How to build an MCP server

MCP (Model Context Protocol) is a standard way to give an AI app access to tools: "look up this order", "create a ticket", "search these docs". You build a server that lists the tools, and any AI app that speaks MCP can use them. One server, lots of apps

The three pieces

• Tools: functions the AI can call, each with a name, a description and typed inputs
• Transport: how the app talks to your server. stdio for local, HTTP for a server on the internet
• Client: the AI app. You point it at your server and it shows your tools

A working server

You need Node.js. Make a folder, then:

npm init -y
npm install @modelcontextprotocol/sdk zod

Save this as server.mjs:

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
import { z } from "zod"

const server = new McpServer({ name: "orders", version: "1.0.0" })

server.tool(
  "get_order_status",
  "Look up the status of an order by its ID",
  { orderId: z.string() },
  async ({ orderId }) => ({
    content: [{ type: "text", text: `Order ${orderId} shipped yesterday` }],
  })
)

await server.connect(new StdioServerTransport())

Swap the fake answer for a real database or API call and that's an MCP server

Connect it

Most desktop AI apps and code editors read an mcpServers config. Add yours:

{
  "mcpServers": {
    "orders": { "command": "node", "args": ["/full/path/to/server.mjs"] }
  }
}

Restart the app, ask "what's the status of order 123?", and it calls your tool

Write tools for the model, not for you

• The description is the docs. The model picks tools by reading it, so say exactly what it does and when to use it
• Small, specific tools beat one giant "do anything" tool
• Return short, plain text. Nobody needs 4,000 lines of JSON, least of all the model

Going online

A local server only runs on your machine. To share it, switch to the HTTP transport and put it behind a URL. Then it needs real auth: hosted AI apps expect OAuth with PKCE, and they'll look for discovery docs at /.well-known/oauth-authorization-server

Before anyone else uses it

• Start read-only. Add write tools one at a time, on purpose
• Act as the user, with their login, not a shared admin account
• Log every call: who, which tool, when
• Rate limit it. Models are very happy to call a tool 200 times