Official

Typescript SDK MCP Server

Build MCP servers and clients using TypeScript for Node.js, Bun, and Deno.

Data last scanned today · Reviewed today

71★ 13,076TypeScriptNOASSERTION

Overview

This SDK provides the essential TypeScript packages, @modelcontextprotocol/server and @modelcontextprotocol/client, to implement the Model Context Protocol. It abstracts the complexities of context provision by offering standardized tools, resources, and prompt handling for AI applications. The library supports multiple runtimes including Node.js, Bun, and Deno. Developers can leverage built-in middleware for frameworks like Express, Fastify, and Hono, while also utilizing modular transports and authentication helpers.

Our verdict

The TypeScript SDK maintains a high risk level with a security score of 53/100. This assessment is primarily driven by its community-maintained status and the lack of an independent editorial review of its implementation. While the project is highly active with 13,076 GitHub stars and zero direct dependencies, potential adopters should proceed with caution regarding the undefined license state (NOASSERTION) and unverified OAuth and read-only mode security properties.

Zero direct dependencies reduce the supply-chain attack surface.
Active development with commits occurring daily.
Broad compatibility across Node.js, Bun, and Deno runtimes.
Comprehensive v2 documentation and ten-minute tutorials.

Community-maintained status lacks formal vendor verification.
License status is currently marked as NOASSERTION.
Crucial security areas like OAuth support remain unreviewed.
Read-only mode implementations have not been audited.

Setup

Claude Desktop

{
  "mcpServers": {
    "typescript-sdk": {
      "args": [
        "-y",
        "@modelcontextprotocol/sdk"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.