MCP Server Development: Building Tools for Claude
Production MCP (Model Context Protocol) server development. Architecture patterns, implementation, security, and deployment for Claude Code and Anthropic API.
MCP (Model Context Protocol) server development guide. Architecture patterns, implementation in Python and TypeScript, security considerations, and deployment for Claude Code and Anthropic API.
- What MCP is: Anthropic’s standard protocol for tool servers; JSON-RPC over stdio or HTTP
- Best language for new MCP servers: TypeScript (richest official SDK) or Python (cleanest patterns)
- Best deployment pattern: Stdio for local; HTTP+SSE for remote
- Best security pattern: Per-tool scope + authentication + rate limiting
- The verdict: MCP is the standard for tool servers in the Anthropic ecosystem. Build new tool servers as MCP from day one.
MCP (Model Context Protocol, launched Nov 2024 by Anthropic) standardized how AI tools expose capabilities to LLMs. By 2026, MCP is the production default for tool servers. Used by Claude Code, Cursor, Continue, hundreds of community servers. Building MCP servers is straightforward; doing it well requires production discipline. This guide covers architecture, implementation, security, and deployment.
01At a glance: what we tested
| Aspect | Pattern | Notes |
|---|---|---|
| Transport | stdio (local) or HTTP+SSE (remote) | stdio for security; HTTP for sharing |
| SDK choice | TypeScript or Python (official SDKs) | Both well-maintained; pick by stack |
| Tool definition | JSON Schema input/output | Match patterns from Anthropic docs |
| Resource definition | URI-addressable | For exposing data, not actions |
| Prompt definition | Templated for reuse | Server-side prompt library |
| Auth pattern | Bearer tokens or OAuth (HTTP) | Stdio inherits process auth |
| Deployment | Container or systemd service | Treat as production service |
02What MCP is and why it matters
MCP standardizes the LLM-to-tool-server protocol. Before MCP: every tool integration was bespoke. After MCP: build once, work with any MCP-compatible client (Claude Code, Cursor, etc.).
Buy if: not applicable. Skip if: not applicable.
Before MCP, integrating a custom tool with Claude required Claude-specific function calling implementation. Cursor used a different shape. Each framework had its own pattern. MCP standardized this. Your MCP server works with Claude Code, Cursor, Continue, custom clients, the SDK directly. The standardization open uped a tool ecosystem (anthropic.com/mcp lists 100+ community servers currently). For internal tools, building as MCP means you can reuse the server across all your AI clients.
03Implementation: pick stdio for local, HTTP for remote
Stdio MCP servers run as subprocess of the AI client (Claude Code, Cursor). Secure by default. HTTP MCP servers run remotely, support multi-client sharing, require explicit auth.
Buy if: not applicable. Skip if: not applicable.
Stdio: AI client launches your MCP server as subprocess; communicates via stdin/stdout JSON-RPC. Security: inherits client process credentials, no network exposure. Best: local file access, local tooling, personal productivity tools. HTTP+SSE: server runs as standalone HTTP service; AI clients connect via HTTP with bearer auth. Best: shared internal tools, cloud APIs wrapped as MCP, multi-tenant scenarios. Implementation: official SDKs in TypeScript and Python handle both transports. Pick by deployment shape, not by complexity.
04Security: per-tool scope + auth + rate limiting
Treat MCP servers as production services. Per-tool scoping prevents over-broad access. Auth on HTTP servers. Rate limiting on expensive tools. Logging for audit.
Buy if: not applicable. Skip if: not applicable.
Three security patterns that matter. (1) Per-tool scoping: each tool declares minimal required permissions; the server enforces. Don’t build a “do anything” tool. Build specific tools. (2) Auth on HTTP transport: bearer tokens for service-to-service; OAuth for user-context. Stdio inherits client auth (typically user). (3) Rate limiting on expensive operations: AI clients can call tools in rapid loops; rate-limit DB queries, API calls, file writes. Logging matters. Every tool call should log who called, when, what arguments, what result.
05Which option should you pick?
Pick by your situation
- You’re building a tool for personal / single-user use? → stdio MCP server
- You’re building a shared internal tool? → HTTP+SSE MCP server with auth
- You’re wrapping an existing internal API? → HTTP+SSE MCP as proxy with auth
- You’re writing in TypeScript? → Use @modelcontextprotocol/sdk
- You’re writing in Python? → Use mcp-server official SDK
- You’re writing in Go / Rust? → Community SDKs exist but less mature; consider TS/Python
06FAQ
How does MCP compare to OpenAI function calling or LangChain tools?
MCP is a transport-and-protocol standard; OpenAI function calling is a model API; LangChain tools are a Python framework. MCP is more general. Your MCP server works with Claude Code, Cursor, Continue, raw Anthropic API, and any other MCP-compatible client. OpenAI function calling and LangChain tools are still valid but less portable.
Can I expose my SaaS as an MCP server?
Yes, common pattern. Wrap your API as MCP server with HTTP+SSE transport. Users authenticate via your existing auth; AI clients connect via MCP. Examples: GitHub MCP server (built by GitHub), Linear MCP server (built by Linear), countless community-built servers for popular SaaS products.
What about MCP for production multi-tenant SaaS?
Multi-tenant MCP works but adds complexity. Auth becomes per-user (OAuth flow); rate limiting becomes per-tenant; logging needs tenant attribution. The pattern is well-documented in MCP spec but adds 2-4 weeks of engineering vs single-tenant. Worth it for SaaS exposing AI integrations.
How do I test MCP servers?
Two layers. Unit tests on your tool implementations (standard testing). Integration tests with the MCP SDK’s test client (mocks the AI-side protocol). For production, run the server in dev mode and connect Claude Code to it locally. Exercises the real protocol path. Promptfoo and similar tools support MCP-aware testing.
Will MCP be the standard long-term?
Anthropic is committed; OpenAI has not adopted formally currently but Claude Code, Cursor, Continue, and most major AI dev tools support MCP. The ecosystem effect is strong. For new tool servers, building MCP is the safe bet. Even if a competing standard emerges, MCP-first servers will continue to work in the Anthropic ecosystem.
07WikiWalls verdict
WikiWalls verdict. MCP is the production-default protocol for tool servers in the Anthropic ecosystem. Build new tool servers as MCP. Pick stdio for local-only, HTTP+SSE for remote / shared. Treat servers as production services with auth, rate limiting, and logging.
Last reviewed by WikiWalls editorial with current pricing, first-party benchmark data, and tested production reliability. Recommendations are editorially independent.
Last reviewed by WikiWalls editorial. Recommendations are editorially independent. Methodology: /test-methodology/. Editorial standards: /editorial-standards/.
