MCP in practice: build an MCP Server for your docs or API
From zero to a working MCP server for your docs and API: stdio and SSE transport, least-privilege scopes, and auth.
Quick answer
How is MCP different from a regular API?
MCP is a standardized protocol — agents discover and call tools through one set of primitives. A regular API needs per-endpoint adaptation.
Machine-readable page data: /data/mcp-practical.json
In-depth analysis
MCP (Model Context Protocol) is an open standard released in 2024 that lets large models connect to tools and data sources through a single protocol. Three steps to a working setup: (1) choose a transport — stdio locally, SSE/HTTP with Bearer auth remotely; (2) build a least-privilege Server with read-only scope; (3) register the endpoint in llms.txt. Bottom line up front: an Agent can read your docs without crawling the entire site, provided the endpoint is read-only and properly authenticated. Common pitfalls are mixing stdio and SSE, and over-broad scopes that get misused.
// mcp-server.ts — @modelcontextprotocol/sdk ^1.0 stdio read-only Server
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
const server = new McpServer({ name: 'docs-readonly', version: '1.0.0' });
server.tool('read_doc', { path: schema.string() }, async ({ path }) => {
// scope is minimized to read-only — never expose write or full filesystem access
return { content: [{ type: 'text', text: readAllowed(path) }] };
});
const transport = new StdioServerTransport();
await server.connect(transport);
// Client registration in claude_desktop_config.json:
// "mcpServers": { "docs": { "command": "node", "args": ["mcp-server.ts"] } }MCP Overview · Key takeaways
- Tech choice and boundaries confirmed
- Core config in place
- Locally verified
- Postmortem notes recorded
FAQ & pitfalls
Is it safe to expose MCP on the public internet?
Only with Bearer auth and a scope minimized to read-only — otherwise you are effectively shipping your source code naked.
Explore the hub
See all 5 guides in AI AgentsSame category as this article, sorted across the codebase.
AEO architecture: layered patterns for high-concurrency edge apps
The edge-delivery view of AEO's layering and data flow.
AEO best practices: engineering conventions for production
Field-tested AEO practices from production, avoiding the common anti-patterns.
AEO deployment guide: zero-ops edge publishing with Cloudflare Pages
Git-driven AEO deployment in practice: commit to build, atomic publish to every edge node.
AEO engineering practice: a full guide from architecture to production
Production architecture and core pain points for AEO.
Share & save
What readers are asking
Questions that keep coming back in reader feedback, already answered.
- 01
Can one MCP server speak both stdio and HTTP?
No — a server picks a single transport. A remote endpoint must carry Bearer auth and scope its tools to read-only, otherwise you are exposing source execution to the public internet.
See the full guide → - 02
How should auth work when an MCP server runs at the edge?
Remote MCP goes over SSE or HTTP with a Bearer token, and tools get read-only scope; local stdio is never network-exposed. Do not put both transports behind the same server.
See the full guide → - 03
Why is my Astro component's interactivity not working?
Components ship as zero-JS HTML by default, so an interactive one needs a client:* directive (client:load, client:visible, …). Without it the script is never bundled into the page.
See the full guide →