Middleware packages for express and node

.changeset/rich-teams-cough.md

@@ -0,0 +1,8 @@
+---
+'@modelcontextprotocol/express': patch
+'@modelcontextprotocol/node': patch
+'@modelcontextprotocol/test-integration': patch
+'@modelcontextprotocol/server': patch
+---
+
+add middleware packages for node and express

examples/server/package.json

@@ -38,6 +38,8 @@
         "hono": "catalog:runtimeServerOnly",
         "@modelcontextprotocol/examples-shared": "workspace:^",
         "@modelcontextprotocol/server": "workspace:^",
+        "@modelcontextprotocol/express": "workspace:^",
+        "@modelcontextprotocol/node": "workspace:^",
         "cors": "catalog:runtimeServerOnly",
         "express": "catalog:runtimeServerOnly",
         "zod": "catalog:runtimeShared"

examples/server/src/elicitationFormExample.ts

@@ -9,7 +9,9 @@
 
 import { randomUUID } from 'node:crypto';
 
-import { createMcpExpressApp, isInitializeRequest, McpServer, StreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isInitializeRequest, McpServer } from '@modelcontextprotocol/server';
 import { type Request, type Response } from 'express';
 
 // Create MCP server - it will automatically use AjvJsonSchemaValidator with sensible defaults

examples/server/src/elicitationUrlExample.ts

@@ -10,18 +10,15 @@
 import { randomUUID } from 'node:crypto';
 
 import { setupAuthServer } from '@modelcontextprotocol/examples-shared';
-import type { CallToolResult, ElicitRequestURLParams, ElicitResult, OAuthMetadata } from '@modelcontextprotocol/server';
 import {
-    checkResourceAllowed,
     createMcpExpressApp,
     getOAuthProtectedResourceMetadataUrl,
-    isInitializeRequest,
     mcpAuthMetadataRouter,
-    McpServer,
-    requireBearerAuth,
-    StreamableHTTPServerTransport,
-    UrlElicitationRequiredError
-} from '@modelcontextprotocol/server';
+    requireBearerAuth
+} from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import type { CallToolResult, ElicitRequestURLParams, ElicitResult, OAuthMetadata } from '@modelcontextprotocol/server';
+import { checkResourceAllowed, isInitializeRequest, McpServer, UrlElicitationRequiredError } from '@modelcontextprotocol/server';
 import cors from 'cors';
 import type { Request, Response } from 'express';
 import express from 'express';

examples/server/src/honoWebStandardStreamableHttp.ts

@@ -9,7 +9,7 @@
 
 import { serve } from '@hono/node-server';
 import type { CallToolResult } from '@modelcontextprotocol/server';
-import { McpServer, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { HTTPServerTransport, McpServer } from '@modelcontextprotocol/server';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import * as z from 'zod/v4';
@@ -36,7 +36,7 @@ server.registerTool(
 );
 
 // Create a stateless transport (no options = no session management)
-const transport = new WebStandardStreamableHTTPServerTransport();
+const transport = new HTTPServerTransport();
 
 // Create the Hono app
 const app = new Hono();

examples/server/src/jsonResponseStreamableHttp.ts

@@ -1,7 +1,9 @@
 import { randomUUID } from 'node:crypto';
 
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult } from '@modelcontextprotocol/server';
-import { createMcpExpressApp, isInitializeRequest, McpServer, StreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { isInitializeRequest, McpServer } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 import * as z from 'zod/v4';
 

examples/server/src/simpleSseServer.ts

@@ -1,5 +1,7 @@
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { SSEServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult } from '@modelcontextprotocol/server';
-import { createMcpExpressApp, McpServer, SSEServerTransport } from '@modelcontextprotocol/server';
+import { McpServer } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 import * as z from 'zod/v4';
 

