MCP到底解决了什么问题?一篇文章带你从零搭建TypeScript服务器（文末送书福利）

┌─────────────────────────────────────┐
│         MCP Server 核心             │
├─────────────────────────────────────┤
│                                     │
│  Resources  ← 只读数据              │
│             (查询配置、读取文档)     │
│                                     │
│  Tools      ← 有副作用的动作        │
│             (创建记录、发送请求)     │
│                                     │
│  Prompts    ← 结构化的推理引导      │
│             (摘要模板、分析框架)     │
│                                     │
└─────────────────────────────────────┘

mkdir my-first-mcp-server
cd my-first-mcp-server
npm init -y
npm install @modelcontextprotocol/sdk zod

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = new McpServer({
  name: "my-first-mcp-server",
  version: "1.0.0",
});

const transport = new StdioServerTransport();
await server.connect(transport);

server.resource(
  "config",
  "config://app",
  async () => ({
    name: "Demo App",
    environment: "development",
  })
);

import { z } from"zod";

server.tool(
"create_note",
  {
    title: z.string(),
    body: z.string(),
  },
async ({ title, body }) => {
    // 这里写入数据库
    return { success: true };
  }
);

// ❌ 危险!没有任何输入验证
server.tool(
  "query_jira",
  {},
  async (params: any) => {
    // 直接拼接SQL或者API查询,等着被注入吧
    return await jiraApi.search(params.query);
  }
);

// ✅ 安全且可靠
server.tool(
"query_jira",
  {
    project: z.string().max(20),
    status: z.enum(["open", "in_progress", "done"]),
    assignee: z.string().email().optional(),
  },
async ({ project, status, assignee }) => {
    // 类型安全的查询,有明确的参数范围
    returnawait jiraApi.search({
      jql: `project = ${project} AND status = ${status}${
        assignee ? ` AND assignee = ${assignee}` : ""
      }`,
    });
  }
);

server.prompt(
  "summarize_notes",
  {
    notes: z.string(),
  },
({ notes }) => ({
    messages: [
      {
        role: "system",
        content: "你是一位精准的技术写作专家。",
      },
      {
        role: "user",
        content: `请总结以下笔记:\n${notes}`,
      },
    ],
  })
);

server.prompt(
  "code_review",
  {
    code: z.string(),
    language: z.enum(["typescript", "javascript", "python"]),
    focus: z.enum(["performance", "security", "style"]).optional(),
  },
({ code, language, focus = "style" }) => ({
    messages: [
      {
        role: "system",
        content: `你是一位经验丰富的${language}代码审查专家。
审查重点:${focus}
- 如果是performance,关注性能瓶颈和优化机会
- 如果是security,关注安全漏洞和潜在风险
- 如果是style,关注代码风格和最佳实践
请给出具体的改进建议,并标注严重程度(critical/major/minor)。`,
      },
      {
        role: "user",
        content: `\`\`\`${language}\n${code}\n\`\`\``,
      },
    ],
  })
);

┌──────────────┐
│ 1. 启动服务器 │
└──────┬───────┘
       │
       ▼
┌──────────────────┐
│ 2. 用inspector   │
│    连接并检查     │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ 3. 调用每个Tool  │
│    尝试边界输入   │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ 4. 检查错误处理  │
│    和返回格式     │
└──────────────────┘

// 千万别这么干!
server.tool(
  "execute_sql",
  {
    query: z.string(),
  },
  async ({ query }) => {
    // 直接执行任意SQL?这是在找死
    return await db.raw(query);
  }
);

// 预定义的安全查询
const ALLOWED_QUERIES = {
  user_count: "SELECT COUNT(*) FROM users WHERE active = true",
  recent_orders: "SELECT * FROM orders WHERE created_at > NOW() - INTERVAL '7 days' LIMIT 100",
  product_stats: "SELECT category, COUNT(*) FROM products GROUP BY category",
} asconst;

server.tool(
"execute_predefined_query",
  {
    query_name: z.enum(Object.keys(ALLOWED_QUERIES) as [string, ...string[]]),
  },
async ({ query_name }) => {
    // 只能执行预定义的查询
    returnawait db.raw(ALLOWED_QUERIES[query_name]);
  }
);

订单查询 → MCP Resource (只读,安全)
订单创建 → MCP Tool (有验证,有日志)
订单分析 → MCP Prompt (标准化输出)