Build an MCP server by defining a small set of safe, clearly described actions, validating every request, and exposing them over the transport that fits how clients will connect. Use stdio when an AI client launches the server on the same machine; use Streamable HTTP over HTTPS for a remotely hosted service. For HTTP deployment, validate Host and Origin values, authenticate connections, and configure any reverse proxy correctly.
The MCP specification release dated July 28, 2026 describes a stateless request model: requests carry their own protocol metadata, so a properly implemented remote server does not need session stickiness. SDK APIs and protocol details can change, so check the SDK and specification version you intend to deploy before adopting a particular implementation.
What an MCP server does
An MCP server makes capabilities available to an AI client through a defined protocol. OpenAI’s MCP documentation describes four server capabilities: tools, resources, prompts, and instructions. A client discovers available capabilities; for a tool call, the model supplies arguments conforming to the tool’s schema; the server validates the arguments, authorizes the operation, executes it, and returns a result. The model can then use that result in its response.
Start from the task a user needs to accomplish, not from a list of endpoints in an existing system. A tool should represent one meaningful action, such as retrieving a record or creating a report. A resource is appropriate when the client needs access to information, while prompts and instructions can provide reusable guidance. Custom UI is optional: the essential work is exposing useful capabilities and returning understandable results.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Choose a transport before you design deployment
| Use case | Transport | What it means operationally |
|---|---|---|
| Local integration | stdio | The client launches the server as a subprocess and exchanges newline-delimited JSON-RPC messages over stdin and stdout. The process must keep stdout reserved for protocol messages; write logs to stderr. |
| Hosted integration | Streamable HTTP | The server exposes an HTTP endpoint, normally over stable HTTPS. The transport uses HTTP POST and can return JSON or an SSE stream. Configure authentication, Host and Origin validation, and any reverse proxy deliberately. |
Choose stdio when the client and server run together and the client can launch a local process. Choose Streamable HTTP when clients need to reach a hosted service. Do not select HTTP just because it sounds more scalable: it adds network security, TLS, proxy, and availability responsibilities. Conversely, a local stdio process is not a remote service that multiple users can access through a URL.
Build the server around explicit capabilities
1. Install the SDK for your language
The official TypeScript package is @modelcontextprotocol/sdk; the official Python package is mcp. Install the package for your chosen stack using that project’s package manager. The package names alone are not enough to guarantee a working server: method names and transport setup belong to the SDK version you install, so use its documentation for the exact version rather than copying a handler written for a different release.
2. Give the server a stable identity
Set a clear server name and version. These identify the service to clients and make changes easier to reason about. Add concise server instructions for rules that apply across capabilities, such as required call order or shared rate limits. Put critical constraints first; an instruction is useful only if a client can find and understand it.
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
3. Make each tool focused and self-describing
For every tool, define an action-oriented name, a human-readable title, a description that explains when it should be used, and an explicit input schema. Add an output schema where it helps clients interpret the result. Avoid a single broad tool that accepts arbitrary commands when several bounded actions would be clearer and safer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Tool descriptions are part of the interface, not decoration. State what the action does, what it does not do, and any consequential effects. Use safety annotations that accurately describe the operation; do not label a tool read-only if it changes data. The handler—not the model’s interpretation of the description—must enforce permissions and constraints.
4. Validate, authorize, execute, and return
Treat tool arguments as untrusted input even when the client says they match a schema. Validate values in the handler, authorize the requested action for the current caller, and apply least privilege to the credentials or services the handler uses. Do not allow a natural-language request or a syntactically valid argument to bypass access controls.
Rank #3
- Design for Raspberry Pi: Supports installation of 4 Raspberry Pis and 4 ssds, compatible with any 2.5” Solid State Drive (7mm/9mm) and Rpi 4B/3B+, and other B/B+ models.
- The SSD mounting bracket also has two holes reserved for the SD card extension adapter ASIN: B09CKRDFTH, which allows you to access the SD card from the front of the rack.
- Easy to Setup: Just use two included thumbscrews to mount the rackmount, which adopts a screw-in design, which helps you install and replace quickly and easily, no tools needed!
- Applications: This is a hardware solution to get ingenious use of the Raspberry Pi, with this kit and open source software OpenMediaVault, you can use the Pi as a NAS Server, Surveillance station, or even a Web server.
- Optional accessories: Single mounting bracket: B09GFQLPTY; Micro SD card extension adapter ASIN: B09CKRDFTH. I/O Panel: B09FXRQPFM
Return concise text or structured content that lets the model understand the result. Include enough context to distinguish success from failure, but avoid leaking credentials or unnecessary private data. Errors should be actionable where possible; internal traces and secrets belong in protected logs, not in tool output.