examples/server/src/simpleStatelessStreamableHttp.ts

@@ -1,5 +1,7 @@
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult, GetPromptResult, ReadResourceResult } from '@modelcontextprotocol/server';
-import { createMcpExpressApp, McpServer, StreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { McpServer } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 import * as z from 'zod/v4';
 

examples/server/src/simpleStreamableHttp.ts

@@ -1,6 +1,13 @@
 import { randomUUID } from 'node:crypto';
 
 import { setupAuthServer } from '@modelcontextprotocol/examples-shared';
+import {
+    createMcpExpressApp,
+    getOAuthProtectedResourceMetadataUrl,
+    mcpAuthMetadataRouter,
+    requireBearerAuth
+} from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type {
     CallToolResult,
     GetPromptResult,
@@ -11,16 +18,11 @@ import type {
 } from '@modelcontextprotocol/server';
 import {
     checkResourceAllowed,
-    createMcpExpressApp,
     ElicitResultSchema,
-    getOAuthProtectedResourceMetadataUrl,
     InMemoryTaskMessageQueue,
     InMemoryTaskStore,
     isInitializeRequest,
-    mcpAuthMetadataRouter,
-    McpServer,
-    requireBearerAuth,
-    StreamableHTTPServerTransport
+    McpServer
 } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 import * as z from 'zod/v4';

examples/server/src/simpleTaskInteractive.ts

@@ -11,6 +11,8 @@
 
 import { randomUUID } from 'node:crypto';
 
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type {
     CallToolResult,
     CreateMessageRequest,
@@ -35,15 +37,13 @@ import type {
 } from '@modelcontextprotocol/server';
 import {
     CallToolRequestSchema,
-    createMcpExpressApp,
     GetTaskPayloadRequestSchema,
     GetTaskRequestSchema,
     InMemoryTaskStore,
     isTerminal,
     ListToolsRequestSchema,
     RELATED_TASK_META_KEY,
-    Server,
-    StreamableHTTPServerTransport
+    Server
 } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 

examples/server/src/sseAndStreamableHttpCompatibleServer.ts

@@ -1,13 +1,9 @@
 import { randomUUID } from 'node:crypto';
 
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { SSEServerTransport, StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult } from '@modelcontextprotocol/server';
-import {
-    createMcpExpressApp,
-    isInitializeRequest,
-    McpServer,
-    SSEServerTransport,
-    StreamableHTTPServerTransport
-} from '@modelcontextprotocol/server';
+import { isInitializeRequest, McpServer } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 import * as z from 'zod/v4';
 

examples/server/src/ssePollingExample.ts

@@ -14,8 +14,10 @@
  */
 import { randomUUID } from 'node:crypto';
 
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult } from '@modelcontextprotocol/server';
-import { createMcpExpressApp, McpServer, StreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { McpServer } from '@modelcontextprotocol/server';
 import cors from 'cors';
 import type { Request, Response } from 'express';
 

examples/server/src/standaloneSseWithGetStreamableHttp.ts

@@ -1,7 +1,9 @@
 import { randomUUID } from 'node:crypto';
 
+import { createMcpExpressApp } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { ReadResourceResult } from '@modelcontextprotocol/server';
-import { createMcpExpressApp, isInitializeRequest, McpServer, StreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { isInitializeRequest, McpServer } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 
 // Create an MCP server with implementation details

examples/server/tsconfig.json

@@ -6,6 +6,8 @@
         "paths": {
             "*": ["./*"],
             "@modelcontextprotocol/server": ["./node_modules/@modelcontextprotocol/server/src/index.ts"],
+            "@modelcontextprotocol/node": ["./node_modules/@modelcontextprotocol/node/src/index.ts"],
+            "@modelcontextprotocol/express": ["./node_modules/@modelcontextprotocol/express/src/index.ts"],
             "@modelcontextprotocol/core": [
                 "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/index.ts"
             ],

examples/shared/package.json

@@ -35,6 +35,7 @@
     },
     "dependencies": {
         "@modelcontextprotocol/server": "workspace:^",
+        "@modelcontextprotocol/express": "workspace:^",
         "express": "catalog:runtimeServerOnly"
     },
     "devDependencies": {

examples/shared/src/demoInMemoryOAuthProvider.ts

@@ -1,15 +1,9 @@
 import { randomUUID } from 'node:crypto';
 
