AI assistants
Integrate into TypeScript projects with type safety and automatic validation
Supported clients
Claude Desktop
Listed from the project's documentation, not tested by this site.
Overview
mcp-framework is a framework for building Model Context Protocol (MCP) servers in TypeScript. It provides architecture out of the box with automatic directory-based discovery for tools, resources, and prompts, supports multiple transports (stdio, SSE, HTTP Stream), is built on the official MCP SDK, and offers out-of-the-box authentication for SSE endpoints (OAuth 2.1, JWT, API Key).
Similar servers
Context7
80 · B
Upstash's official server providing up-to-date third-party library docs for AI coding assistants
NPM Sentinel MCP Server
79 · B
AI-powered NPM package analysis MCP server
MartinLoop MCP Server
79 · B
An independent control layer that gives AI coding agents budgets, brakes, and receipts
GitHub MCP Server
76 · B
GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
Source revision ead9c4bbcd5f Data synced 2026-10-19 Read the FMRS scoring method