Model Context Protocol (MCP) in 2026: The Production Guide for Web Developers

mkdir mcp-remote-production && cd mcp-remote-production
npm init -y

# Core MCP SDK, web framework, validation, and security
npm install @modelcontextprotocol/sdk express zod dotenv cors

# TypeScript and development tooling
npm install -D typescript @types/node @types/express @types/cors tsx

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "lib": ["ES2022"],
    "outDir": "./dist",
    "rootDir": "./src",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true
  },
  "include": ["src/**/*"]
}

import express, { Request, Response, NextFunction } from "express";
import cors from "cors";
import dotenv from "dotenv";
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
import {
  CallToolRequestSchema,
  ListToolsRequestSchema,
  ListResourcesRequestSchema,
  ReadResourceRequestSchema,
} from "@modelcontextprotocol/sdk/types.js";
import { z } from "zod";

dotenv.config();

const app = express();
const PORT = process.env.PORT || 3001;
const API_SECRET_KEY = process.env.MCP_API_KEY || "deesu-mcp-secret-key-2026";

app.use(cors());
app.use(express.json());

// -------------------------------------------------------------
// 1. Security Middleware: Bearer Token Validation
// -------------------------------------------------------------
function requireAuth(req: Request, res: Response, next: NextFunction) {
  const authHeader = req.headers.authorization;
  const token = authHeader?.startsWith("Bearer ")
    ? authHeader.slice(7)
    : (req.query.token as string);

  if (!token || token !== API_SECRET_KEY) {
    return res.status(401).json({
      error: "Unauthorized",
      message: "Valid Bearer token or token query parameter required.",
    });
  }
  next();
}

// -------------------------------------------------------------
// 2. Initialize the MCP Server Instance
// -------------------------------------------------------------
const mcpServer = new Server(
  {
    name: "deesu-production-analytics-mcp",
    version: "1.0.0",
  },
  {
    capabilities: {
      tools: {},
      resources: {},
    },
  }
);

// -------------------------------------------------------------
// 3. Register Read-Only Resources (Database Schema Awareness)
// -------------------------------------------------------------
mcpServer.setRequestHandler(ListResourcesRequestSchema, async () => ({
  resources: [
    {
      uri: "postgres://analytics/schemas/users",
      name: "Users & Subscriptions Schema",
      mimeType: "text/plain",
      description: "Read-only schema structure for the production analytics database.",
    },
    {
      uri: "postgres://analytics/schemas/billing",
      name: "Billing Events Schema",
      mimeType: "text/plain",
      description: "Read-only schema for revenue, Stripe webhook, and tier transition logs.",
    },
  ],
}));

mcpServer.setRequestHandler(ReadResourceRequestSchema, async (request) => {
  const { uri } = request.params;

  if (uri === "postgres://analytics/schemas/users") {
    return {
      contents: [
        {
          uri,
          mimeType: "text/plain",
          text: `-- Read-only production schema reference
CREATE TABLE users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
  country_code VARCHAR(2) NOT NULL,
  subscription_tier VARCHAR(32) NOT NULL DEFAULT 'free',
  is_active BOOLEAN NOT NULL DEFAULT true
);
CREATE INDEX idx_users_cohort ON users (created_at, subscription_tier);`,
        },
      ],
    };
  }

  if (uri === "postgres://analytics/schemas/billing") {
    return {
      contents: [
        {
          uri,
          mimeType: "text/plain",
          text: `CREATE TABLE billing_events (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id UUID REFERENCES users(id),
  amount_cents INTEGER NOT NULL,
  currency VARCHAR(3) NOT NULL DEFAULT 'USD',
  event_type VARCHAR(64) NOT NULL, -- 'subscription_created', 'invoice_paid', 'churn'
  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
);`,
        },
      ],
    };
  }

  throw new Error(`Resource not found: ${uri}`);
});

// -------------------------------------------------------------
// 4. Register Executable Tools with Strict Schema Validation
// -------------------------------------------------------------
mcpServer.setRequestHandler(ListToolsRequestSchema, async () => ({
  tools: [
    {
      name: "query_subscription_metrics",
      description: "Fetch aggregated revenue, active subscriber counts, and churn rates by cohort without leaking customer PII.",
      inputSchema: {
        type: "object",
        properties: {
          tier: {
            type: "string",
            enum: ["all", "free", "starter", "professional", "enterprise"],
            description: "Target subscription tier filter.",
          },
          daysBack: {
            type: "number",
            minimum: 1,
            maximum: 365,
            description: "Number of preceding days to analyze (default: 30).",
          },
        },
        required: ["tier"],
      },
    },
  ],
}));

