MCP Starter Kit
A production-ready starter to build a secure MCP server for any project
Connect Claude, ChatGPT and any AI agent to your backend with just a URL + API key.
---
## What is this?
**MCP Starter Kit** scaffolds a **secure, online MCP (Model Context Protocol) server**
for **any project**. It's the machine-to-machine bridge between an AI agent
(Claude Desktop/Web, ChatGPT, or your own agent) and your backend API — each *tool*
maps to one endpoint and is authenticated with an **API key + scopes**.
```
AI agent ──MCP (Streamable HTTP / stdio / OAuth)──▶ -mcp ──REST + Bearer key──▶ Your backend
```
The kit is project-agnostic: you provide the project name, backend URL and the list
of tools — the templates already ship with all the security hardening baked in.
## Features
- **Two transports** — Streamable HTTP (online, many clients) + stdio (Claude Desktop).
- **Stateless OAuth 2.0** (PKCE S256) so the ChatGPT app / Claude web (which require OAuth,
with no field to paste an API key) can connect. Header-key auth keeps working in parallel.
- **Security hardening**, ready out of the box:
- Verify the key against the backend **at `initialize`** (blocks pre-auth DoS).
- Session cap + idle-TTL sweep, per-IP rate limit on the initialize path.
- Bind `sha256(key)` to the session; SSRF cross-host block + request timeouts.
- Audit to **stderr** (stdout is reserved for JSON-RPC), secrets redacted.
- Non-root Dockerfile, TLS terminated at the reverse proxy.
- **Read-only by default** — add a write scope explicitly if you ever need one.
## How to use
0. (Optional but recommended) Fill [`feature.md`](feature.md) — your project config + the
list of tools you want. Then tell the agent "scaffold the MCP from feature.md".
1. Or just read / run [`SKILL.md`](SKILL.md) — it asks for the **MCP project name** and
whether your backend **already has an API-key system**.
- **Not yet** → follow [`API-KEY-BACKEND-GUIDE.md`](API-KEY-BACKEND-GUIDE.md) to build it
(hashed keys + scopes + `/ext/me` + a create/edit/revoke admin tab).
- **Already have it** → scaffold the MCP repo from [`templates/`](templates/).
2. In `templates/`: rename `gitignore` → `.gitignore`, replace `__PROJECT__` with your
project name, fill `.env`, and add your tools in `src/server.ts`.
3. `npm install && npm run build` → host behind TLS (path `/mcp`) → connect your client.
## Connect a client
| Client | How |
|---|---|
| **Claude Desktop** | `npx -y mcp-remote https:///mcp --header "Authorization: Bearer "` |
| **Claude web** | Custom connector: URL `/mcp`, header **`x-api-key`** = key |
| **ChatGPT app** | Requires **OAuth** enabled + a Business/Enterprise plan; Auth = OAuth, Streamable HTTP → paste key on the consent page |
| **OpenAI API** | `tools:[{type:"mcp", server_url:".../mcp", headers:{"x-api-key":""}}]` |
## Structure
```
feature.md intake form — fill your project config + tool list, then generate
SKILL.md workflow + confirmation questions
API-KEY-BACKEND-GUIDE.md how to build the backend API-key system (if you don't have one)
templates/ full MCP source (just change the name + tool list)
├── package.json tsconfig.json Dockerfile .env.example gitignore README.md
└── src/ index config apiClient audit server http oauth stdio (.ts)
```
## License
MIT
---
Built by codewebkhongkho.com