MCP Fusion

What vinkius-labs/mcp-fusion MCP server does

vinkius-labs/mcp-fusion MCP server is a TypeScript framework for creating MCP servers with security and governance enforced in the server architecture. It is intended for developers building their own MCP tools, not for connecting an agent to a specific SaaS product or data source.

The framework uses typed models and presenters to control what reaches the model. A presenter validates responses against a schema derived from a model, removes undeclared fields, and can redact selected PII paths. It can also add rules, suggestions, and prompt-firewall checks for dynamically generated system content. The documented design applies redaction after UI blocks render, allowing internal rendering logic to use complete data while restricting serialized output.

Workflow-sensitive tools can be associated with finite-state-machine states. When the active state does not permit a tool, the tool is removed from the server's advertised namespace rather than merely rejected after invocation. State can be persisted through an FsmStateStore backed by Redis or another key-value store, and requests receive isolated FSM clones.

How it works

MCP Fusion combines file-based tool routing, model declarations, presenters, and state bindings into a server architecture. Its included SKILL.md describes those patterns for AI coding agents, including Cursor, Claude Code, GitHub Copilot, and Windsurf. The skill is designed to help agents generate servers that follow the framework's required governance structure.

The framework supports MCP 2.0 protocol revision 2026-07-28. Documented protocol features include stateless requests, multi-round-trip input collection, sealed request state using HMAC-SHA256, structured content, output schemas, list caching, pagination, resource templates, subscriptions, header parameters, resource links, and JSON Schema 2020-12. Deprecated MCP features remain available during the stated deprecation window, with migration guidance marked in the API.

Setup and configuration

The repository publishes the @mcpfusion/core npm package and is written for TypeScript 5.7 or newer. The provided material does not include a complete installation command or a minimal runnable project, so setup details should be taken from the repository's current documentation.

Transport selection is part of server configuration. Supported modes described in the material include stdio, SSE, HTTP, and stateless HTTP-style request handling. Stateless mode serves requests independently, without sessions or an initialize handshake. Serverless deployments can use persistent state storage for workflow gates.

Tools and capabilities

• Discover tools automatically through the framework's routing and server definitions.
• Validate and shape output with typed models, Zod-backed presenters, and output schemas.
• Redact PII with compiled fast-redact rules before serialization.
• Gate tools with XState v5 or the documented manual fallback.
• Generate mcpfusion.lock behavioral snapshots and check them with fusion lock --check.
• Inspect handlers for filesystem, network, subprocess, and evaluation capabilities.
• Run LLM-provided JavaScript in a sealed V8 isolate with memory and timeout controls.
• Expose servers through multiple MCP transport modes.

The governance stack includes tool contracts, SHA-256 behavior digests, capability lockfiles, HMAC runtime verification, contract diffs, entitlement scanning, semantic probing, and token-economics profiling.

Limitations and notes

vinkius-labs/mcp-fusion MCP server is a development framework, so it does not provide business-domain tools by itself. The excerpt does not document a ready-to-run server package, required environment variables, or a complete client configuration. Its MCP 2.0 claims refer to protocol support in the framework and the MCP SDK v2; individual applications still need to define their own models, handlers, transports, and state configuration.

The README also identifies several MCP features as deprecated, including roots, sampling, logging notifications, dynamic client registration, HTTP+SSE transport, and certain includeContext values. Applications using those features should follow the framework's stated migration paths.