Connect a transport
For a local stdio server
- Configure the MCP client to launch the server as a subprocess using the runtime and entry point appropriate to your project.
- Use the SDK’s stdio transport for the installed version and exchange newline-delimited JSON-RPC messages through stdin and stdout.
- Keep stdout free of banners, debug messages, progress text, and other non-protocol output. Send diagnostic logging to stderr.
- Test launch, capability discovery, a valid tool call, invalid arguments, and a handler error from the actual client environment.
A server that prints an ordinary startup message to stdout can corrupt the protocol stream. If the client appears unable to parse responses, check output channels before changing the tool schema.
For a remote Streamable HTTP server
- Expose the Streamable HTTP endpoint using the SDK and request/response content types required by the protocol version you support.
- Serve it through stable HTTPS, with TLS termination either in the application stack or at a correctly configured reverse proxy.
- Require authentication and authorize operations in the handlers. Protocol access is not permission to access every underlying account or resource.
- Validate the HTTP
Originheader and allow only expected origins. This helps prevent DNS rebinding attacks. - Allowlist the deployed
Hostvalue. Keep Host and browser Origin allowlists conceptually separate; they answer different questions. - If a reverse proxy sits in front of the application, configure trusted forwarded headers correctly and ensure the app sees the intended external host and scheme.
- Exercise the deployed endpoint through the same network path clients will use, including authentication, proxy, and allowlist behavior.
MCP’s transport guidance recommends binding local servers to 127.0.0.1 and recommends authentication for all connections. For a public hosted service, do not treat a correct Origin check as a replacement for authentication, or authentication as a reason to accept arbitrary Host and Origin values.
Rank #4
- [ULTIMATE RASPBERRY PI 5 CASE & MINI PC] - Unlock the full potential of your Raspberry Pi 5 with the Pironman 5-MAX — the most advanced Raspberry Pi 5 Case for power users. This high-performance Raspberry Pi 5 Cooling Case features dual NVMe M.2 slots with RAID 0/1 support, AI accelerator compatibility ( e.g. Hailo-8l M.2 AI), a PCIe Gen2 switch, a PWM tower cooler + dual RGB fans and a smart OLED display. With its dual transparent panels and optimized cable management (including full-size HDMI), it’s the ideal Raspberry Pi 5 Enclosure for building a high-speed NAS, AI edge computing device, or Home Assistant hub. (Raspberry Pi NOT Included)
- [DUAL NVMe M.2 SLITS & NAS RAID SUPPORT] - Supercharge your storage with the best Raspberry Pi 5 NVMe Case solution. Featuring two expandable NVMe M.2 slots (2230-2280) powered by a built-in PCIe Gen2 switch, this Raspberry Pi 5 NAS Case supports RAID 0/1 for ultra-fast data setups. Whether you're using a high-speed NVMe SSD or a Hailo-8L AI accelerator, Pironman 5-MAX delivers the ultimate performance boost for advanced Raspberry Pi 5 AI applications and edge computing
- [ADVANCED COOLING SYSTEM] - Engineered for high-performance builds, Pironman 5-MAX features a powerful tower cooler, one PWM fan, and dual RGB fans for enhanced airflow. The dual transparent panel design improves ventilation while showcasing vibrant RGB lighting. Ideal for cooling both the Raspberry Pi 5 and dual NVMe SSDs or AI accelerators like Hailo-8L, it ensures stable operation under heavy workloads with low noise and long-term durability
- [SMART OLED DISPLAY WITH VIBRATION WAKE-UP] - Pironman 5-MAX features a 0.96" OLED screen that delivers real-time system insights including CPU usage, memory, temperature, IP address, and disk status. With customizable display options and auto sleep mode, the screen can be instantly reactivated by a light tap thanks to the built-in vibration sensor—offering a smarter and more interactive experience
- [ENHANCED FUNCTIONALITY] - Pironman 5-MAX empowers your Raspberry Pi 5 with advanced features like safe shutdown via a metal power button, customizable RGB lighting, dual full-size HDMI ports, vibration-triggered OLED wake-up, and an external GPIO extender. It also includes RTC battery support for timekeeping and seamless Home Assistant integration. With detailed guides, online tutorials, and full technical support from SunFounder, setup and use are effortless and worry-free
Deploy and scale a remote server
Put the HTTP application behind TLS termination or a reverse proxy, and configure the proxy/application boundary deliberately. A common deployment failure is a correct public hostname being rejected because the application’s Host allowlist does not match it. The Python deployment guide identifies HTTP 421, “Invalid Host header,” as a possible result of an incorrectly configured allowlist. Check the hostname the application actually receives, not just the URL in a browser.
