Watch

History

Repository files (latest commit first)
Filename	Latest commit message	Latest commit date
Sam Morrow 6032170087 Some checks failed Conformance Tests / client-conformance (push) Has been cancelled Details Conformance Tests / server-conformance (push) Has been cancelled Details Deploy Docs / deploy-docs (push) Has been cancelled Details Examples / examples (build + e2e) (push) Has been cancelled Details / build (push) Has been cancelled Details / test (20) (push) Has been cancelled Details / test (22) (push) Has been cancelled Details / test (24) (push) Has been cancelled Details / test-e2e (20) (push) Has been cancelled Details / test-e2e (22) (push) Has been cancelled Details / test-e2e (24) (push) Has been cancelled Details / test-runtimes (bun, 1.x) (push) Has been cancelled Details / test-runtimes (deno, v2.x) (push) Has been cancelled Details Publish Any Commit / pkg-publish (push) Has been cancelled Details Release / Version (push) Has been cancelled Details Release / Publish (push) Has been cancelled Details feat(server): add request-time OAuth scope challenges (#1624 ) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>		2026-09-16 16:51:56 +00:00
..
express	fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length (#2698 )	2026-08-25 14:23:40 +01:00
fastify	Version Packages (#2555 )	2026-07-28 00:52:57 +01:00
hono	fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length (#2698 )	2026-08-25 14:23:40 +01:00
node	feat(server): add request-time OAuth scope challenges (#1624 )	2026-09-16 16:51:56 +00:00
README.md	docs: comprehensive GA pass — stable-release wording, released-spec links, install tags (#2566 )	2026-07-27 23:32:17 +01:00

README.md

Middleware packages

The packages in packages/middleware/* are thin integration layers that help you expose an MCP server in a specific runtime, platform, or web framework.

They intentionally do not add new MCP features or “business logic”. MCP functionality (tools, resources, prompts, transports, auth primitives, etc.) lives in @modelcontextprotocol/server (and other core packages). Middleware packages should primarily:

adapt request/response types to the SDK (e.g. Node.js IncomingMessage/ServerResponse)
provide small framework helpers (e.g. wiring, body parsing hooks)
supply safe defaults for common deployment pitfalls (e.g. localhost DNS rebinding protection)

Packages

@modelcontextprotocol/express — Express helpers (app defaults + Host header validation for DNS rebinding protection).
@modelcontextprotocol/fastify — Fastify helpers (app defaults + Host header validation).
@modelcontextprotocol/hono — Hono helpers (app defaults + JSON body parsing hook + Host header validation).
@modelcontextprotocol/node — Node.js Streamable HTTP transport wrapper for IncomingMessage/ServerResponse.

Typical usage

Most servers use:

@modelcontextprotocol/server for the MCP server implementation
one middleware package for framework/runtime integration (this folder)
(optionally) additional platform/framework dependencies (Express, Hono, etc.)