Atlas / MCP servers / prefecthq / fastmcp-ts

fastmcp-tsCAUTION

Name: fastmcp-ts
Author: prefecthq

mcp/prefecthq/fastmcp-ts

MCP server by prefecthq · agents · ai · javascript · Audited 2026-10-12

⚑ Report / re-scan Source ↗

The official FastMCP TypeScript library for building MCP servers, clients, and apps 🏎️ 🏎️ 🏎️

Verdict

CAUTION

Grade

Trust score

76 /100

Exposed tools

200 205r · 16w · 6d

Transport

stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The TypeScript framework for building Model Context Protocol servers, clients, and apps. The official TypeScript counterpart to FastMCP for Python - built and maintained with 💙 by the same team at Prefect.

Built on version 2 of the official MCP TypeScript SDK — the scoped @modelcontextprotocol/server and @modelcontextprotocol/client packages. FastMCP handles the protocol plumbing so you can focus on what your server actually does.

FastMCP 1.0 speaks both MCP protocol generations: the 2025 legacy era and the 2026-07-28 modern era. A server serves both at once, and a client negotiates one. The client negotiates automatically by default: it probes once at connect, uses the modern era when the server offers it, and falls back to legacy otherwise, so upgrading from 0.x keeps your existing code running against servers of either generation. Pass versionNegotiation: { mode: 'legacy' } to opt out of the probe. The migration guide covers the upgrade path.

Installation

npm install @prefecthq/fastmcp-ts

Servers

Turn TypeScript functions into MCP tools, resources, and prompts. Input schemas are inferred automatically from any Standard Schema-compatible library: Zod, Valibot, ArkType, and others.

import { FastMCP } from '@prefecthq/fastmcp-ts/server'
import { z } from 'zod'

const server = new FastMCP({ name: 'my-server', version: '1.0.0' })

server.tool(
{
name: 'add',
description: 'Add two numbers',
input: z.object({ a: z.number(), b: z.number() }),
},
({ a, b }) => a + b
)

server.resource(
{ uri: 'config://settings', description: 'App configuration' },
() => JSON.stringify({ theme: 'dark', lang: 'en' })
)

server.resource(
{ uri: 'user://{id}', description: 'User by ID' },
({ id }) =>

Read from source at commit 269acc757599OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add fastmcp-ts -- npx -y @prefecthq/[email protected]

claude-desktop

{
  "mcpServers": {
    "fastmcp-ts": {
      "command": "npx",
      "args": [
        "-y",
        "@prefecthq/[email protected]"
      ]
    }
  }
}

Exposed tools (200)

