Production-Ready MCP Server Framework • Build, deploy & scale secure AI agent infrastructure • Includes Auth, Observability, Debugger, Telemetry & Runtime • Run real-world MCPs powering AI Agents
SaferSkills independently audited Golf (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <img src="./golf-banner.png" alt="Golf Banner">
<br>
<h1 align="center"> <br> <span style="font-size: 80px;">⛳ Golf</span> <br> </h1>
<h3 align="center"> Easiest framework for building MCP servers </h3>
<br>
<p> <a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License"></a> <a href="https://github.com/golf-mcp/golf/pulls"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg" alt="PRs"></a> <a href="https://github.com/golf-mcp/golf/issues"><img src="https://img.shields.io/badge/support-contact%20author-purple.svg" alt="Support"></a> </p>
<p> <a href="https://docs.golf.dev"><strong>📚 Documentation</strong></a> </p> </div>
Golf is a framework designed to streamline the creation of MCP server applications. It allows developers to define server's capabilities—tools, prompts, and resources—as simple Python files within a conventional directory structure. Golf then automatically discovers, parses, and compiles these components into a runnable MCP server, minimizing boilerplate and accelerating development.
With Golf v0.2.0, you get enterprise-grade authentication (JWT, OAuth Server, API key, development tokens), built-in utilities for LLM interactions, and automatic telemetry integration. Focus on implementing your agent's logic while Golf handles authentication, monitoring, and server infrastructure.
Get your Golf project up and running in a few simple steps:
Ensure you have Python (3.10+ recommended) installed. Then, install Golf using pip:
pip install golf-mcpUse the Golf CLI to scaffold a new project:
golf init your-project-nameThis command creates a new directory (your-project-name) with a basic project structure, including example tools, resources, and a golf.json configuration file.
Navigate into your new project directory and start the development server:
cd your-project-name
golf build dev
golf runThis will start the MCP server, typically on http://localhost:3000 (configurable in golf.json).
That's it! Your Golf server is running and ready for integration.
A Golf project initialized with golf init will have a structure similar to this:
<your-project-name>/
│
├─ golf.json # Main project configuration
│
├─ tools/ # Directory for tool implementations
│ └─ hello.py # Example tool
│
├─ resources/ # Directory for resource implementations
│ └─ info.py # Example resource
│
├─ prompts/ # Directory for prompt templates
│ └─ welcome.py # Example prompt
│
├─ .env # Environment variables (e.g., API keys, server port)
└─ auth.py # Authentication configuration (JWT, OAuth Server, API key, dev tokens)tools/payments/charge.py). The module docstring of each file serves as the component's description.tools/hello.py becomes hello, and a nested file like tools/payments/submit.py would become submit_payments (filename, followed by reversed parent directories under the main category, joined by underscores).Creating a new tool is as simple as adding a Python file to the tools/ directory. The example tools/hello.py in the boilerplate looks like this:
# tools/hello.py
"""Hello World tool {{project_name}}."""
from typing import Annotated
from pydantic import BaseModel, Field
class Output(BaseModel):
"""Response from the hello tool."""
message: str
async def hello(
name: Annotated[str, Field(description="The name of the person to greet")] = "World",
greeting: Annotated[str, Field(description="The greeting phrase to use")] = "Hello"
) -> Output:
"""Say hello to the given name.
This is a simple example tool that demonstrates the basic structure
of a tool implementation in Golf.
"""
print(f"{greeting} {name}...")
return Output(message=f"{greeting}, {name}!")
# Designate the entry point function
export = helloGolf will automatically discover this file. The module docstring """Hello World tool {{project_name}}.""" is used as the tool's description. It infers parameters from the hello function's signature and uses the Output Pydantic model for the output schema. The tool will be registered with the ID hello.
Golf includes enterprise-grade authentication, built-in utilities, and automatic telemetry:
# auth.py - Configure authentication
from golf.auth import configure_auth, JWTAuthConfig, StaticTokenConfig, OAuthServerConfig
# JWT authentication (production)
configure_auth(JWTAuthConfig(
jwks_uri_env_var="JWKS_URI",
issuer_env_var="JWT_ISSUER",
audience_env_var="JWT_AUDIENCE",
required_scopes=["read", "write"]
))
# OAuth Server mode (Golf acts as OAuth 2.0 server)
# configure_auth(OAuthServerConfig(
# base_url="https://your-golf-server.com",
# valid_scopes=["read", "write", "admin"]
# ))
# Static tokens (development only)
# configure_auth(StaticTokenConfig(
# tokens={"dev-token": {"client_id": "dev", "scopes": ["read"]}}
# ))
# Built-in utilities available in all tools
from golf.utils import elicit, sample, get_context# Enable OpenTelemetry tracing
export OTEL_TRACES_EXPORTER="otlp_http"
export OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318/v1/traces"
golf run # ✅ Telemetry enabled[📚 Complete Documentation →](https://docs.golf.dev)
Basic configuration in golf.json:
{
"name": "My Golf Server",
"host": "localhost",
"port": 3000,
"transport": "sse",
"opentelemetry_enabled": false,
"detailed_tracing": false
}"sse", "streamable-http", or "stdio"Golf collects anonymous usage data on the CLI to help us understand how the framework is being used and improve it over time. The data collected includes:
No personal information, project names, code content, or error messages are ever collected.
You can disable telemetry in several ways:
golf telemetry disableThis saves your preference permanently. To re-enable:
golf telemetry enable--no-telemetry to save your preference: golf init my-project --no-telemetryYour telemetry preference is stored in ~/.golf/telemetry.json and persists across all Golf commands.
<div align="center"> Made with ❤️ in Warsaw, Poland and SF </div>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.