Log inSubmit server
MCP Fusion logo

MCP Fusion

by vinkius-labs

Builds TypeScript MCP servers with typed output controls, workflow-based tool gating, governance checks, and multiple transports.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Fusion

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "vinkius-labs-mcp-fusion": {
      "command": "npx",
      "args": [
        "-y",
        "@mcpfusion/core"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @mcpfusion/core

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 29d ago.

Overview

vinkius-labs/mcp-fusion MCP server is a TypeScript framework for building governed MCP servers rather than a standalone domain integration. It provides automatic tool discovery, typed validation, presenters for filtering and redacting output, workflow state gates, and stdio, SSE, HTTP, and stateless transport support. Its governance features create behavioral digests, lockfiles, runtime attestations, and capability scans for review and CI checks. Reach for it when developing MCP servers that need controlled data exposure, auditable behavior, or tools whose availability depends on workflow state.

Use cases

  • Build governed TypeScript MCP servers
  • Redact sensitive fields from tool responses
  • Gate tools by workflow state
  • Audit behavioral changes in CI
  • Run untrusted JavaScript in a restricted isolate

Key features

  • Automatic tool discovery
  • Typed output validation and redaction
  • FSM-based tool visibility
  • MCP 2.0 transport support
  • Behavioral lockfiles and attestations
  • Sandboxed V8 JavaScript execution

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

18/19 checks healthy over the last 78d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · @mcpfusion/core (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars255Stargazers on the source repository.
npm downloads6.3kPackage downloads in the last 30 days.
Last commit1mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity4 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Fusion works

What vinkius-labs/mcp-fusion MCP server does

vinkius-labs/mcp-fusion MCP server is a TypeScript framework for creating MCP servers with security and governance enforced in the server architecture. It is intended for developers building their own MCP tools, not for connecting an agent to a specific SaaS product or data source.

The framework uses typed models and presenters to control what reaches the model. A presenter validates responses against a schema derived from a model, removes undeclared fields, and can redact selected PII paths. It can also add rules, suggestions, and prompt-firewall checks for dynamically generated system content. The documented design applies redaction after UI blocks render, allowing internal rendering logic to use complete data while restricting serialized output.

Workflow-sensitive tools can be associated with finite-state-machine states. When the active state does not permit a tool, the tool is removed from the server's advertised namespace rather than merely rejected after invocation. State can be persisted through an FsmStateStore backed by Redis or another key-value store, and requests receive isolated FSM clones.

How it works

MCP Fusion combines file-based tool routing, model declarations, presenters, and state bindings into a server architecture. Its included SKILL.md describes those patterns for AI coding agents, including Cursor, Claude Code, GitHub Copilot, and Windsurf. The skill is designed to help agents generate servers that follow the framework's required governance structure.

The framework supports MCP 2.0 protocol revision 2026-07-28. Documented protocol features include stateless requests, multi-round-trip input collection, sealed request state using HMAC-SHA256, structured content, output schemas, list caching, pagination, resource templates, subscriptions, header parameters, resource links, and JSON Schema 2020-12. Deprecated MCP features remain available during the stated deprecation window, with migration guidance marked in the API.

Setup and configuration

The repository publishes the @mcpfusion/core npm package and is written for TypeScript 5.7 or newer.

Transport selection is part of server configuration. Supported modes described in the material include stdio, SSE, HTTP, and stateless HTTP-style request handling. Stateless mode serves requests independently, without sessions or an initialize handshake. Serverless deployments can use persistent state storage for workflow gates.

Tools and capabilities

  • Discover tools automatically through the framework's routing and server definitions.
  • Validate and shape output with typed models, Zod-backed presenters, and output schemas.
  • Redact PII with compiled fast-redact rules before serialization.
  • Gate tools with XState v5 or the documented manual fallback.
  • Generate mcpfusion.lock behavioral snapshots and check them with fusion lock --check.
  • Inspect handlers for filesystem, network, subprocess, and evaluation capabilities.
  • Run LLM-provided JavaScript in a sealed V8 isolate with memory and timeout controls.
  • Expose servers through multiple MCP transport modes.

The governance stack includes tool contracts, SHA-256 behavior digests, capability lockfiles, HMAC runtime verification, contract diffs, entitlement scanning, semantic probing, and token-economics profiling.

Limitations and notes

vinkius-labs/mcp-fusion MCP server is a development framework, so it does not provide business-domain tools by itself. Its MCP 2.0 claims refer to protocol support in the framework and the MCP SDK v2; individual applications still need to define their own models, handlers, transports, and state configuration.

The README also identifies several MCP features as deprecated, including roots, sampling, logging notifications, dynamic client registration, HTTP+SSE transport, and certain includeContext values. Applications using those features should follow the framework's stated migration paths.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Fusion

Yes.

Yes.

Yes. Tools bound to FSM states are removed from tools/list when the current state does not permit them.

Related MCP servers

All in Other Tools and Integrations All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Fusion AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/vinkius-labs-mcp-fusion?style=directory)](https://allmcps.com/mcp/vinkius-labs-mcp-fusion)
HTML Embed
<a href="https://allmcps.com/mcp/vinkius-labs-mcp-fusion"><img src="https://allmcps.com/api/badge/vinkius-labs-mcp-fusion?style=directory" alt="MCP Fusion on AllMCPs" /></a>