Skip to main content
Glama
parmindersk

mcp-starter

by parmindersk
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

mcp-starter

Secure, starter MCP server boilerplate with JWT authentication, schema validation, and Docker support.

Built for developers who want to expose AI-compatible APIs to tools like Claude, OpenAI, Sourcegraph Cody, or custom agents using the Model Context Protocol (MCP).

Features

  • JWT-based authentication with tenant isolation

  • Function auto-loading from /functions directory

  • Inline per-function schema validation (via AJV)

  • Dynamic MCP manifest generation (/mcp-manifest.json)

  • Docker container

  • CLI utility to generate JWTs for local testing

  • Health endpoints (/mcp, /healthz)

Related MCP server: MCP Server Templates

Running locally

Clone repo

git clone https://github.com/parmindersk/mcp-starter.git
cd mcp-starter

Run with Docker

docker-compose up

Run from code

pnpm install
pnpm start

Generating a Test Token

node tools/generateToken.js --tenant=acme --secret=supersecure

The --secret value (supersecure) must match the JWT_SECRET defined in your .env or docker-compose.yml.

Testing sample submitFeedback

curl -X POST http://localhost:3000/mcp \
  -H "Authorization: Bearer YOUR_JWT_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "submitFeedback",
    "params": {
      "message": "Love the product!",
      "rating": 5
    }
  }'

You can play around with the body to remove message or give an invalid value for rating to see how validation is working.

Follow SinghSpeak.com for more.

Have feedback or feature ideas? Open an issue or contribute via pull request.

Available Tools

1 tool
hello_toolD

Hello tool

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesThe name of the person to greet

TDQS

D1.8/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Hello tool' reveals nothing about whether this is a read/write operation, what permissions might be required, what side effects occur, or what the response format looks like. The description fails to provide any behavioral context beyond the minimal implication from the name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

While technically concise with only two words, this represents under-specification rather than effective conciseness. The description doesn't contain enough information to be useful, and the single phrase doesn't earn its place by providing meaningful guidance to an AI agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there are no annotations and no output schema, the description should provide more complete context about what this tool does and what to expect. A single-parameter tool with 100% schema coverage could get by with minimal description, but 'Hello tool' fails to explain the basic purpose and behavior adequately for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents the single 'name' parameter. The description adds no additional parameter information beyond what's in the schema. According to scoring rules, when schema coverage is high (>80%), the baseline is 3 even with no parameter information in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Hello tool' is essentially a tautology that restates the tool name without specifying what it does. It doesn't provide a clear verb+resource combination or explain the actual function. While the name suggests greeting functionality, the description fails to articulate this explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides absolutely no guidance about when to use this tool, what context it's appropriate for, or any prerequisites. There are no sibling tools mentioned, but even basic usage context is completely missing from the description text.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • First observedhello_tool
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

C2.2/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of confusion or overlap between tools. The tool's purpose is clearly distinct by default.

Naming Consistency5/5

The single tool name 'hello_tool' follows a consistent verb_noun pattern (hello + tool). With only one tool, consistency is inherently perfect.

Tool Count2/5

A single tool is too few for most practical server purposes, as it severely limits functionality and scope. This feels thin and inadequate for typical MCP server use cases.

Completeness1/5

With only a 'hello_tool', the server lacks any meaningful domain coverage. It is severely incomplete, offering no operations for a coherent workflow or domain.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • granola-mcp

    NickyHeC
    A
    license
    Not graded
    quality
    F
    maintenance
    A starter template for building MCP servers with support for No Auth, API Key, and OAuth authentication using the Dedalus Labs DAuth framework.
    MIT

  • MCP Server Templates

    VISystems
    A
    license
    Not graded
    quality
    D
    maintenance
    Provides production-grade starter templates for MCP servers with permission boundaries, integration tests, and eval contracts, enabling rapid development of secure and testable MCP servers.
    Apache 2.0

  • mcp-server-toolkit

    sarmakska
    A
    license
    Not graded
    quality
    D
    maintenance
    Production-ready MCP server starter with authentication, observability, and a plugin system for building and deploying MCP servers quickly.
    MIT

  • cybersecurity-mcp-server

    Krishsakaria26
    A
    license
    Not graded
    quality
    C
    maintenance
    A security-first MCP (Model Context Protocol) backend built with Node.js and Express, featuring hardening, rate limiting, structured logging, and Docker support.
    MIT