ModelsAtlas
Explore
Atlas / MCP servers / redocly-contrib / MCP TypeScript SDK !

MCP TypeScript SDK !SAFE

mcp/redocly-contrib/mcp-typescript-sdk
MCP server by redocly-contrib · Audited 2026-10-12
⚑ Report / re-scanSource ↗

The official TypeScript SDK for Model Context Protocol servers and clients

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
2 2r · 0w · 0d
Transport
sse · stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

MCP TypeScript SDK

Table of Contents

  • Overview
  • Installation
  • Quickstart
  • What is MCP?
  • Core Concepts
  • Server
  • Resources
  • Tools
  • Prompts
  • Completions
  • Sampling
  • Running Your Server
  • stdio
  • Streamable HTTP
  • Testing and Debugging
  • Examples
  • Echo Server
  • SQLite Explorer
  • Advanced Usage
  • Dynamic Servers
  • Low-Level Server
  • Writing MCP Clients
  • Proxy Authorization Requests Upstream
  • Backwards Compatibility
  • Documentation
  • Contributing
  • License

Overview

The Model Context Protocol allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction. This TypeScript SDK implements the full MCP specification, making it easy to:

  • Build MCP clients that can connect to any MCP server
  • Create MCP servers that expose resources, prompts and tools
  • Use standard transports like stdio and Streamable HTTP
  • Handle all MCP protocol messages and lifecycle events

Installation

npm install @modelcontextprotocol/sdk
⚠️ MCP requires Node.js v18.x or higher to work fine.

Quick Start

Let's create a simple MCP server that exposes a calculator tool and some data:

import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } f
Read from source at commit d85e22edf71dOBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-typescript-sdk -- npx -y @redocly/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-typescript-sdk": {
      "command": "npx",
      "args": [
        "-y",
        "@redocly/[email protected]"
      ]
    }
  }
}
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
greetreadA simple greeting tool
test-toolread
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (5)

LOWInventory / provenance · inv.hidden_file · CWE-1104
.git-blame-ignore-revs
.git-blame-ignore-revs
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/server/sse.test.ts:107
resolve(new URL(`http://127.0.0.1:${addr.port}`));
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/server/streamableHttp.test.ts:84
resolve(new URL(`http://127.0.0.1:${addr.port}`));
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/server/streamableHttp.test.ts:141
resolve(new URL(`http://127.0.0.1:${addr.port}`));
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
content-type, raw-body, zod, @eslint/js, @jest-mock/express, @types/content-type, @types/cors, @types/cross-spawn
Why it matters. 23 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha d85e22edf71dfull audit observations/trust-audit/mcp-server/redocly-contrib__mcp-typescript-sdk.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12d85e22edf71dSAFEB89first audit
06

Questions

What is the @redocly/mcp-typescript-sdk MCP server?

The official TypeScript SDK for Model Context Protocol servers and clients

What tools does @redocly/mcp-typescript-sdk expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @redocly/mcp-typescript-sdk safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does @redocly/mcp-typescript-sdk need?

No credential environment variables were found in its source, so it appears to need none.

How does @redocly/mcp-typescript-sdk run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @redocly/mcp-typescript-sdk at 1.18.1.

How current is this page?

The grade is for one exact copy of the source (d85e22edf71d), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement