The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the MCP Server listing page.
A generic, modular server for implementing the Model Context Protocol (MCP). This server provides a framework for controlling and interacting with various models through a standardized API.
A hosted deployment is available on Fronteir AI.
This project uses ES Modules (ESM) exclusively. All imports use the import syntax rather than require().
The server will start on http://localhost:3000 by default.
Copy the sample environment file and edit it with your API keys:
At minimum, you'll need to add API keys for the model providers you want to use:
You can get these API keys from:
The server has no global authentication layer, so anything that can reach the port can call any module route. Modules that touch the filesystem or issue outbound requests are constrained as follows.
Module tokens. Routes with side effects accept a token via
Authorization: Bearer <token> or X-API-Key: <token>. When the variable is
unset the routes stay open and a warning is logged at startup.
| Variable | Guards |
|---|---|
SCANNER_API_TOKEN | /scanner/scan, /scanner/reports/:id/export, /tools/scanner |
README_BADGES_API_TOKEN | /readme-badges/update, /readme-badges/detect, /tools/readme-badges |
Path containment. readme-badges resolves readmePath and rootDir
against README_BADGES_ROOT (default: the working directory) and refuses
anything that escapes it, targets a non-markdown file, or reaches outside via a
symlink. scanner confines exports to its reports directory the same way.
Outbound request allowlists. Modules that fetch caller-named URLs reject loopback, link-local (cloud metadata), RFC1918, CGNAT and other non-public addresses, resolve hostnames and check every returned address, and re-validate each redirect hop. Where a module talks to one known service, the host is also allowlisted:
| Variable | Extends the allowlist for |
|---|---|
CONVERT2DOC_ALLOWED_HOSTS | convert2doc baseUrl (default: convert2doc.com) |
CRAIGSLIST_ALLOWED_HOSTS | /craigslist/details (default: *.craigslist.org) |
Cross-origin requests. CSRF_PROTECTION_ENABLED (default true) rejects
state-changing requests that carry a foreign Origin header, so a malicious web
page cannot drive a browser at a localhost-bound server. Clients that send no
Origin — curl, MCP clients, server-to-server calls — are unaffected. List
trusted browser origins in CORS_ORIGINS.
Run the server behind an authenticating reverse proxy if it is exposed beyond localhost.
The repository includes comprehensive testing using Mocha and Chai:
The testing infrastructure includes:
Tests are organized in a structured way:
/test/core/test/ directoryThis comprehensive testing ensures code quality and makes it easier to detect regressions when making changes.
The repository includes pre-commit hooks using Husky and lint-staged:
The pre-commit hooks:
This ensures that all code committed to the repository follows coding standards and maintains code quality. The test suite is continuously being improved to provide better coverage and reliability, and will be enabled in the pre-commit hook once it's more stable.
The repository includes Docker support for easy containerization and deployment:
The Docker configuration:
The MCP server implements a standardized set of methods that all MCP servers should provide:
GET / - Basic server informationGET /status - Detailed server statusGET /health - Health check endpointGET /metrics - Server metricsGET /models - List available modelsGET /model/:modelId - Get model informationPOST /model/:modelId/activate - Activate a specific modelPOST /model/deactivate - Deactivate the current modelGET /model/active - Get information about the active modelPOST /model/infer - Perform inference with the active modelPOST /model/:modelId/infer - Perform inference with a specific modelThe MCP server supports the following model types:
| Model Type | Provider | Capabilities | Example IDs |
|---|---|---|---|
| GPT Models | OpenAI | Text generation | gpt-4, gpt-3.5-turbo |
| Whisper | OpenAI | Speech-to-text | whisper, whisper-1 |
| Stable Diffusion | Stability AI | Image generation | stable-diffusion-xl-1024-v1-0 |
| Claude Models | Anthropic | Text generation | claude-3-opus, claude-3-sonnet |
| Custom Models | Hugging Face | Various | (any Hugging Face model ID) |
Text generation with GPT-4:
Image generation with Stable Diffusion:
Streaming text generation:
GET /modules - List installed modulesGET /modules/:moduleId - Get module informationGET /modules/search/:query - Search modules by any field in their package.json or metadataGET /tools - List available toolsGET /resources - List available resourcesFor detailed information about these methods, see MCP Standard Methods.
Configuration is loaded from environment variables and stored in src/core/config.js. The easiest way to configure the server is to edit the .env file in the project root.
Key environment variables include:
| Variable | Description | Default |
|---|---|---|
| PORT | Server port | 3000 |
| HOST | Server host | localhost |
| NODE_ENV | Environment (development/production) | development |
| OPENAI_API_KEY | OpenAI API key | (required for OpenAI models) |
| STABILITY_API_KEY | Stability AI API key | (required for Stable Diffusion) |
| ANTHROPIC_API_KEY | Anthropic API key | (required for Claude models) |
| HUGGINGFACE_API_KEY | Hugging Face API key | (required for Hugging Face models) |
See sample.env for a complete list of configuration options.
The repository includes several examples to help you get started:
examples/client.js demonstrates how to interact with the MCP server from a client application.examples/custom-module/ shows how to create a custom module that adds a calculator tool to the server.To run the client example:
To use the custom module example, copy it to the modules directory:
Modules are the primary way to extend the MCP server. Each module is a self-contained package that can add new functionality to the server.
Modules now follow an enhanced structure with better organization:
Each module should include a package.json file with:
This structure provides better separation of concerns, makes testing easier, and improves module discoverability.
The main module file (index.js) must export a register function that will be called when the module is loaded:
mcp_modules/example/ to demonstrate how to create a module.examples/custom-module/.mcp_modules/health-check/ for system monitoring.mcp_modules/template/.You can create a new module using the provided script:
The script will:
mcp_modules/The MCP server includes a powerful search functionality that allows you to find modules based on any information in their package.json or metadata.
GET /modules/search/:query - Search for modules containing the specified query string in any fieldThe search is comprehensive and will find matches in any field, including nested objects like dependencies, keywords, and other metadata.
The MCP server integrates with several AI model providers:
OpenAI provides GPT models for text generation and Whisper for speech-to-text:
Stability AI provides Stable Diffusion for image generation:
Anthropic provides Claude models for text generation:
Hugging Face provides access to thousands of open-source models:
ISC