@modelcontextprotocol/sdk (TypeScript)
Official TypeScript SDK for building MCP servers and clients. Anthropic-maintained, the canonical pick for Node-based MCP work.
Delv Safety Grade: A+
Score 94/100 · assessed 2026-04-19
This is Anthropic's official TypeScript SDK for building MCP servers and clients, not an end-user application. As a framework, it inherits permissions from whatever you build with it. The SDK itself is transport and protocol machinery: it handles stdio/SSE connections, message serialisation, and capability negotiation. Anthropic maintains it actively in the modelcontextprotocol GitHub organisation with excellent documentation and examples. Supply chain is clean: published to npm with standard semver, fully open source under MIT licence. No known incidents. The security posture depends entirely on what developers build with it. If you're writing a filesystem server, you grant filesystem access; if you're wrapping an API, you grant network access. The SDK provides no sandbox or permission model itself, it's purely infrastructure. For developers building MCP tooling, this is the canonical reference implementation with strong provenance.
Green flags
- Official Anthropic SDK, canonical reference implementation
- Clean npm package with semver, MIT licence, active maintenance
- Comprehensive docs with working examples for all capabilities
- Handles protocol complexity (transport, negotiation, marshalling)
- Open source with active issue tracker and community
Red flags
- No built-in sandboxing or permission model for servers you build
- Developers must implement their own input validation and auth
- Framework inherits all risks of whatever capabilities you expose
Permissions requested
MCP capabilities
- Tools
- Resources
- Prompts
- Sampling
Platforms
Config location
npm install @modelcontextprotocol/sdk
Review
The canonical choice for building MCP servers in TypeScript. Requires Node fluency and willingness to handle plumbing yourself. If you want a framework that makes decisions for you, look elsewhere; this is a toolkit.
Good at
- Complete MCP support: tools, resources, prompts, sampling, all transport modes
- Clean API with strong TypeScript types that catch errors early
- Official Anthropic maintenance means protocol changes land here first
- Flexible transport: stdio for local clients, SSE for remote access
- Thorough docs with working examples for every capability
Watch out
- No middleware or batteries-included features (auth, rate limiting, validation)
- Debugging is hard because most clients hide stderr output
- Stdio transport on Windows requires careful stream handling
- Protocol still pre-1.0, minor breaking changes between versions
- Assumes comfort with async iterators and Node signal handling