For Python deployments, the deployment guide discusses running multiple ASGI workers when needed. The July 28, 2026 MCP specification describes requests as self-contained: a worker must not infer identity or capabilities from an earlier request, and cross-request state must use explicit identifiers. That means a compatible stateless HTTP implementation can route requests to any worker without MCP session stickiness. If your application has its own stateful workflow, represent that state explicitly and protect it; stateless protocol requests do not make underlying business state disappear.
Plan operational visibility around request outcomes, authorization failures, transport errors, and handler failures. Keep secrets out of logs, and ensure logs go somewhere operators can inspect without contaminating stdio protocol output. The source guidance establishes the transport and worker model, but it does not prescribe a universal hosting provider, worker count, uptime target, or monitoring stack; choose those based on the workload and deployment environment.
What changed in the July 28, 2026 MCP specification
The official release article dated July 28, 2026 identifies the 2026-07-28 specification as current at that time. It describes a stateless core, Multi Round-Trip Requests (MRTR), Mcp-Method and Mcp-Name routing headers, cache hints on list responses, authorization hardening, and a formal extension framework. Treat this as a dated version statement, not a guarantee that later releases have not changed the protocol.
- Stateless requests: requests carry protocol version, client identity, and capabilities in
_meta. The release removes theinitialize/initializedexchange and theMcp-Session-Idprotocol session header. - Optional discovery: capability discovery can use
server/discover; clients do not have to make that call to establish a session. - MRTR: a tool can return
input_required, after which the client retries withinputResponses. The release presents this as a replacement for server-initiated interactions that required a held-open stream. - Legacy HTTP+SSE: the release formally deprecates it with a minimum twelve-month deprecation window. The window is the minimum stated in that release; check the current specification and the compatibility needs of your clients before removing support.
The release article also reports ecosystem figures from MCP maintainers: close to half-a-billion SDK downloads per month in 2026, and more than one billion total downloads each for the TypeScript and Python SDKs. These are maintainer-reported ecosystem figures, not independent audited measurements, and they do not establish adoption or performance for any particular server.
Security and reliability checklist
- Define explicit schemas and validate arguments again inside each handler.
- Authorize every operation and use least-privilege credentials.
- For HTTP, authenticate connections and enforce Host and Origin allowlists.
- Use HTTPS for hosted endpoints and configure trusted forwarded headers at the proxy boundary.
- For stdio, reserve stdout for MCP messages and direct logs to stderr.
- Represent any state needed across requests using explicit identifiers rather than assuming a request will reach the same worker.
- Test malformed input, denied permissions, handler failures, proxy behavior, and the exact client versions you intend to support.
Troubleshooting common MCP server problems
| Symptom | Likely cause | What to check |
|---|---|---|
| Local client cannot parse server output | Non-MCP text was written to stdout. | Remove startup banners and debug output from stdout; send logs to stderr and retry the client launch. |
| HTTP 421 “Invalid Host header” | The application Host allowlist does not match the hostname received by the app. | Compare the deployed hostname with the app’s Host allowlist and check what the reverse proxy forwards. |
| A browser-originated request is rejected | The Origin is not allowlisted, or the Host and Origin controls have been confused. | Check the browser Origin against its own allowlist and the request Host against the Host allowlist; do not collapse them into one setting. |
| Tool calls fail despite schema-valid arguments | Schema validity does not guarantee authorization or successful execution. | Inspect handler validation, caller permissions, and the underlying operation’s result. Return a useful error without exposing secrets. |
| Requests behave differently across workers | The application may be relying on implicit process-local state. | Under the 2026-07-28 stateless model, make cross-request state explicit and ensure each worker can handle an independent request. |
| Older client does not interoperate | The client may implement a different protocol generation or rely on legacy HTTP+SSE. | Identify the client’s supported protocol and transport, then decide whether compatibility is required. Check the current deprecation status rather than assuming the 2026 minimum window is still open. |
Or skip the browser setup
If the MCP workflow you are building needs a website screenshot, ScreenshotNeo offers a screenshot API and MCP server. The call below requests a WebP capture of a page:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for API details. Cookie banners and consent prompts, newsletter popups, and chat widgets are removed before the capture; those steps can be turned off. Bot checks and CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and responses identify the page verdict and billing status in headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf for Claude, Cursor, and other MCP clients. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. These are optional screenshot capabilities, not a replacement for designing and securing your own MCP server. Sign up free for 1,000 screenshots a month, with no card required.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFrequently Asked Questions
Can an MCP server return a custom interface?
Yes, but custom UI is optional. A server can return concise text or structured content for the model and client to use.
Which SDK package should I start with?
The official package names in the documented stacks are @modelcontextprotocol/sdk for TypeScript and mcp for Python. Use the documentation matching the package version you install.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