205 read · 16 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`a`	read	test
`a-data`	read	data from A
`add`	write	adds two numbers
`add_note`	write	Add a new note to the hub.
`added_after_listen`	write	Trigger list change
`added_later`	write	added after sync
`admin-only`	read	test
`admin-tool`	read	Admin only tool
`allLevels`	read	a tool
`alpha`	read	test tool
`always-fails`	read	Always throws an error
`analyze_notes`	read	Ask the LLM (via sampling) to analyze all notes. Requires a sampling-capable client.
`anotherTool`	read	test
`app_tool`	read	App-only tool
`apple`	read	test tool
`approval_confirm`	read	Record a confirmed approval decision
`approval_deny`	read	Record a denied approval decision
`approval_request`	read	Present a confirm/deny approval card to the user
`arg1`	read	First test argument
`arg2`	read	Second test argument
`ask`	read	ask
`assist`	read	test
`aud`	read	test
`b`	read	test
`b-data`	read	data from B
`b-item`	read	item template
`backend_action`	read	Backend action
`bad`	read	test
`beta`	read	test tool
`big`	read	big
`bin`	read	test
`blocked`	read	blocked
`boom`	read	boom
`both_tool`	read	Both
`c`	read	c
`call`	read	Call a tool, resource, or prompt on an MCP server
`check`	read	test
`choice_present`	read	Present a list of options for the user to choose from
`choice_select`	read	Record the user
`claude-code`	write	Install MCP server into Claude Code (~/.claude.json)
`claude-desktop`	write	Install MCP server into Claude Desktop
`code`	read	Code to review
`collect_info`	read	Collect user info
`compute`	read	Compute
`confirm`	read	needs confirmation
`confirmDelete`	destructive	Delete after confirmation
`convert_length`	read	Convert a value between length units (m, km, cm, mm, ft, in, mi, yd).
`convert_temperature`	read	Convert a value between temperature units (C, F, K).
`convert_weight`	read	Convert a value between weight units (kg, g, mg, lb, oz, st).
`count`	read	count
`ctx`	read	test
`ctxPrompt`	read	test
`cursor`	write	Install MCP server into Cursor (~/.cursor/mcp.json)
`custom`	read	test
`data`	read	a tool
`deep`	read	deep
`degenerate`	read	inputRequired with an empty inputRequests object
`delete-file`	destructive	Delete a file
`deleteFiles`	destructive	Delete files, asking for confirmation first
`deleteFilesStateful`	destructive	Delete files, threading server-minted state across the round-trip
`deleteState`	read	test
`delete_note`	destructive	Permanently delete a note. Requires the admin scope.
`dev`	read	Development utilities
`discover`	read	Discover MCP servers from known config files
`doc`	read	test
`dual_tool`	read	Dual tool
`dynamic`	read	a tool
`echo`	read	a tool
`echo_env`	read	Return the value of an environment variable
`elicitor`	read	a tool
`embedded-resource`	read	An embeddable text resource
`existing`	read	already there
`explain`	read	test
`explode`	read	test tool
`extended`	read	a tool
`fail`	read	fail
`fast`	read	test
`fetch`	read	test tool
`fetch-weather`	read	Fetch current weather conditions
`fetch_data`	read	Fetch data
`fetch_notes_table`	read	Return all notes as a rendered table component.
`file_upload_delete`	destructive	Delete a previously uploaded file by its handle
`file_upload_open`	write	Open a file picker UI for the user to upload a file
`file_upload_submit`	write	Receive and store uploaded file bytes server-side
`first`	read	test tool
`format`	read
`gamma`	read	test tool
`gemini`	write	Install MCP server into Gemini CLI (~/.gemini/settings.json)
`generate_ui`	write	Execute a UI component expression and return the component tree. Use search_components to discover available component APIs first.
`getId`	read	test
`getRoots`	read	a tool
`getState`	read	test
`getUser`	read	Get a user
`get_note`	read	Retrieve a single note by ID.
`get_time`	read	Return the current UTC time. No auth required.
`get_weather`	read	Get weather
`goose`	write	Install MCP server into Goose (~/.config/goose/config.yaml)
`greet`	read	Say hello
`greeting`	read	A greeting
`guarded`	read	Guarded
`hello`	read	hello prompt
`hidden`	read	test
`id`	read	Note ID to review
`img`	read	test
`initial`	read	a tool
`inspect`	read	Inspect tools, resources, and prompts from an MCP server
`inspector`	read	Launch the MCP inspector for a server file
`install`	write	Install an MCP server into a client config
`internal`	read	Internal
`internal_prompt`	read	Internal
`internal_tool`	read	Internal
`json_schema_2020_12_tool`	read	Tool with JSON Schema 2020-12 features
`lang`	read	output language
`language`	read	Language hint
`late_deep`	read	added late to grandchild
`late_prompt`	read	added late
`late_tool`	read	added late
`link`	read	test
`list`	read	List tools, resources, and prompts from an MCP server
`list_notes`	read	List all notes, optionally filtered by tag.
`list_prompts`	read	List all available MCP prompts
`list_resources`	read	List all available MCP resources
`logger`	read	a tool
`logit`	read	log
`mango`	read	test tool
`mcp-json`	write	Install MCP server into local mcp.json
`model_tool`	read	Model tool
`multi`	read	a tool
`my_form`	read	A form
`my_tool`	read	My tool
`name`	read	Who to greet
`named`	read	a tool
`new`	read	test
`new-tool`	read	a tool
`newPrompt`	read	added after connect
`newTool`	read	added after connect
`new_prompt`	read	new
`new_tool`	read	triggers notification
`noToken`	read	test
`noargs`	read	test
`noisy`	read	logs then returns
`noop`	read	x
`note`	read	A note
`notes_dashboard`	read	Open the interactive Dev Notes Hub dashboard.
`old_prompt`	read	old
`old_tool`	read	Old
`open`	read	Open
`open_a`	read	Open A
`open_app`	read	Open app
`open_b`	read	Open B
`open_dashboard`	read	Open the status dashboard UI.
`original`	read	original
`p`	read	p
`ping`	read	returns pong
`probe`	read	test
`progressor`	read	a tool
`protected_tool`	read	Requires read scope
`public`	read	public tool
`public-tool`	read	Public tool
`public_prompt`	read	Public
`public_tool`	read	No auth required
`read`	read	read
`refresh`	read	Refresh data
`refresh_status`	read	Backend action invoked from the dashboard UI.
`remember`	read	writes session state
`resourceUri`	read	URI of the resource to embed
`result`	read	extended result
`review`	read	Review code
`review_note`	read	Build a constructive review prompt for a specific note.
`rootser`	read	calls ctx.listRoots
`run`	write	Start an MCP server from a file
`sampler`	read	a tool
`search`	read	Search
`search_components`	read	List available UI components with their types and descriptions
`second`	read	test tool
`secret`	read	secret
`setState`	read	test
`show`	read	Show
`show_dashboard`	read	Show the dashboard
`slow`	read	slow
`soon_gone`	read	will be removed
`spy`	read	a tool
`static-binary`	read	A static binary resource
`static-text`	read	A static text resource
`stream`	read	Log before returning
`style`	read	tone
`submit_note`	write	Handle the add-note form submission from the dashboard.
`sumChunked`	read	sum a large array a few items at a time
`summarize`	read	Summarize text
`summarize_notes`	read	Build a prompt asking the LLM to summarize all notes.
`template-data`	read	A resource template keyed by id
`test_audio_content`	read	Returns an audio content block.
`test_elicitation`	read	Requests user input from the client via elicitation.
`test_elicitation_sep1034_defaults`	read	Elicits input with per-field default values (SEP-1034).
`test_elicitation_sep1330_enums`	read	Elicits input with all enum schema variants (SEP-1330).
`test_embedded_resource`	read	Returns an embedded resource content block.
`test_error_handling`	read	Always returns a tool-level error result.
`test_image_content`	read	Returns an image content block.
`test_multiple_content_types`	read	Returns text, image, and embedded-resource content blocks.
`test_prompt_with_arguments`	read	A prompt with two required arguments

