Bun Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bun Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A white-label HTTP-based Model Context Protocol (MCP) server built with Bun.
This project began as a personal learning exercise to better understand how MCP servers work by building one from the ground up. As such, it currently implements a meaningful subset of the MCP specification, with compliance support being added over time as the project evolves.
You can read the full MCP specification here.
mcp.config.js file.tools/ directory are loaded and registered automatically at startup — no manual wiring required./mcp), supporting POST, GET, DELETE, and OPTIONS.-32700, -32600, -32601, -32602, -32603).mcp-session-id on initialize, tracks sessions in memory, and automatically expires them after 5 minutes of inactivity.mcp-protocol-version header on every non-initialization request.Origin header and exposes mcp-session-id and mcp-protocol-version to browser clients.bun installbun run devThe server starts on http://localhost:3000 with file-watching enabled for live reload during development.
Clone the repo, edit the config, add your tools. Follow the steps below to get started.
Open mcp.config.js and update the following values:
export const config = {
name: "my-mcp-server", // Machine-readable identifier (used in client configs)
title: "My MCP Server", // Human-readable display name
description: "Does something useful.",
version: "1.0.0",
protocolVersion: "2025-11-25", // MCP spec version this server targets
categories: ["demo"], // Descriptive tags for discoverability
}These values flow into two places automatically:
GET /.well-known/mcp — used for server discoveryDrop .js files into the tools/ directory. The server loads them automatically at startup — no registration needed. See Tools for the file format.
Once running, your server self-describes via the /.well-known/mcp endpoint — the MCP Server Card. This gives clients a machine-readable way to discover your server's identity, transport type, and endpoint URL without any manual configuration.
curl http://localhost:3000/.well-known/mcp{
"name": "my-mcp-server",
"title": "My MCP Server",
"description": "Does something useful.",
"version": "1.0.0",
"url": "http://localhost:3000/mcp",
"transport": "http",
"categories": ["demo"]
}[!Note] The/.well-known/mcpServer Card is not yet part of the official MCP specification, but it fills a gap: there is currently no standardized way for HTTP-based MCP servers to announce themselves. This endpoint follows the established/.well-known/convention for service discovery on the web.
| Tool | Description | Parameters |
|---|---|---|
get_weather | Get the current weather for a given city | city (string, required) |
The get_weather tool returns simulated data (random temperature, "Cloudy" condition) — it is included as a demo tool for testing the MCP lifecycle.Drop a new .js file into the tools/ directory. The server picks it up automatically at startup.
Each tool file must export two things:
`metadata` — the tool's schema (name, description, input shape):
export const metadata = {
name: "my_tool",
title: "My Tool",
description: "Does something useful.",
parameters: {
type: "object",
properties: {
input: { type: "string", description: "Some input value" }
},
required: ["input"]
}
}`handler` — an async function that receives the tool's arguments:
export async function handler({ input }) {
// Your tool logic here
return { result: `Processed: ${input}` }
}The tool is automatically available via tools/list and executable via tools/call — no additional wiring needed.
See tools/get_weather.js for a working example.
bun-mcp-server/
├── src/
│ ├── index.js # Entry point — starts the Bun HTTP server and runs session cleanup
│ ├── lib/
│ │ ├── sessions.js # In-memory session store (Map)
│ │ └── utils.js # Shared utilities (timestamps, CORS headers, logging, IP parsing)
│ ├── mcp/
│ │ ├── index.js # Core MCP request handler (JSON-RPC dispatch)
│ │ └── tools.js # Auto-loads tools from the tools/ directory
│ └── routes/
│ └── index.js # HTTP route definitions (/mcp, /.well-known/mcp, catch-all)
├── tools/ # Drop tool files here — they are picked up automatically
│ └── get_weather.js # Example tool (simulated weather data)
├── mcp.config.js # Server identity and capabilities config
├── package.json
└── jsconfig.jsonPOST /mcpThe main MCP endpoint. Accepts JSON-RPC 2.0 requests and dispatches them to the appropriate handler.
