Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@apikey-mcp-server find customer by email john@doe.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A fully-featured Model Context Protocol (MCP) server with API-key authentication, demonstrating realistic e-commerce tools, resources, and prompts. Built on the official @modelcontextprotocol/sdk.
npm install
npm run build
# Start with a custom key:
API_KEY=my-secret-key npm start
# Or start without setting API_KEY — uses default key "mcp-api-key-default":
npm startRelated MCP server: mcp-server-demo
This server requires an API key passed via the x-api-key custom header for HTTP transport access. This is the industry-standard header used by Stripe, SendGrid, GitHub REST API, and many others.
If API_KEY env var is set: use that value as the key.
If API_KEY env var is unset: a default key mcp-api-key-default is used, so the server is never wide open.
stdio transport: No authentication required — stdio is launched as a local subprocess on a trusted machine.
The /health endpoint is not authenticated so load balancers and monitoring tools can probe it.
# Start the server
API_KEY=my-secret-key npm start
# Health check (no auth required)
curl http://localhost:3000/health
# Initialize an MCP session
curl -X POST http://localhost:3000/mcp \
-H "Content-Type: application/json" \
-H "x-api-key: my-secret-key" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2026-07-28","capabilities":{},"clientInfo":{"name":"test","version":"1.0.0"}}}'npm run start:stdio
# Or: npx @modelcontextprotocol/inspector node dist/stdio.jsTransport: Streamable HTTP
URL: http://localhost:3000/mcp
Custom Header: x-api-key = your-key-here
Variable | Default | Description |
|
| API key for HTTP auth. Always falls back to this default if unset. |
|
| HTTP server port |
|
| Bind address (auto-switches to |
|
| Environment name |
|
| Max chars of request/response body to log |
Tool | Description |
| Search 25 customer records by name, email, or ID |
| Fetch full order details with line items, pricing, and tracking |
| Browse 30 products across 5 categories with text search and category filters |
| Estimate shipping cost by product weight and destination zone |
| Generate business reports: sales, customers, orders, inventory, or summary |
| Validate and standardize postal addresses with confidence scoring |
| Connectivity and health check with uptime info |
URI | Description |
| Server configuration and feature flags (JSON) |
| Full product catalog — 30 products (JSON) |
| API documentation listing all capabilities (Markdown) |
| Individual customer record with order history (JSON) |
| Individual order record with line items and tracking (JSON) |
Prompt | Description |
| Generate a customer summary for support staff |
| Draft an order status email to a customer |
| Generate personalized product recommendations |
| Analyze business metrics and surface actionable insights |
All data is in-memory (no external database required):
25 customers across 4 tiers (bronze / silver / gold / platinum)
30 products across 5 categories (Electronics, Apparel, Home, Books, Sports)
30 orders across 5 statuses (pending, confirmed, shipped, delivered, cancelled)
4 shipping zones with weight-tiered rate tables
Spec | Transport | Status |
Streamable HTTP | ✅ Primary | |
HTTP + SSE | ✅ Compatible |
Add to claude_desktop_config.json:
{
"mcpServers": {
"apikey-mcp-server": {
"command": "node",
"args": ["C:\\Users\\...\\apikey-mcp-server\\dist\\stdio.js"]
}
}
}docker build -t apikey-mcp-server .
docker run -p 8080:8080 -e API_KEY=my-secret-key apikey-mcp-serverScript | Description |
| Compile TypeScript to |
| Start HTTP server |
| Start stdio server |
| Watch mode (TypeScript compilation only) |
| Hot-reload HTTP server with tsx |
| Hot-reload stdio server with tsx |
| Launch MCP Inspector (stdio) |
| Build + run smoke test |
| Remove |
src/
├── server.ts # MCP server factory (createServer)
├── http.ts # Streamable HTTP transport + auth middleware
├── stdio.ts # Stdio transport entry point
├── auth.ts # API key validation (x-api-key header)
├── config.ts # Typed configuration loader (env vars)
├── data.ts # Mock data store (customers, products, orders, shipping)
├── tools.ts # 7 e-commerce tools
├── resources.ts # 5 resources (static + templated)
├── prompts.ts # 4 prompts
├── banner.ts # ANSI startup banner
└── logging.ts # Structured JSON logging with redaction
scripts/
└── smoke.mjs # stdio smoke testMIT
Estimate shipping cost for a product based on weight and destination zone.
