>_mcpbuilder

Documentation

Generate a working MCP (Model Context Protocol) server that connects an AI assistant to your files, database or API, with access rules you describe in plain language.

How a build works

  1. The AI model (open weights, served by Featherless.ai) reads your instructions and turns them into a small JSON policy: limits, blocked fields and tool descriptions.
  2. The policy is validated and clamped by the backend. Secret-looking names such as password or token are always blocked.
  3. The code comes from tested templates, not from the model, so the project compiles and the security checks are always present.
  4. You get a spoken report (optional) and download the .zip from the result page.

You choose a source, list what may be exposed and write your instructions. The service returns a .zip with a TypeScript server, its configuration and a README.

About the demo

Payment on this site is a simulation and nothing is charged. The generation, the AI step, the voice report and the download are real.

Install the generated server

Requires Node.js 18 or newer. Unzip the download, then:

1. Install and build

npm install
npm run build

2. Connect it to Claude Desktop

Add the server to claude_desktop_config.json. Use the real absolute path of the folder and set the environment variable for your source (see the table in Configuration).

{
  "mcpServers": {
    "clinica-pacientes": {
      "command": "node",
      "args": ["/absolute/path/to/clinica-pacientes/dist/index.js"],
      "env": {
        "DATABASE_URL": "postgresql://readonly_user:password@localhost/clinic"
      }
    }
  }
}

3. Restart Claude Desktop

Quit Claude Desktop completely and open it again. The tools of your server appear in the tools list. Cursor, Windsurf and any other MCP client can run the same command.

Configuration

Every generated project has an mcp.config.json. It holds the resources you exposed and the policy the server enforces. Edit it, then run npm run build again.

Example for a database source

{
  "server": { "name": "clinica-pacientes", "version": "1.0.0" },
  "resources": ["patients", "appointments"],
  "db_engine": "postgresql",
  "policy": {
    "max_rows": 100,
    "blocked_columns": ["password", "token", "diagnosis"],
    "statement_timeout_ms": 15000
  },
  "tool_descriptions": {
    "run_query": "Read-only SELECT over patients and appointments."
  }
}

Policy fields

FieldApplies toWhat it does
resourcesAll sourcesFolders, tables or endpoints the server may expose. Anything else is refused.
tool_descriptionsAll sourcesText the AI client reads to decide when to use each tool.
allowed_extensionsLocal filesFile extensions that can be listed and read.
max_file_bytesLocal filesLargest file size that will be read (1 KB to 5 MB).
max_resultsLocal filesMaximum number of search results (1 to 200).
max_rowsDatabaseMaximum rows returned by a query (1 to 1000).
blocked_columnsDatabaseColumns that are never returned, even if a query asks for them.
statement_timeout_msDatabaseTime limit for each query, in milliseconds.
blocked_fieldsExternal APIJSON fields removed from every API response.
max_response_charsExternal APIResponses longer than this are truncated.
timeout_msExternal APITime limit for each API call, in milliseconds.

Environment variables

Secrets never go in mcp.config.json. The server reads them from its environment, which is the env block in the client configuration or a local .env file.

VariableApplies toWhat it does
MCP_ALLOWED_DIRSLocal filesFolders the server may read, separated by ; on Windows or : elsewhere.
DATABASE_URLDatabaseConnection string of a read-only database user.
API_BASE_URLExternal APIBase address of the API.
API_TOKENExternal APIAccess token, if the API needs one.
API_AUTH_HEADERExternal APIHeader that carries the token. Defaults to Authorization.
API_AUTH_SCHEMEExternal APIToken prefix. Defaults to Bearer. Leave empty for raw keys.

Local Files

Lets the assistant list, read and search text files inside folders you choose. It cannot leave those folders.

  • list_files: lists the allowed files.
  • read_file: returns the content of one file, up to the size limit.
  • search_files: finds text across the allowed files.

Security

Every path is resolved to its real location before it is opened, so ../ tricks and symbolic links that point outside the folder are refused. Only the allowed extensions are read.

Databases

PostgreSQL or MySQL/MariaDB. The assistant can inspect the tables you exposed and run read-only queries.

  • list_tables: lists the exposed tables.
  • describe_table: shows the visible columns of a table.
  • run_query: runs one SELECT statement.

How queries are checked

Only a single SELECT is accepted. Words such as INSERT, UPDATE, DELETE, DROP or TRUNCATE are refused, only exposed tables can be read, blocked columns are never returned, and the query runs inside a read-only transaction with a time limit. Use a database user that can only read as a second layer.

External APIs

Lets the assistant call the endpoints you list on one REST API.

  • list_endpoints: lists the allowed endpoints.
  • call_endpoint: calls one allowed endpoint and returns the JSON, truncated if long.

Security

Only endpoints on the list can be called. Full URLs and redirects are refused, so the server cannot be pointed to another host. Blocked fields are removed from the response before the assistant sees it.

Accessibility

MCP Builder is designed so that a blind or low-vision developer can build a server without looking at the screen. This section explains how.

Spoken build report

When a build finishes, the service creates an audio report with an ElevenLabs voice in English, German or Spanish. It says the server name, how many files were created and which rules the server enforces. Choose the language in the voice language field.

Text version of every report

The same report is always written as text in a live region. A screen reader announces it even if audio is off or fails, and a braille display shows it.

Keyboard and labels

Every control can be reached with Tab. Dialogs move focus inside and return it when they close, Escape closes them, every field has a label, and status changes are announced. Automated checks with axe-core report zero violations on all pages in the three languages.

Automatic reading

The result page can play the report by itself. The option to read it aloud automatically can be turned off, for example if your screen reader already speaks every change.

Step by step with a screen reader

  1. Open the home page and jump by headings to the build section, for example with the H key in NVDA or JAWS.
  2. Fill the fields in order: server name, source type, what to expose, instructions and voice language. Each field has a label and a hint.
  3. Activate the build button. Progress and errors are announced, so there is no need to look for them.
  4. On the result page the report is announced and can be played. Then activate the download button for the .zip.
  5. Open README.md inside the .zip and follow it. It is plain text, with the exact commands.

Honest limits

Automated audits cover the structure and labels, but a complete test with real screen reader users has not been done yet. The audio depends on the ElevenLabs service being available; the text version does not.

Troubleshooting

The server does not appear in Claude Desktop

Check that the path points to dist/index.js and is absolute, and that you ran npm run build. Quit Claude Desktop completely, including the system tray, and open it again.

The server starts but says a variable is missing

Set the variable for your source in the env block of the client configuration: MCP_ALLOWED_DIRS, DATABASE_URL or API_BASE_URL.

A database query is refused

The server accepts one SELECT over the exposed tables. Add the table to resources in mcp.config.json, remove blocked columns from the query, then run npm run build.

The API call fails

Check API_BASE_URL and the token. The endpoint must be in the list, and it must be a path such as /products, not a full URL.

The voice report does not play

Read the text version shown on the page, which is always available. Audio needs the voice service to be reachable; try the button again after a moment.

Frequently asked questions

What does the downloaded file include?

A TypeScript MCP server (src/index.ts), package.json, tsconfig.json, mcp.config.json with your rules, .env.example and a README with the steps.

Is it compatible with Cursor and Windsurf?

Yes. The server speaks MCP over stdio, so any MCP client can run it with the same command.

Do I need Node.js installed?

Yes, Node.js 18 or newer, to build and run the generated server.

Does the AI write the code of my server?

No. The model only turns your instructions into a validated policy. The code comes from templates that are compiled and tested in the project's continuous integration.