MCP Starter Kit

A production-ready starter to build a secure MCP server for any project
Connect Claude, ChatGPT and any AI agent to your backend with just a URL + API key.

---

What is this?

**MCP Starter Kit** scaffolds a **secure, online MCP (Model Context Protocol) server** for **any project**. It's the machine-to-machine bridge between an AI agent (Claude Desktop/Web, ChatGPT, or your own agent) and your backend API — each *tool* maps to one endpoint and is authenticated with an **API key + scopes**.

AI agent ──MCP (Streamable HTTP / stdio / OAuth)──▶ -mcp ──REST + Bearer key──▶ Your backend

The kit is project-agnostic: you provide the project name, backend URL and the list of tools — the templates already ship with all the security hardening baked in.

Features

• Two transports — Streamable HTTP (online, many clients) + stdio (Claude Desktop).
• Stateless OAuth 2.0 (PKCE S256) so the ChatGPT app / Claude web (which require OAuth, with no field to paste an API key) can connect. Header-key auth keeps working in parallel.
• Security hardening, ready out of the box:
  • Verify the key against the backend at initialize (blocks pre-auth DoS).
  • Session cap + idle-TTL sweep, per-IP rate limit on the initialize path.
  • Bind sha256(key) to the session; SSRF cross-host block + request timeouts.
  • Audit to stderr (stdout is reserved