mcp-sdk-typescript-bootstrapper — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-sdk-typescript-bootstrapper (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bootstrap production-ready MCP servers using the official TypeScript SDK with proper transport configuration, tool/resource handlers, and security best practices.
Invoke this skill when you need to:
| Parameter | Type | Required | Description |
|---|---|---|---|
| serverName | string | Yes | Name of the MCP server (kebab-case) |
| description | string | Yes | Server description for clients |
| transport | string | No | stdio, sse, or websocket (default: stdio) |
| tools | array | No | List of tools to scaffold |
| resources | array | No | List of resources to provide |
| capabilities | object | No | Server capability declarations |
{
"tools": [
{
"name": "read_file",
"description": "Read contents of a file",
"inputSchema": {
"type": "object",
"properties": {
"path": { "type": "string", "description": "File path to read" }
},
"required": ["path"]
}
}
]
}{
"resources": [
{
"uriTemplate": "file:///{path}",
"name": "File Resource",
"description": "Access file contents",
"mimeType": "text/plain"
}
]
}<serverName>/
├── package.json
├── tsconfig.json
├── .gitignore
├── README.md
├── src/
│ ├── index.ts # Server entry point
│ ├── server.ts # MCP server setup
│ ├── transport/
│ │ ├── stdio.ts # Stdio transport
│ │ ├── sse.ts # SSE transport (if selected)
│ │ └── websocket.ts # WebSocket transport (if selected)
│ ├── tools/
│ │ ├── index.ts # Tool registry
│ │ └── <tool>.ts # Individual tool handlers
│ ├── resources/
│ │ ├── index.ts # Resource registry
│ │ └── <resource>.ts # Resource providers
│ ├── prompts/
│ │ └── index.ts # Prompt templates (optional)
│ └── utils/
│ ├── validation.ts # Input validation helpers
│ ├── errors.ts # MCP error handling
│ └── logging.ts # Structured logging
├── tests/
│ ├── tools/
│ └── resources/
└── mcp.json # MCP server manifestimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
import { registerTools } from './tools';
import { registerResources } from './resources';
export async function createServer() {
const server = new McpServer({
name: '<serverName>',
version: '1.0.0',
});
// Register capabilities
registerTools(server);
registerResources(server);
return server;
}
export async function startServer() {
const server = await createServer();
const transport = new StdioServerTransport();
await server.connect(transport);
console.error('[MCP] Server started on stdio');
}import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { z } from 'zod';
import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
const inputSchema = z.object({
path: z.string().describe('File path to read'),
});
export function registerReadFileTool(server: McpServer) {
server.tool(
'read_file',
'Read contents of a file',
inputSchema.shape,
async (args) => {
const { path } = inputSchema.parse(args);
try {
// Implementation
const content = await readFile(path, 'utf-8');
return {
content: [{ type: 'text', text: content }],
};
} catch (error) {
throw new McpError(
ErrorCode.InternalError,
`Failed to read file: ${error.message}`
);
}
}
);
}import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
export function registerFileResource(server: McpServer) {
server.resource(
'file:///{path}',
'File Resource',
'Access file contents by path',
async (uri) => {
const path = uri.pathname;
const content = await readFile(path, 'utf-8');
return {
contents: [{
uri: uri.href,
mimeType: 'text/plain',
text: content,
}],
};
}
);
}{
"dependencies": {
"@modelcontextprotocol/sdk": "^1.0.0",
"zod": "^3.22.0"
},
"devDependencies": {
"@types/node": "^20.0.0",
"typescript": "^5.0.0",
"vitest": "^1.0.0"
}
}import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
const transport = new StdioServerTransport();import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
import express from 'express';
const app = express();
app.get('/sse', (req, res) => {
const transport = new SSEServerTransport('/message', res);
server.connect(transport);
});import { WebSocketServerTransport } from '@modelcontextprotocol/sdk/server/websocket.js';
import { WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 3000 });
wss.on('connection', (ws) => {
const transport = new WebSocketServerTransport(ws);
server.connect(transport);
});~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.