// Zod runtime validation contract
const SubscriptionMetricsArgsSchema = z.object({
  tier: z.enum(["all", "free", "starter", "professional", "enterprise"]),
  daysBack: z.number().int().min(1).max(365).optional().default(30),
});

mcpServer.setRequestHandler(CallToolRequestSchema, async (request) => {
  const { name, arguments: rawArgs } = request.params;

  if (name === "query_subscription_metrics") {
    const parseResult = SubscriptionMetricsArgsSchema.safeParse(rawArgs);
    if (!parseResult.success) {
      return {
        isError: true,
        content: [
          {
            type: "text",
            text: `Validation failed: ${parseResult.error.issues.map((i) => i.message).join(", ")}`,
          },
        ],
      };
    }

    const { tier, daysBack } = parseResult.data;

    // In production, execute a parameterized query on a read-only database replica:
    // const results = await db.query(SQL_QUERY, [tier, daysBack]);
    const mockAggregatedData = {
      queryWindowDays: daysBack,
      tierFilter: tier,
      totalActiveAccounts: tier === "enterprise" ? 420 : 18450,
      monthlyRecurringRevenueUSD: tier === "enterprise" ? 210000 : 738000,
      churnRatePercentage: 1.42,
      calculatedAt: new Date().toISOString(),
    };

    return {
      content: [
        {
          type: "text",
          text: JSON.stringify(mockAggregatedData, null, 2),
        },
      ],
    };
  }

  throw new Error(`Tool not registered: ${name}`);
});

// -------------------------------------------------------------
// 5. Multi-Client SSE Transport Connection Management
// -------------------------------------------------------------
const activeTransports = new Map<string, SSEServerTransport>();

// SSE Endpoint: AI Client opens the persistent event stream
app.get("/sse", requireAuth, async (req: Request, res: Response) => {
  // Set SSE response headers to disable proxy buffering
  res.setHeader("Content-Type", "text/event-stream");
  res.setHeader("Cache-Control", "no-cache");
  res.setHeader("Connection", "keep-alive");
  res.setHeader("X-Accel-Buffering", "no");

  const transport = new SSEServerTransport("/message", res);
  const sessionId = transport.sessionId;

  activeTransports.set(sessionId, transport);
  console.log(`[MCP] Client connected | Session: ${sessionId}`);

  req.on("close", () => {
    activeTransports.delete(sessionId);
    console.log(`[MCP] Client disconnected | Session: ${sessionId}`);
  });

  await mcpServer.connect(transport);
});

// Message Endpoint: AI Client posts tool executions and JSON-RPC calls
app.post("/message", requireAuth, async (req: Request, res: Response) => {
  const sessionId = req.query.sessionId as string;

  if (!sessionId || !activeTransports.has(sessionId)) {
    return res.status(404).json({
      error: "SessionNotFound",
      message: "No active SSE transport stream for the provided sessionId.",
    });
  }

  const transport = activeTransports.get(sessionId)!;
  await transport.handlePostMessage(req, res);
});

// Health check endpoint for cloud load balancers
app.get("/health", (_req, res) => {
  res.json({
    status: "healthy",
    uptimeSeconds: process.uptime(),
    activeSessions: activeTransports.size,
  });
});

app.listen(PORT, () => {
  console.log(`🚀 DEESU Remote MCP Server online at http://localhost:${PORT}`);
  console.log(`📡 SSE endpoint: http://localhost:${PORT}/sse`);
  console.log(`🛡️  Authentication: Bearer token enforced`);
});

{
  "mcpServers": {
    "deesu-analytics": {
      "url": "http://localhost:3001/sse?token=deesu-mcp-secret-key-2026"
    }
  }
}

{
  "mcpServers": {
    "production-db": {
      "url": "https://mcp.internal.yourdomain.com/sse",
      "headers": {
        "Authorization": "Bearer YOUR_PRODUCTION_MCP_SECRET"
      }
    }
  }
}

npx @modelcontextprotocol/inspector http://localhost:3001/sse?token=deesu-mcp-secret-key-2026

# Stage 1: Build TypeScript bundle
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json tsconfig.json ./
RUN npm ci
COPY src/ ./src/
RUN npm run build

# Stage 2: Minimal runtime image
FROM node:22-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
COPY package*.json ./
RUN npm ci --omit=dev && npm cache clean --force
COPY --from=builder /app/dist ./dist

# Run as non-root user for container security
USER node

EXPOSE 3001
CMD ["node", "dist/server.js"]

location /sse {
    proxy_pass http://mcp_backend:3001;
    proxy_http_version 1.1;
    proxy_set_header Connection '';
    proxy_set_header Host $host;
    proxy_buffering off;
    proxy_cache off;
    chunked_transfer_encoding on;
}