mcp-server
Build and maintain an MCP server
Scaffolding an MCP server is the easy 10%. The heavy lifting is everything after init: writing tool definitions the agent reads correctly, extending the surface without breaking agents that already depend on it, defending against tool poisoning and prompt injection, and operating the thing once it is remote. This skill covers the whole lifecycle. The deep reference for each phase is the vendored OKF bundle in references/; SKILL.md is the procedure.
Target the current protocol
MCP uses date-string protocol revisions. As of 2026-06-21 the current stable revision is 2025-11-25 (it superseded 2025-06-18); a stateless-core revision 2026-07-28 is the imminent next release. Build against 2025-11-25 and let the SDK negotiate older clients. The production SDK is @modelcontextprotocol/sdk (v1.x, TypeScript). The split @modelcontextprotocol/server + /client packages are the unreleased V2 line, not current. Full protocol surface, lifecycle, and result shapes in protocol.md.
Step 1: Pick the transport
| Use | Transport | Why |
|---|---|---|
| Local, client spawns the server as a subprocess, one user | stdio | No auth, no sessions, no scaling. Default for local tools. Log to stderr only. |
| Remote, hosted, multiple clients | Streamable HTTP | Single endpoint (POST + optional SSE upgrade), Mcp-Session-Id, OAuth, you own scaling and ops. |
Prefer stdio until you genuinely need remote multi-client access. The old HTTP+SSE transport is deprecated (replaced by Streamable HTTP in 2025-03-26). Transport mechanics, the stdio-vs-HTTP operational cliff, and sessions are in protocol.md and maintenance.md.