Documentation
Generate a working MCP (Model Context Protocol) server that connects an AI assistant to your files, database or API, with access rules you describe in plain language.
How a build works
- The AI model (open weights, served by Featherless.ai) reads your instructions and turns them into a small JSON policy: limits, blocked fields and tool descriptions.
- The policy is validated and clamped by the backend. Secret-looking names such as password or token are always blocked.
- The code comes from tested templates, not from the model, so the project compiles and the security checks are always present.
- You get a spoken report (optional) and download the .zip from the result page.
You choose a source, list what may be exposed and write your instructions. The service returns a .zip with a TypeScript server, its configuration and a README.
About the demo
Payment on this site is a simulation and nothing is charged. The generation, the AI step, the voice report and the download are real.
Install the generated server
Requires Node.js 18 or newer. Unzip the download, then:
1. Install and build
npm install
npm run build
2. Connect it to Claude Desktop
Add the server to claude_desktop_config.json. Use the real absolute path of the folder and set the environment variable for your source (see the table in Configuration).
{
"mcpServers": {
"clinica-pacientes": {
"command": "node",
"args": ["/absolute/path/to/clinica-pacientes/dist/index.js"],
"env": {
"DATABASE_URL": "postgresql://readonly_user:password@localhost/clinic"
}
}
}
}
3. Restart Claude Desktop
Quit Claude Desktop completely and open it again. The tools of your server appear in the tools list. Cursor, Windsurf and any other MCP client can run the same command.
Configuration
Every generated project has an mcp.config.json. It holds the resources you exposed and the policy the server enforces. Edit it, then run npm run build again.
Example for a database source
{
"server": { "name": "clinica-pacientes", "version": "1.0.0" },
"resources": ["patients", "appointments"],
"db_engine": "postgresql",
"policy": {
"max_rows": 100,
"blocked_columns": ["password", "token", "diagnosis"],
"statement_timeout_ms": 15000
},
"tool_descriptions": {
"run_query": "Read-only SELECT over patients and appointments."
}
}
Policy fields
| Field | Applies to | What it does |
|---|---|---|
| resources | All sources | Folders, tables or endpoints the server may expose. Anything else is refused. |
| tool_descriptions | All sources | Text the AI client reads to decide when to use each tool. |
| allowed_extensions | Local files | File extensions that can be listed and read. |
| max_file_bytes | Local files | Largest file size that will be read (1 KB to 5 MB). |
| max_results | Local files | Maximum number of search results (1 to 200). |
| max_rows | Database | Maximum rows returned by a query (1 to 1000). |
| blocked_columns | Database | Columns that are never returned, even if a query asks for them. |
| statement_timeout_ms | Database | Time limit for each query, in milliseconds. |
| blocked_fields | External API | JSON fields removed from every API response. |
| max_response_chars | External API | Responses longer than this are truncated. |
| timeout_ms | External API | Time limit for each API call, in milliseconds. |
Environment variables
Secrets never go in mcp.config.json. The server reads them from its environment, which is the env block in the client configuration or a local .env file.
| Variable | Applies to | What it does |
|---|---|---|
| MCP_ALLOWED_DIRS | Local files | Folders the server may read, separated by ; on Windows or : elsewhere. |
| DATABASE_URL | Database | Connection string of a read-only database user. |
| API_BASE_URL | External API | Base address of the API. |
| API_TOKEN | External API | Access token, if the API needs one. |
| API_AUTH_HEADER | External API | Header that carries the token. Defaults to Authorization. |
| API_AUTH_SCHEME | External API | Token prefix. Defaults to Bearer. Leave empty for raw keys. |
Local Files
Lets the assistant list, read and search text files inside folders you choose. It cannot leave those folders.
- list_files: lists the allowed files.
- read_file: returns the content of one file, up to the size limit.
- search_files: finds text across the allowed files.
Security
Every path is resolved to its real location before it is opened, so ../ tricks and symbolic links that point outside the folder are refused. Only the allowed extensions are read.
Databases
PostgreSQL or MySQL/MariaDB. The assistant can inspect the tables you exposed and run read-only queries.
- list_tables: lists the exposed tables.
- describe_table: shows the visible columns of a table.
- run_query: runs one SELECT statement.
How queries are checked
Only a single SELECT is accepted. Words such as INSERT, UPDATE, DELETE, DROP or TRUNCATE are refused, only exposed tables can be read, blocked columns are never returned, and the query runs inside a read-only transaction with a time limit. Use a database user that can only read as a second layer.
External APIs
Lets the assistant call the endpoints you list on one REST API.
- list_endpoints: lists the allowed endpoints.
- call_endpoint: calls one allowed endpoint and returns the JSON, truncated if long.
Security
Only endpoints on the list can be called. Full URLs and redirects are refused, so the server cannot be pointed to another host. Blocked fields are removed from the response before the assistant sees it.
Accessibility
MCP Builder is designed so that a blind or low-vision developer can build a server without looking at the screen. This section explains how.
Spoken build report
When a build finishes, the service creates an audio report with an ElevenLabs voice in English, German or Spanish. It says the server name, how many files were created and which rules the server enforces. Choose the language in the voice language field.
Text version of every report
The same report is always written as text in a live region. A screen reader announces it even if audio is off or fails, and a braille display shows it.
Keyboard and labels
Every control can be reached with Tab. Dialogs move focus inside and return it when they close, Escape closes them, every field has a label, and status changes are announced. Automated checks with axe-core report zero violations on all pages in the three languages.
Automatic reading
The result page can play the report by itself. The option to read it aloud automatically can be turned off, for example if your screen reader already speaks every change.
Step by step with a screen reader
- Open the home page and jump by headings to the build section, for example with the H key in NVDA or JAWS.
- Fill the fields in order: server name, source type, what to expose, instructions and voice language. Each field has a label and a hint.
- Activate the build button. Progress and errors are announced, so there is no need to look for them.
- On the result page the report is announced and can be played. Then activate the download button for the .zip.
- Open README.md inside the .zip and follow it. It is plain text, with the exact commands.
Honest limits
Automated audits cover the structure and labels, but a complete test with real screen reader users has not been done yet. The audio depends on the ElevenLabs service being available; the text version does not.
Troubleshooting
The server does not appear in Claude Desktop
Check that the path points to dist/index.js and is absolute, and that you ran npm run build. Quit Claude Desktop completely, including the system tray, and open it again.
The server starts but says a variable is missing
Set the variable for your source in the env block of the client configuration: MCP_ALLOWED_DIRS, DATABASE_URL or API_BASE_URL.
A database query is refused
The server accepts one SELECT over the exposed tables. Add the table to resources in mcp.config.json, remove blocked columns from the query, then run npm run build.
The API call fails
Check API_BASE_URL and the token. The endpoint must be in the list, and it must be a path such as /products, not a full URL.
The voice report does not play
Read the text version shown on the page, which is always available. Audio needs the voice service to be reachable; try the button again after a moment.
Frequently asked questions
What does the downloaded file include?
A TypeScript MCP server (src/index.ts), package.json, tsconfig.json, mcp.config.json with your rules, .env.example and a README with the steps.
Is it compatible with Cursor and Windsurf?
Yes. The server speaks MCP over stdio, so any MCP client can run it with the same command.
Do I need Node.js installed?
Yes, Node.js 18 or newer, to build and run the generated server.
Does the AI write the code of my server?
No. The model only turns your instructions into a validated policy. The code comes from templates that are compiled and tested in the project's continuous integration.