Trust audit

CAUTIONgrade C · trust 76/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (6 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (25)

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/server/openapi/parser.ts

parser.ts

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

conformance-baseline-main.yml:26

#             --url http://127.0.0.1:39750/mcp --suite all

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/server/auth.test.ts:802

token: 'access-token-to-revoke',

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

confirmDelete, delete-file, deleteFiles, deleteFilesStateful, delete_note, file_upload_delete

Why it matters. 6 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/commands/dev/inspector.ts:3

import { parseFileSpec } from '../../utils/file-spec.js'

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/commands/dev/inspector.ts:4

import { resolveEntrypointBootstrapPath, buildEntrypointEnv } from '../../utils/entrypoint-bootstrap.js'

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/commands/dev/inspector.ts:5

import { cliError, formatError } from '../../utils/error.js'

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/commands/dev/inspector.ts:6

import { log } from '../../ui/output.js'

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/cli/commands/dev/inspector.ts:7

import { theme } from '../../ui/theme.js'

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

.github/workflows/conformance-nightly.yml:71

--url http://127.0.0.1:39750/mcp \

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/servers/running.mdx:101

console.log(server.address)                                          // e.g. http://127.0.0.1:54123/mcp

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/apps/providers.test.ts:229

new URL(`http://127.0.0.1:${port}/mcp`),

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/browser/oauth-e2e.spec.ts:89

baseUrl = `http://127.0.0.1:${mcp.address.port}`

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

tests/client/auth.test.ts:1186

expect(atob(headers.Authorization.slice('Basic '.length))).toBe(

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

examples/kitchen-sink/package.json

zod, tsx

Why it matters. 2 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

examples/unit-converter/package.json

zod, tsx

Why it matters. 2 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@clack/prompts, @modelcontextprotocol/client, @modelcontextprotocol/core, @modelcontextprotocol/node, @modelcontextprotocol/server, @modelcontextprotocol/server-legacy, @standard-schema/spec, @types/e

Why it matters. 39 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/api/server/interfaces/CorsOptions.mdx:36

Send `Access-Control-Allow-Credentials: true`. Requires an explicit

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/servers/running.mdx:158

`origin` accepts `'*'` (the default), one origin, an array of origins, or a function over the request's `Origin` header. With any non-`*` value the server echoes an allowed origin back (with `Vary: Or

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

AGENTS.md:155

**SSE resumability (SEP-1699):** the legacy (2025-era, sessionful) Streamable HTTP branch (`_dispatchLegacyHttp`) constructs the SDK transport with a bounded per-session `eventStore` (`src/server/lega