-import type {
-    AuthInfo,
-    AuthorizationParams,
-    OAuthClientInformationFull,
-    OAuthMetadata,
-    OAuthRegisteredClientsStore,
-    OAuthServerProvider,
-    OAuthTokens
-} from '@modelcontextprotocol/server';
-import { createOAuthMetadata, InvalidRequestError, mcpAuthRouter, resourceUrlFromServerUrl } from '@modelcontextprotocol/server';
+import type { AuthorizationParams, OAuthRegisteredClientsStore, OAuthServerProvider } from '@modelcontextprotocol/express';
+import { createOAuthMetadata, mcpAuthRouter } from '@modelcontextprotocol/express';
+import type { AuthInfo, OAuthClientInformationFull, OAuthMetadata, OAuthTokens } from '@modelcontextprotocol/server';
+import { InvalidRequestError, resourceUrlFromServerUrl } from '@modelcontextprotocol/server';
 import type { Request, Response } from 'express';
 import express from 'express';
 

examples/shared/test/demoInMemoryOAuthProvider.test.ts

@@ -1,5 +1,5 @@
-import type { OAuthClientInformationFull } from '@modelcontextprotocol/core';
-import type { AuthorizationParams } from '@modelcontextprotocol/server';
+import type { AuthorizationParams } from '@modelcontextprotocol/express';
+import type { OAuthClientInformationFull } from '@modelcontextprotocol/server';
 import { InvalidRequestError } from '@modelcontextprotocol/server';
 import { createExpressResponseMock } from '@modelcontextprotocol/test-helpers';
 import type { Response } from 'express';

examples/shared/tsconfig.json

@@ -6,6 +6,7 @@
         "paths": {
             "*": ["./*"],
             "@modelcontextprotocol/server": ["./node_modules/@modelcontextprotocol/server/src/index.ts"],
+            "@modelcontextprotocol/express": ["./node_modules/@modelcontextprotocol/express/src/index.ts"],
             "@modelcontextprotocol/core": [
                 "./node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/src/index.ts"
             ],

packages/middleware/express/README.md

@@ -0,0 +1,35 @@
+# @modelcontextprotocol/express
+
+Express middleware and OAuth server support for MCP.
+
+## Installation
+
+```bash
+npm install @modelcontextprotocol/express
+```
+
+## Exports
+
+- `createMcpExpressApp()` - Create an Express app with MCP-compatible middleware
+- `mcpAuthRouter()` - OAuth 2.0 authorization server router
+- `requireBearerAuth()` - Bearer token authentication middleware
+- `mcpAuthMetadataRouter()` - Protected resource metadata endpoints
+
+## Usage
+
+```typescript
+import { createMcpExpressApp, mcpAuthRouter } from '@modelcontextprotocol/express';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { McpServer } from '@modelcontextprotocol/server';
+
+const app = createMcpExpressApp();
+const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+
+app.post('/mcp', async (req, res) => {
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => crypto.randomUUID() });
+    await server.connect(transport);
+    await transport.handleRequest(req, res, req.body);
+});
+
+app.listen(3000);
+```

packages/middleware/express/eslint.config.mjs

@@ -0,0 +1,12 @@
+// @ts-check
+
+import baseConfig from '@modelcontextprotocol/eslint-config';
+
+export default [
+    ...baseConfig,
+    {
+        settings: {
+            'import/internal-regex': '^@modelcontextprotocol/'
+        }
+    }
+];