| Name | Required | Description | Default |
|---|---|---|---|
| zone | Yes | The shipping destination zone | |
| quantity | No | Number of units (affects total weight) | |
| product_id | Yes | The product ID to estimate shipping for (e.g. 'P003') |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of disclosing behavior. It only says 'estimate shipping cost' without revealing side effects, return format, error conditions, or any operational details. This is a minimal behavioral disclosure for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clean sentence that states the tool's function without unnecessary words. It is front-loaded with the action ('Estimate') and object ('shipping cost') and includes the key inputs. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, and the description does not specify what the tool returns (e.g., a numeric cost, currency, breakdown). While the tool is relatively simple, the lack of return value details and behavioral nuances leaves the context only partially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers all parameters with descriptions, so the schema provides the primary semantics. The description adds context about weight (which is derived from product and quantity) but does not explain any parameter syntax or relationships beyond what the schema already provides. Baseline 3 is appropriate given 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: estimating shipping cost for a product. It identifies the key inputs (weight and destination zone), which distinguishes it from sibling tools like get_order or validate_address. However, 'weight' is not a direct schema parameter, so the purpose is slightly imprecise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when estimating shipping), but it does not explicitly state usage contexts, prerequisites, or alternatives. No exclusions or comparisons to sibling tools are provided, making usage guidance somewhat implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a summary report with key business metrics: customer stats, order volumes, revenue, and product inventory.
| Name | Required | Description | Default |
|---|---|---|---|
| period | No | Time period to cover (filtered in-memory by date) | all |
| report_type | Yes | The type of report to generate |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden of behavioral disclosure. It does not mention side effects, read-only behavior, performance implications, data freshness, or return format. 'Generate' gives no insight into whether the tool performs expensive computations or varies in behavior by report_type.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded and gets straight to the point. No filler words or repetition of schema details. It earns its place by summarizing the tool's purpose and the key metrics covered.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has two parameters, no output schema, and no annotations, yet the description omits the period parameter, misleads by implying only a summary report, and does not explain the return structure or available report types. For an AI agent selecting and invoking the tool, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds high-level context about report content (customer stats, order volumes, etc.) that maps to some report_type values, but it does not explain the period parameter or how report_type selects different outputs. The added value is marginal given the schema already enumerates and describes both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function: generating a summary report with key business metrics (customer stats, order volumes, revenue, product inventory). It uses a specific verb-resource pair and the listed metrics align well with report_type enums. Slight ambiguity: 'summary report' implies only the summary type, though the schema supports sales, customers, orders, inventory, and summary reports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or alternative guidance is given, but the sibling tools (get_order, list_products, search_customers) suggest this tool is for aggregate reporting rather than individual record lookups. This provides only implied usage context, not clear exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch full order details by order ID, including line items, pricing, status, and tracking information.
| Name | Required | Description | Default |
|---|---|---|---|
| order_id | Yes | The order ID (e.g. 'ORD-1001') |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the burden. The verb 'Fetch' implies a read-only operation, and the description specifies the return content. However, it does not disclose error behavior, authorization requirements, or any side effects, which is a moderate gap given no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that leads with the action and object, then elaborates with specific included details. Every word contributes value; there is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, the description adequately explains the return contents. It omits error conditions or pagination, but these are not critical for the tool's complexity and are not expected given the sibling set.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes order_id with an example format ('ORD-1001'). The description adds no additional parameter-specific detail. With 100% schema coverage, the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Fetch'), the resource ('full order details'), and the identifier ('by order ID'). It enumerates the content (line items, pricing, status, tracking), which distinguishes it from sibling tools like list_products or calculate_shipping.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: fetch order details when you have an order ID. Does not explicitly exclude alternatives or mention when not to use it, but the sibling tools are topically distinct, so the usage intent is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Browse the product catalog with optional category and text filters.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (1-50) | |
| query | No | Optional search text — matches product name, SKU, or description | |
| category | No | Product category to filter by. Available: Electronics, Apparel, Home, Books, Sports. Omit for all categories. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations provided, so the description carries the burden of conveying behavioral traits. 'Browse' implies a read-only operation, and the optional filters are mentioned. However, it doesn't disclose details such as pagination behavior, return format, or that results are a list of products. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, succinct sentence that front-loads the action and resource, with the filter options immediately following. Every word earns its place, with no redundancy or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity of this tool, the lack of output schema, and the full parameter documentation in the schema, the description is nearly complete. It could explicitly state that the tool returns a list of products, but 'browse the product catalog' strongly implies a list result. The limits and filter details are already in the schema, so the description suffices for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions cover 100% of the parameters, so the baseline is 3. The description adds a high-level mention of 'category and text filters' that maps to category and query parameters, but it does not add detail beyond what the schema already provides, such as the exact match fields for query.