Create MCP Servers in One Command
AgenticMarket CLI scaffolds a production-ready MCP server in under 30 seconds. Build from scratch or wrap an existing REST API — then deploy and start earning. For the full narrative tutorial with deployment, see How to Create an MCP Server — From Zero to Production.
Who this is for
- Creators who want to publish and monetize a server on AgenticMarket
- Teams building private MCP servers for internal use
- Developers who want to turn an existing REST API into MCP tools
Requirements
- Node.js 20.6+ (current LTS recommended)
- npm (or any Node package manager)
- No AgenticMarket account required to create — only to publish
Quickstart
bashnpm install -g agenticmarket agenticmarket create my-server cd my-server npm install npm run dev
Open the MCP Inspector in a second terminal:
bashnpm run inspect
Connect at http://localhost:3000/mcp, add your x-mcp-secret header from .env, and start calling tools immediately.

Choose a template
agenticmarket create asks a few questions and generates the right starter project.
Fresh Server
Start from scratch with a production-ready MCP server and one reference tool (echo).
Use this when you are building something new or want full control of the tool design.

API Wrapper
Turn an existing REST API into MCP tools in minutes. The scaffold includes a pre-configured API client with:
- Auth injection (API key or bearer token) from environment variables
- Configurable request timeout with
API_TIMEOUT_MS - Typed error handling with
ApiClientError - Clean helpers:
apiClient.get(),apiClient.post()
What you would write manually:
typescript// ~80 lines of boilerplate per endpoint const res = await fetch("https://api.example.com/users?q=test", { headers: { "x-api-key": process.env.API_KEY ?? "" }, signal: AbortSignal.timeout(10000), }); if (!res.ok) throw new Error(`HTTP ${res.status}`); const data = await res.json();
What the scaffold gives you:
typescript// Auth, timeout, errors — all handled const data = await apiClient.get("/users", { q: "test" });

What gets generated
my-server/
├── src/
│ ├── index.ts # Hono server + MCP Streamable HTTP transport
│ ├── middleware/
│ │ ├── security.ts # HTTPS, secret header, CORS, header stripping
│ │ ├── rateLimit.ts # Per-IP sliding window rate limiter
│ │ ├── logger.ts # Color-coded dev request logger
│ │ └── audit.ts # Structured production audit logs
│ ├── tools/
│ │ ├── index.ts # Tool registry (auto-managed by CLI)
│ │ └── echo.ts # Reference tool with Zod validation
│ ├── lib/ # (API wrapper only)
│ │ └── api-client.ts # Pre-configured HTTP client
│ └── types.ts
├── .mcp/server.json # Official MCP registry schema
├── .env # Auto-generated secret (gitignored)
├── .env.example # Template for other developers
├── package.json # dev, build, inspect, validate, release
├── tsconfig.json
├── wrangler.toml # or Dockerfile, based on deploy target
├── AGENTS.md # AI agent context file
└── README.md
Production-ready defaults
Every scaffold ships with security and reliability wired in as middleware — difficult to accidentally remove:
| Layer | What it does |
|---|---|
| Secret header | Timing-safe constant-time comparison of x-mcp-secret |
| HTTPS enforcement | Hard rejects HTTP in production (warns in dev) |
| Rate limiting | Per-IP sliding window, configurable via env vars |
| CORS | No origins allowed by default. Configure via CORS_ORIGINS |
| Header stripping | Removes X-Powered-By and Server headers |
| CSP + X-Frame-Options | Content Security Policy and clickjacking prevention |
| Body limit | 1 MB max request size to prevent memory DoS |
| Session timeout | 30-minute idle cleanup for MCP sessions |
| Graceful shutdown | SIGTERM/SIGINT handlers for clean deploys |
| Audit logger | Structured logs in production (disabled in dev) |
Available scripts
| Script | What it does |
|---|---|
npm run dev | Start dev server with hot-reload at localhost:3000 |
npm run build | Compile TypeScript to dist/ |
npm start | Run production build |
npm run inspect | Open MCP Inspector browser UI |
npm run test:tools | Run Inspector in CLI mode (CI-ready) |
npm run validate | Pre-publish security and schema audit |
npm run release | Bump version number |
AgenticMarket