packages/middleware/express/package.json

@@ -0,0 +1,80 @@
+{
+    "name": "@modelcontextprotocol/express",
+    "version": "2.0.0-alpha.0",
+    "description": "Express adapter for Model Context Protocol servers",
+    "license": "MIT",
+    "author": "Anthropic, PBC (https://anthropic.com)",
+    "homepage": "https://modelcontextprotocol.io",
+    "bugs": "https://github.com/modelcontextprotocol/typescript-sdk/issues",
+    "type": "module",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/modelcontextprotocol/typescript-sdk.git"
+    },
+    "engines": {
+        "node": ">=20",
+        "pnpm": ">=10.24.0"
+    },
+    "packageManager": "pnpm@10.24.0",
+    "keywords": [
+        "modelcontextprotocol",
+        "mcp",
+        "express"
+    ],
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.mts",
+            "import": "./dist/index.mjs"
+        }
+    },
+    "files": [
+        "dist"
+    ],
+    "scripts": {
+        "typecheck": "tsgo -p tsconfig.json --noEmit",
+        "build": "tsdown",
+        "build:watch": "tsdown --watch",
+        "prepack": "npm run build",
+        "lint": "eslint src/ && prettier --ignore-path ../../../.prettierignore --check .",
+        "lint:fix": "eslint src/ --fix && prettier --ignore-path ../../../.prettierignore --write .",
+        "check": "npm run typecheck && npm run lint",
+        "test": "vitest run",
+        "test:watch": "vitest"
+    },
+    "dependencies": {
+        "cors": "catalog:runtimeServerOnly",
+        "express": "catalog:runtimeServerOnly",
+        "express-rate-limit": "catalog:runtimeServerOnly",
+        "pkce-challenge": "catalog:runtimeShared",
+        "zod": "catalog:runtimeShared"
+    },
+    "peerDependencies": {
+        "@modelcontextprotocol/server": "workspace:*",
+        "@modelcontextprotocol/node": "workspace:*"
+    },
+    "devDependencies": {
+        "@modelcontextprotocol/core": "workspace:^",
+        "@modelcontextprotocol/server": "workspace:^",
+        "@modelcontextprotocol/node": "workspace:^",
+        "@modelcontextprotocol/tsconfig": "workspace:^",
+        "@modelcontextprotocol/vitest-config": "workspace:^",
+        "@modelcontextprotocol/eslint-config": "workspace:^",
+        "@modelcontextprotocol/test-helpers": "workspace:^",
+        "@eslint/js": "catalog:devTools",
+        "@types/cors": "catalog:devTools",
+        "@types/express": "catalog:devTools",
+        "@types/express-serve-static-core": "catalog:devTools",
+        "@types/supertest": "catalog:devTools",
+        "@typescript/native-preview": "catalog:devTools",
+        "eslint": "catalog:devTools",
+        "eslint-config-prettier": "catalog:devTools",
+        "eslint-plugin-n": "catalog:devTools",
+        "prettier": "catalog:devTools",
+        "supertest": "catalog:devTools",
+        "tsdown": "catalog:devTools",
+        "tsx": "catalog:devTools",
+        "typescript": "catalog:devTools",
+        "typescript-eslint": "catalog:devTools",
+        "vitest": "catalog:devTools"
+    }
+}

packages/middleware/express/src/auth/handlers/index.ts

@@ -0,0 +1,5 @@
+export * from './authorize.js';
+export * from './metadata.js';
+export * from './register.js';
+export * from './revoke.js';
+export * from './token.js';

packages/middleware/express/src/auth/index.ts

@@ -0,0 +1,6 @@
+export * from './clients.js';
+export * from './handlers/index.js';
+export * from './middleware/index.js';
+export * from './provider.js';
+export * from './providers/index.js';
+export * from './router.js';

packages/middleware/express/src/auth/middleware/index.ts

@@ -0,0 +1,3 @@
+export * from './allowedMethods.js';
+export * from './bearerAuth.js';
+export * from './clientAuth.js';

packages/middleware/express/src/auth/providers/index.ts

@@ -0,0 +1 @@
+export * from './proxyProvider.js';