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Browse' with a clear resource ('the product catalog') and mentions optional category and text filters, which precisely conveys the tool's function. It is clearly distinct from sibling tools like get_order and search_customers, which target different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool ('Browse the product catalog') and indicates filtering options, making it obvious this is the tool for catalog exploration. While it doesn't explicitly exclude any scenarios or name alternatives, the siblings are unrelated, so no exclusion is necessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lightweight connectivity and health check. Returns server status, uptime, and version information.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It states the tool returns server status, uptime, and version information, and describes itself as lightweight, which effectively conveys its read-only, non-destructive nature and expected output. It does not detail error handling, but for a ping-style tool this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the primary purpose, and includes only necessary details. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of a zero-parameter health check and no output schema, the description fully covers what the tool does and returns. It identifies the output (status, uptime, version) and purpose, making it complete for its intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool accepts zero parameters, so the baseline is 4. The description adds no parameter-specific information, but none is needed given the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a connectivity and health check with a specific verb ('check') and resource (server), and the return values (status, uptime, version) distinguish it from business-oriented sibling tools like list_products or generate_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for verifying server health and connectivity ('connectivity and health check'), which provides clear context. Since none of the sibling tools serve this function, no explicit exclusions are necessary. However, it does not explicitly state when to prefer this over alternatives, which keeps it at a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search the customer directory by name, email, or customer ID. Returns matching customer profiles with tier, lifetime value, and order counts.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return (1-50) | |
| query | Yes | Search text — matches against name, email, or customer ID (e.g. 'Alice', 'C001', 'gold') |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosure. It reveals that the tool returns profiles with tier, lifetime value, and order counts, which is useful, but it does not explain search behavior (e.g., partial vs exact matching, case sensitivity, or empty result handling). This leaves some ambiguity about how the query is interpreted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loads the core action and resource, and includes the key return fields. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with two well-documented parameters and no output schema, the description provides adequate context: it states what it searches, what it returns, and the key return fields. It lacks deeper behavioral details like pagination or matching rules, but the schema covers the limit parameter, and the description is sufficient for typical use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already fully documents both parameters with descriptions and constraints. The tool description adds no new parameter meaning beyond what the schema states; it simply reiterates that search matches name, email, or customer ID. Baseline 3 is appropriate because the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Search') and a clear resource ('customer directory'), and further specifies the search keys (name, email, customer ID). It distinguishes itself from sibling tools like get_order and list_products by focusing on customer lookup and listing the returned profile data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states the tool's purpose ('Search the customer directory'), which implies when to use it: whenever you need to find customers by identifiers. It does not explicitly discuss alternatives or exclusions, but given the sibling list, this is a focused customer search tool with no obvious overlap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Validate and standardize a postal address. Returns a normalized version with a verification confidence score and any corrections.
| Name | Required | Description | Default |
|---|---|---|---|
| zip | Yes | ZIP or postal code | |
| city | Yes | City name | |
| state | Yes | State or province code (e.g. 'CA', 'NY') | |
| street | Yes | Street address (e.g. '123 Main St') | |
| country | No | ISO 3166-1 alpha-2 country code (default: US) | US |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It does say the tool returns a normalized version with a confidence score and corrections, which is useful. However, it does not disclose behavior on invalid input, edge cases, country-specific handling, or limitations, leaving significant behavioral traits undocumented.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action and immediately followed by return value details. Every word earns its place, with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 5-parameter tool with no output schema, the description does a good job covering the return value in prose. It explains what the tool produces (normalized address, confidence score, corrections) without needing an output schema. However, it stops short of mentioning potential failure modes or international address handling, which would make it more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds no additional parameter-level meaning beyond what the schema provides. Baseline 3 is appropriate because the schema does the heavy lifting and the description does not compensate or add detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool validates and standardizes a postal address, using a specific verb and resource that distinguishes it from sibling tools like get_order or calculate_shipping. It explicitly mentions returning a normalized version with confidence score and corrections, fully clarifying its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention preconditions (e.g., use before shipping), exclusions, or related tools that might be more appropriate in certain contexts. This is essentially a bare functional description with no usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0calculate_shippinggenerate_reportget_orderlist_productspingsearch_customersvalidate_addressScored across 7 tools
Each tool targets a distinct resource or action: orders, products, shipping, reports, addresses, health, and customers. There is no overlap or ambiguity between the tools.
Most tools follow a verb_noun pattern (get_order, list_products, calculate_shipping, generate_report, validate_address, search_customers), but 'ping' breaks the pattern by being a bare verb without a noun.
With 7 tools, the set is well-scoped for a data-oriented commerce server. Each tool serves a clear purpose without unnecessary bloat, and the count is within the ideal range.
The set covers read-only operations like fetching orders, listing products, and searching customers, but lacks basic lifecycle operations such as creating, updating, or deleting resources. Also missing is a list_orders or get_product endpoint, leaving notable gaps in the domain surface.
Hosted MCP for e-commerce: live product catalog, stock, and pricing for AI agents.
Hosted MCP server for live public-data APIs and Skills for AI agents.
Hosted Amazon Seller and Vendor MCP server for Claude, ChatGPT, Cursor, Codex, Gemini, Copilot.
MCP server for building and testing AI agents with multi-model experimentation and insights.
