AgenticMarketLoading
AgenticMarket CLI scaffolds a production-ready MCP server in under 30 seconds. Build from scratch or wrap an existing REST API — then deploy and distribute across 13+ IDEs. For the full narrative tutorial with deployment, see How to Create an MCP Server — From Zero to Production.
bashnpm install -g agenticmarket agenticmarket create my-server cd my-server npm install npm run dev
Open the MCP Inspector in a second terminal:
bashnpm run inspect
Connect at http://localhost:3000/mcp, add your x-mcp-secret header from .env, and start calling tools immediately.
agenticmarket create asks a few questions and generates the right starter project.
Start from scratch with a production-ready MCP server and one reference tool (echo).
Use this when you are building something new or want full control of the tool design.
Turn an existing REST API into MCP tools in minutes. The scaffold includes a pre-configured API client with:
API_TIMEOUT_MSApiClientErrorapiClient.get(), apiClient.post()What you would write manually:
typescript// ~80 lines of boilerplate per endpoint const res = await fetch("https://api.example.com/users?q=test", { headers: { "x-api-key": process.env.API_KEY ?? "" }, signal: AbortSignal.timeout(10000), }); if (!res.ok) throw new Error(`HTTP ${res.status}`); const data = await res.json();
What the scaffold gives you:
typescript// Auth, timeout, errors — all handled const data = await apiClient.get("/users", { q: "test" });
my-server/
├── src/
│ ├── index.ts # Hono server + MCP Streamable HTTP transport
│ ├── middleware/
│ │ ├── security.ts # HTTPS, secret header, CORS, header stripping
│ │ ├── rateLimit.ts # Per-IP sliding window rate limiter
│ │ ├── logger.ts # Color-coded dev request logger
│ │ └── audit.ts # Structured production audit logs
│ ├── tools/
│ │ ├── index.ts # Tool registry (auto-managed by CLI)
│ │ └── echo.ts # Reference tool with Zod validation
│ ├── lib/ # (API wrapper only)
│ │ └── api-client.ts # Pre-configured HTTP client
│ └── types.ts
├── .mcp/server.json # Official MCP registry schema
├── .env # Auto-generated secret (gitignored)
├── .env.example # Template for other developers
├── package.json # dev, build, inspect, validate, release
├── tsconfig.json
├── wrangler.toml # or Dockerfile, based on deploy target
├── AGENTS.md # AI agent context file
└── README.md
Every scaffold ships with security and reliability wired in as middleware — difficult to accidentally remove:
| Layer | What it does |
|---|---|
| Secret header | Timing-safe constant-time comparison of x-mcp-secret |
| HTTPS enforcement | Hard rejects HTTP in production (warns in dev) |
| Rate limiting | Per-IP sliding window, configurable via env vars |
| CORS | No origins allowed by default. Configure via CORS_ORIGINS |
| Header stripping | Removes X-Powered-By and Server headers |
| CSP + X-Frame-Options | Content Security Policy and clickjacking prevention |
| Body limit | 1 MB max request size to prevent memory DoS |
| Session timeout | 30-minute idle cleanup for MCP sessions |
| Graceful shutdown | SIGTERM/SIGINT handlers for clean deploys |
| Audit logger | Structured logs in production (disabled in dev) |
| Script | What it does |
|---|---|
npm run dev | Start dev server with hot-reload at localhost:3000 |
npm run build | Compile TypeScript to dist/ |
npm start | Run production build |
npm run inspect | Open MCP Inspector browser UI |
npm run test:tools | Run Inspector in CLI mode (CI-ready) |
npm run validate | Pre-publish security and schema audit |
npm run release | Bump version number |