For all methods except initialize and notifications, the request must include:
mcp-session-id header — a valid session ID issued during initializemcp-protocol-version header — must match the server's configured protocol versionSupported methods:
| Method | Description |
|---|---|
initialize | Handshake — returns server info, protocol version, and capabilities. Issues mcp-session-id in the response header. |
ping | No-op keep-alive — returns an empty result {} |
tools/list | Returns the list of available tools with their schemas |
tools/call | Executes a registered tool by name with the given arguments |
notifications/initialized | Acknowledges client initialization (returns 202) |
notifications/roots/list_changed | Acknowledges root change notifications (returns 202) |
GET /mcpSession probe. Requires a valid mcp-session-id header. Returns 200 if the session exists, 404 if not. Returns 406 if the client requests text/event-stream (SSE is not currently supported).
DELETE /mcpSession termination. Requires a valid mcp-session-id header. Removes the session and returns 204.
OPTIONS /mcpCORS preflight. Returns 204 with appropriate Access-Control-* headers.
GET /.well-known/mcpSee Step 3 — Announce your server above.
* /*Catch-all route that returns a 404 Not Found JSON response for any unmatched path.
On success, the server returns an mcp-session-id header. Save it — all subsequent requests must include it.
curl -D - -X POST http://localhost:3000/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-11-25",
"capabilities": {},
"clientInfo": { "name": "test-client", "version": "1.0.0" }
}
}'curl -X POST http://localhost:3000/mcp \
-H "Content-Type: application/json" \
-H "mcp-session-id: <your-session-id>" \
-H "mcp-protocol-version: 2025-11-25" \
-d '{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/list"
}'curl -X POST http://localhost:3000/mcp \
-H "Content-Type: application/json" \
-H "mcp-session-id: <your-session-id>" \
-H "mcp-protocol-version: 2025-11-25" \
-d '{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "get_weather",
"arguments": { "city": "Tokyo" }
}
}'curl -X DELETE http://localhost:3000/mcp \
-H "mcp-session-id: <your-session-id>"You can verify that the server is functioning correctly by connecting it to an MCP client, such as VS Code or AntiGravity.
[!Note] Ensure your MCP server is already running locally before connecting. Upon success, you will see connection activity in your server's console logs.
.vscode/mcp.json in your project directory.{
"servers": {
"my-mcp-server": {
"url": "http://localhost:3000/mcp"
}
}
}my-mcp-server listed under Workspace.my-mcp-server and select Start Server from the context menu to initialize the connection....) and select MCP Servers.mcp_config.json file.{
"mcpServers": {
"my-mcp-server": {
"serverUrl": "http://localhost:3000/mcp"
}
}
}Once connected, confirm that tool discovery and execution are working by sending a prompt through your IDE's chat interface:
"Let's test the MCP server. Get the weather for Tokyo today."
If successful, the chat should trigger the tool and return the relevant data from your server.
The server returns standard JSON-RPC 2.0 error responses:
| Code | Meaning |
|---|---|
-32700 | Parse error — malformed JSON body |
-32600 | Invalid Request — missing jsonrpc or method, or bad protocol version |
-32601 | Method not found — unsupported MCP method |
-32602 | Invalid params — missing or malformed tool parameters |
-32603 | Internal error — unexpected server-side failure |
The MCP specification defines Streamable HTTP as one of the supported transport mechanisms for MCP servers. It replaces the HTTP+SSE transport used in earlier versions of the protocol.
I haven't implemented Streamable HTTP in this project yet, as I'm still learning how it works. Support for it will be added in the future, hopefully.
The idea is to introduce an MCP Server Card, similar to the Web App Manifest for web applications. A Server Card would provide standardized metadata that serves as the foundation for searchable directories of MCP servers, making it easy for users to discover and add servers to their MCP clients or IDEs. That’s the dream, at least.
MIT © supershaneski
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.