A minimal MCP server that exposes tools for addition, echoing text, time lookup, and URL fetching, with support for HTTP and stdio transports.
SaferSkills independently audited node-mcp-poc (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A minimal Model Context Protocol server in Node.js/TypeScript. It runs over HTTP (Express + Streamable HTTP) by default, with stdio available as a fallback, and is attachable to Claude Code.
It exposes four demo tools:
| Tool | Input | Returns |
|---|---|---|
add | { a: number, b: number } | the sum, e.g. 2 + 3 = 5 |
echo | { text: string } | the same text |
now | { timezone?: string } | current time (ISO + localized) |
fetch_url | { url: string, maxChars?: int } | HTTP GET body (JSON pretty-printed) |
Requires Node.js 24 (see .nvmrc) and pnpm. Builds and tests run on Vite / Vitest.
pnpm install
pnpm build # vite build -> build/index.js (server) + build/lambda.js (Lambda)The server reads its config from the environment (a .env file is loaded automatically — see .env.example):
| Variable | Default | Purpose |
|---|---|---|
MCP_TRANSPORT | http | http (Express) or stdio |
PORT | 3219 | HTTP port; endpoint is http://localhost:PORT/mcp |
LOG_LEVEL | info | pino log level |
NODE_ENV | — | development pretty-prints HTTP logs |
pnpm start # HTTP server on http://localhost:3219/mcp
pnpm start:stdio # stdio transport insteadThis repo ships a project-level .mcp.json pointing at the HTTP endpoint, so within this directory the server is picked up automatically once it's running:
{
"mcpServers": {
"node-poc": { "type": "http", "url": "http://localhost:3219/mcp" },
},
}Start the server (pnpm start), then start (or restart) a Claude Code session and try:
Check it's connected with claude mcp list.
To register it from anywhere instead of relying on .mcp.json:
# HTTP (server must already be running)
claude mcp add --transport http node-poc http://localhost:3219/mcp
# or stdio (Claude Code launches the process for you)
claude mcp add node-poc -- node /ABSOLUTE/PATH/TO/node-mcp-poc/build/index.jsRemove it with:
claude mcp remove node-pocpnpm dev # rebuild + node --watch
pnpm test # vitest run
pnpm test:watch # vitest (watch mode)
pnpm typecheck # tsc --noEmit
pnpm smoke # build + stdio client smoke test (scripts/smoke.mjs)
pnpm smoke:http # HTTP client smoke test (scripts/smoke-http.mjs)
pnpm logs # tail logs/server.log through pino-pretty
pnpm inspect # open the MCP Inspector against the serverDeploying to AWS? See [docs/README.md](docs/README.md).
src/lambda.ts is a stateless variant of the server;template.yaml deploys it on nodejs24.x behind a Function URL. pnpm sam:build && sam deploy --guided.
src/index.ts server (in-memory sessions + SSE), which Lambda can't host.
src/mcp.ts (createMcpServer) and shared byboth entry points: src/index.ts (long-running, stateful HTTP/stdio) and src/lambda.ts (stateless, for Lambda).
Mcp-Session-Id header; logs go to stdout (pretty-printed when NODE_ENV=development).
stderr and logs/server.log (view with pnpm logs).
src/mcp.ts via server.registerTool(...).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.