Show and tell: Enterprise TypeScript MCP Boilerplate — Dual-stream Stdio Logging & SSRF-hardened Tools

[A7mdMe]

Disclosure: I am the maintainer of this open-source template. Posting in Show and tell to share production architectural patterns we developed for reliable MCP servers.

When building Model Context Protocol (MCP) servers in TypeScript for clients like Claude Desktop, Cursor, or Cline, developers frequently encounter three production hurdles that aren't addressed by basic "Hello World" examples:

---

1. The Stdio Framing Trap (Accidental console.log corruption)

In the MCP stdio transport, stdout is strictly reserved for JSON-RPC message frames. A single rogue console.log() from a third-party library or debug statement corrupts the byte stream, causing clients to throw SyntaxError: Unexpected token and disconnect immediately.

The Solution:
Route all diagnostic telemetry and logs strictly to stderr or rotating local file sinks, while leaving stdout exclusively to the MCP transport protocol:

import { format } from 'util';

export class StdioSafeLogger {
  private static writeToStderr(level: string, message: string, ...args: unknown[]): void {
    const timestamp = new Date().toISOString();
    const formatted = format(message, ...args);
    // Write strictly to stderr so stdio JSON-RPC on stdout remains untouched
    process.stderr.write(`[${timestamp}] [${level.toUpperCase()}] ${formatted}\n`);
  }

  static info(msg: string, ...args: unknown[]) { this.writeToStderr('info', msg, ...args); }
  static warn(msg: string, ...args: unknown[]) { this.writeToStderr('warn', msg, ...args); }
  static error(msg: string, ...args: unknown[]) { this.writeToStderr('error', msg, ...args); }
}

---

2. Tool Hardening: SSRF Prevention & Read-Only SQL Sanitization

Giving an LLM agent tools to fetch URLs or query relational databases creates real security surfaces:

• SSRF Protection: Web scraping / fetch tools must resolve hostnames prior to connection and block internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1, 169.254.169.254).
• SQL Sanitization: Database inspection tools should enforce read-only semantics at both the driver connection and the SQL token layer (stripping comments, disallowing multi-statement semicolons, and blocking mutation keywords like INSERT, UPDATE, DROP, ALTER).

---

3. Production Docker Packaging for Claude Desktop

For reproducible containerized execution with Claude Desktop, the image should run unprivileged with minimal attack surface:

FROM node:20-slim AS builder
WORKDIR /app
COPY package*.json tsconfig.json ./
RUN npm ci
COPY src/ ./src/
RUN npm run build

FROM node:20-slim AS runner
WORKDIR /app
ENV NODE_ENV=production
COPY package*.json ./
RUN npm ci --omit=dev
COPY --from=builder /app/dist ./dist
USER node
ENTRYPOINT ["node", "dist/index.js"]

Claude Desktop configuration:

{
  "mcpServers": {
    "production-kit": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "mcp-production-kit:latest"]
    }
  }
}

---

Resources & Live Implementation

• Open-source Core (MIT): github.com/A7mdMe/mcp-production-kit
• Glama Registry Score: Grade B Evaluated (Passed automated schema introspection and tool inspection)
• Enterprise Add-on: For teams looking for turn-key Docker Compose SSE services, CI/CD pipelines, and Cloudflare Worker templates, we also maintain a Pro Pack on Whop.

Would love feedback on how other teams are isolating stdio streams and handling SSRF validation in their MCP servers!