mkdir my-mcp-server && cd my-mcp-server
npm init -y
npm install @modelcontextprotocol/sdk zod
npm install -D typescript @types/node tsx
npx tsc --init

// src/index.ts
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";
import fs from "fs/promises";
import path from "path";
 
const PROJECT_ROOT = process.env.PROJECT_ROOT || process.cwd();
 
const server = new McpServer({
  name: "project-filesystem",
  version: "1.0.0",
});
 
// Tool: List files in a directory
server.tool(
  "list_files",
  "List files and directories at the given path",
  {
    directoryPath: z
      .string()
      .describe("Relative path from project root")
      .default("."),
  },
  async ({ directoryPath }) => {
    const fullPath = path.resolve(PROJECT_ROOT, directoryPath);
 
    // Security: prevent directory traversal
    if (!fullPath.startsWith(PROJECT_ROOT)) {
      return {
        content: [
          {
            type: "text",
            text: "Error: Access denied. Path is outside project root.",
          },
        ],
      };
    }
 
    const entries = await fs.readdir(fullPath, { withFileTypes: true });
    const listing = entries
      .map((e) => `${e.isDirectory() ? "[DIR]" : "[FILE]"} ${e.name}`)
      .join("\n");
 
    return {
      content: [{ type: "text", text: listing }],
    };
  }
);
 
// Tool: Search for text across files
server.tool(
  "search_files",
  "Search for a text pattern across project files",
  {
    pattern: z.string().describe("Text or regex pattern to search for"),
    fileExtension: z
      .string()
      .describe("File extension filter, e.g. '.ts'")
      .optional(),
  },
  async ({ pattern, fileExtension }) => {
    const results: string[] = [];
    const regex = new RegExp(pattern, "gi");
 
    async function searchDir(dir: string) {
      const entries = await fs.readdir(dir, { withFileTypes: true });
      for (const entry of entries) {
        const fullPath = path.join(dir, entry.name);
        if (entry.name === "node_modules" || entry.name === ".git") continue;
        if (entry.isDirectory()) {
          await searchDir(fullPath);
        } else if (!fileExtension || entry.name.endsWith(fileExtension)) {
          try {
            const content = await fs.readFile(fullPath, "utf-8");
            const lines = content.split("\n");
            lines.forEach((line, idx) => {
              if (regex.test(line)) {
                const relPath = path.relative(PROJECT_ROOT, fullPath);
                results.push(`${relPath}:${idx + 1}: ${line.trim()}`);
              }
            });
          } catch {
            // Skip binary files
          }
        }
      }
    }
 
    await searchDir(PROJECT_ROOT);
    return {
      content: [
        {
          type: "text",
          text:
            results.length > 0
              ? results.slice(0, 50).join("\n")
              : "No matches found.",
        },
      ],
    };
  }
);
 
// Resource: Read a specific file
server.resource(
  "file",
  "file:///{filePath}",
  async (uri) => {
    const filePath = decodeURIComponent(uri.pathname.slice(1));
    const fullPath = path.resolve(PROJECT_ROOT, filePath);
 
    if (!fullPath.startsWith(PROJECT_ROOT)) {
      throw new Error("Access denied: path outside project root");
    }
 
    const content = await fs.readFile(fullPath, "utf-8");
    return {
      contents: [
        {
          uri: uri.href,
          mimeType: "text/plain",
          text: content,
        },
      ],
    };
  }
);
 
// Start the server with stdio transport
const transport = new StdioServerTransport();
await server.connect(transport);
console.error("Project filesystem MCP server running on stdio");

// src/database-tools.ts
import Database from "better-sqlite3";
import { z } from "zod";
import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
const ALLOWED_TABLES = ["users", "orders", "products", "analytics"];
 
export function registerDatabaseTools(
  server: McpServer,
  dbPath: string
) {
  const db = new Database(dbPath, { readonly: true });
 
  server.tool(
    "query_database",
    "Execute a read-only SQL query against the project database",
    {
      sql: z.string().describe("SQL SELECT query to execute"),
      params: z
        .array(z.union([z.string(), z.number()]))
        .describe("Query parameters for prepared statements")
        .optional(),
    },
    async ({ sql, params }) => {
      // Security: only allow SELECT statements
      const normalized = sql.trim().toUpperCase();
      if (!normalized.startsWith("SELECT")) {
        return {
          content: [
            {
              type: "text",
              text: "Error: Only SELECT queries are allowed.",
            },
          ],
        };
      }
 
      // Security: check for disallowed operations
      const forbidden = ["DROP", "DELETE", "INSERT", "UPDATE", "ALTER"];
      if (forbidden.some((op) => normalized.includes(op))) {
        return {
          content: [
            {
              type: "text",
              text: "Error: Query contains forbidden operations.",
            },
          ],
        };
      }
 
      try {
        const stmt = db.prepare(sql);
        const rows = params ? stmt.all(...params) : stmt.all();
 
        return {
          content: [
            {
              type: "text",
              text: JSON.stringify(rows.slice(0, 100), null, 2),
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text",
              text: `Query error: ${(error as Error).message}`,
            },
          ],
        };
      }
    }
  );
 
  // Resource: database schema
  server.resource(
    "schema",
    "db://schema",
    async () => {
      const tables = db
        .prepare(
          `SELECT name, sql FROM sqlite_master
           WHERE type='table' AND name IN (${ALLOWED_TABLES.map(() => "?").join(",")})
          `
        )
        .all(...ALLOWED_TABLES);
 
      return {
        contents: [
          {
            uri: "db://schema",
            mimeType: "application/json",
            text: JSON.stringify(tables, null, 2),
          },
        ],
      };
    }
  );
}

// ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)
// %APPDATA%\Claude\claude_desktop_config.json (Windows)
{
  "mcpServers": {
    "project-filesystem": {
      "command": "npx",
      "args": ["tsx", "/path/to/my-mcp-server/src/index.ts"],
      "env": {
        "PROJECT_ROOT": "/path/to/your/project"
      }
    }
  }
}

npx @modelcontextprotocol/inspector npx tsx src/index.ts

// src/__tests__/server.test.ts
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 
describe("Project Filesystem MCP Server", () => {
  let client: Client;
 
  beforeAll(async () => {
    const server = new McpServer({ name: "test", version: "1.0.0" });
    // ... register tools ...
 
    const [clientTransport, serverTransport] =
      InMemoryTransport.createLinkedPair();
    await server.connect(serverTransport);
 
    client = new Client({ name: "test-client", version: "1.0.0" });
    await client.connect(clientTransport);
  });
 
  test("list_files returns directory contents", async () => {
    const result = await client.callTool({
      name: "list_files",
      arguments: { directoryPath: "." },
    });
 
    expect(result.content).toBeDefined();
    expect(result.content[0].text).toContain("[FILE]");
  });
 
  test("blocks directory traversal attacks", async () => {
    const result = await client.callTool({
      name: "list_files",
      arguments: { directoryPath: "../../../etc" },
    });
 
    expect(result.content[0].text).toContain("Access denied");
  });
});