Create a server. config.name and config.version identify the server
to clients during initialization. config.basePath (default "/mcp")
is both the MCP route and the path of the OAuth protected-resource
identity, so any explicit OAuth resource URL must use that exact path.
Nothing binds or listens until MCPServer.listen or
the first request reaches MCPServer.fetch.
ReadonlyallRegister a typed route for every HTTP method on MCPServer.app.
ReadonlyappHono application that owns HTTP middleware and routes.
ReadonlydeleteRegister a typed DELETE route on MCPServer.app.
ReadonlyfetchCanonical Web-standard handler for edge runtimes and framework mounting.
ReadonlygetRegister a typed GET route on MCPServer.app.
ReadonlypatchRegister a typed PATCH route on MCPServer.app.
ReadonlypostRegister a typed POST route on MCPServer.app.
ReadonlyputRegister a typed PUT route on MCPServer.app.
The URL path prefix the MCP endpoint is mounted at.
Reflects config.basePath (default "/mcp"). Exposed so tooling that
imports the entry module — mcp-use dev's startup log, for example —
can build endpoint and development-tool URLs without assuming the default.
Immutable normalized branding shared by MCP identity and browser pages.
favicon is the final source after explicit-favicon and icon-selection
precedence. Landing-page integrations can use this accessor and link to
the server's root-level /favicon.ico route without reading private
configuration or depending on the landing/view layers.
Configured bind host, before CLI and environment overrides.
Configured bind port, before CLI and environment overrides.
String-keyed tooling alias for registerSkills.
Abort in-flight MCP exchanges and stop the HTTP listener.
A closed server is done for good — the underlying MCP handler stays
closed, so listen()/fetch() cannot revive it. Create a new
instance to serve again.
Canonical Web-standard handler for edge runtimes and framework mounting.
Use MCPServer.fetch directly.
Serve over HTTP on Node. Pass port 0 for an ephemeral port. Port
precedence is the argument, PORT, config.port, then 3000; host
precedence is options.host, HOST, config.host, then 127.0.0.1.
Localhost-class binds get
DNS-rebinding Host protection automatically. Origin validation is off
unless allowedOrigins is set. To serve publicly set host: "0.0.0.0";
behind a platform edge that is all that's needed, and allowedHosts
restricts direct exposure (additive — localhost-class values stay allowed).
With OAuth and no explicit resource or MCP_URL, a localhost listener
derives its protected-resource URL from the actual bound port. Mounting
therefore waits for the listener callback (especially for port 0), and
requests accepted before then are queued. Public/wildcard listeners must
configure the resource before calling this method.
If called on a localhost-class bind after MCPServer.fetch already mounted the app without Host validation.
Register a read-only MCP observer. Unlike MCPServer.use, listeners cannot block, override, or mutate params. Throwing is logged and does not fail the request.
Append :complete to run after the handler (for example
mcp:tools/call:complete).
Register a prompt template. Schema fields wrapped with completable()
gain autocomplete via completion/complete.
Compose upstream MCP servers into this server.
A name-keyed HTTP config creates upstream connections through the optional
@mcp-use/client v2 peer. Each key automatically namespaces its mounted
tools, resources, and prompts. You may instead pass an existing ready
ProxyConnection; its negotiated server name becomes the namespace
and the connection remains caller-owned. Anonymous connections cannot use
this overload because they do not provide a namespace.
Connection, introspection, and collision failures are diagnosed and skipped without discarding capabilities that can be mounted.
Namespace-keyed upstream HTTP connection settings.
Mount an existing ready @mcp-use/client v2 connection.
Ready connection to introspect and forward through. The connection's negotiated server name automatically namespaces every mounted capability. Anonymous connections are rejected because they do not provide a namespace. Introspection and collision failures are diagnosed and skipped without discarding capabilities that can be mounted.
Register a static resource readable at definition.uri.
Register a parameterized resource. Reads matching uriTemplate invoke
the callback with the extracted variables.
The const type parameter keeps uriTemplate a string literal during
inference (plain generic inference widens object-literal properties to
string), which is what lets InferTemplateParams type the callback's
params from the template's variables.
Register one native plugin settings read/update pair before starting the server.
Callbacks receive the same request context and OAuth guarantees as ordinary authenticated tools. They own authorization, defaults, persistence, atomic partial updates, and cross-field validation. The framework validates field values and replays both tools and the capability on every request-scoped server.
Register a tool. Input is validated against inputSchema before the callback
runs; results carrying structuredContent are type-checked against
outputSchema at the callback's return position.
Assign static registrations to exported constants so mcp-env.d.ts can
expose their ToolRef types to views:
export const search = server.tool(...).
ctx.auth is required in the callback unless
definition.securitySchemes includes noauth.
A ToolRef carrying the tool name and phantom types for inference-based view typing.
Register HTTP middleware or typed MCP operation middleware.
MCP patterns always use an mcp: prefix (for example
mcp:tools/call, mcp:*). Every other overload is Hono middleware and
may target all routes or a path pattern.
Exact methods may transform their typed result. The global mcp:* pattern
is pass-through middleware. Middleware runs in registration order; call
next() to continue the chain.
Register HTTP middleware or typed MCP operation middleware.
MCP patterns always use an mcp: prefix (for example
mcp:tools/call, mcp:*). Every other overload is Hono middleware and
may target all routes or a path pattern.
Exact methods may transform their typed result. The global mcp:* pattern
is pass-through middleware. Middleware runs in registration order; call
next() to continue the chain.
Register HTTP middleware or typed MCP operation middleware.
MCP patterns always use an mcp: prefix (for example
mcp:tools/call, mcp:*). Every other overload is Hono middleware and
may target all routes or a path pattern.
Exact methods may transform their typed result. The global mcp:* pattern
is pass-through middleware. Middleware runs in registration order; call
next() to continue the chain.
StaticfromCreate an MCP server from a parsed, bundled OpenAPI document.
Each included OpenAPI operation becomes a tool that validates its input,
calls the matching upstream HTTP endpoint, and returns the response using
the SDK's raw tool-result shape. External $ref values are not fetched;
bundle the document before passing it in.
OpenAPI document, operation filters, upstream URL, and request authentication options.
An unauthenticated MCP server populated with generated tools.
MCP server with declarative tool/resource/prompt registration, served statelessly over a composed fetch handler.
Registrations are stored in a registry; a fresh SDK
McpServeris built from it for every HTTP request (the stateless 2026-07-28 model), so definition-time work must stay cheap — put pools and caches at module scope, not inside callbacks' setup.Example