How to Build a Secure MCP Server from Scratch

How to Build a Secure MCP Server from Scratch Most MCP server tutorials show you how to make things work. This one shows you how to make them work without creating security vulnerabilities. We'll build a file reader MCP server — simple enough to follow in one sitting, complex enough to hit all the real security decisions you'll face in production. Setup mkdir secure-mcp-demo && cd secure-mcp-demo npm init -y npm install @modelcontextprotocol/sdk zod npm install -D typescript @types/node tsx tsconfig.json: { "compilerOptions": { "target": "ES2022", "module": "Node16", "moduleResolution": "Node16", "strict": true, "outDir": "./dist" } } The Insecure Version (What Not to Do) Most tutorials look like this: import { Server } from "@modelcontextprotocol/sdk/server/index.js"; import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"; import * as fs from "fs"; const server = new Server({ name: "file-reader", version: "1.0.0" }); server.setRequestHandler("tools/ca