Configuration

mcp({
  server: {
    name: 'example-api',
    version: '1.0.0',
    title: 'Example API',
    instructions: 'Prefer read-only tools unless mutation is requested.'
  },
  path: '/mcp',
  allowedRoutes: '*',
  excludedRoutes: ['/admin/*'],
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
  defaultRouteKind: 'tool',
  onNameCollision: 'error',
  inputMode: 'envelope',
  includeHiddenRoutes: false,
  headers: {
    passThroughFromMcpRequest: ['authorization', 'cookie', 'x-api-key'],
    allowFromToolInput: []
  },
  marshal: {
    maxTextBytes: 262144,
    maxStructuredBytes: 262144,
    includeHttpMetadata: true,
    binary: 'error'
  },
  transport: {
    validateOrigin: true,
    allowedOrigins: [],
    enableGetSse: false,
    enableDeleteSession: false,
    protocolVersion: '2025-11-25',
    protocolVersions: ['2026-07-28', '2025-11-25']
  },
  core: {
    maxToolInputElements: 10000,
    cache: {
      default: { cacheScope: 'private', ttlMs: 0 }
    }
  },
  diagnostics: {
    failOnMissingSchema: false
  }
})

Core optionsCopy Anchor Link

Schema diagnosticsCopy Anchor Link

Set diagnostics.failOnMissingSchema to true when every exposed route must provide an inferable input schema. mapJsonSchema(schema, context) can normalize schemas for a specific MCP client after route inference or explicit schema selection.

Modern protocol optionsCopy Anchor Link

2026-07-28 is the default protocol. transport.protocolVersion remains the legacy initialize response value. Restrict transport.protocolVersions to ['2025-11-25'] only for a legacy-only endpoint.

core.continuation configures MRTR state signing and optional durable single-use consumption. core.pagination configures signed cursors and page size. core.cache controls cache hints. core.subscriptions declares notification support and supplies the application provider. These features remain opt-in, except private zero-TTL cache hints.

core.maxToolInputElements optionally counts nested object members and array elements, then rejects oversized tool input before route dispatch or task creation. It must be a positive safe integer and is unlimited when omitted.

transport.allowedOrigins accepts exact serialized origins. It also accepts explicit non-HTTP scheme patterns such as chrome-extension://*. Global, HTTP, HTTPS, malformed, credentialed, and opaque origin patterns are rejected during configuration.

Per-route marshalingCopy Anchor Link

A route-level mcp.marshal object overrides the plugin defaults for that route. This lets a deliberate binary or large-text tool opt in without broadening every tool.

See the source-generated McpPluginOptions reference for every field and nested type.