Build MCP Server with Node.js - Step by Step
A full tutorial for building MCP servers in Node.js with a clean tool structure.
Key Takeaways
- Node.js is a fast way to prototype MCP servers.
- Use your OpenAPI spec to generate tools instead of hand-coding.
- Claude Desktop connects through a simple MCP config file.
- Keep auth and logging configured before production use.
Project setup
This guide walks through building a simple Node.js MCP server, then connecting it to Claude Desktop. You can start with a generated MCP server or build a thin wrapper if you already have an OpenAPI spec.
- Node.js 18 or later.
- An OpenAPI spec for your API.
- LegacyAI CLI or dashboard access.
Scaffold the server
If you are using LegacyAI generation, the scaffold includes tool schemas, routing, and a runtime that forwards requests to your API. If you are building manually, keep the server thin and focused on validation and forwarding rather than business logic.
Store generated code in a dedicated folder so you can regenerate without overwriting custom changes. Keep any customization in a separate wrapper module.
Step 1: Generate tools from OpenAPI
Use LegacyAI to generate a Node.js MCP server from your OpenAPI file. This gives you a tool catalog and validated schemas out of the box.
Step 2: Wire environment variables
Store API base URLs and tokens in environment variables so you do not hardcode secrets.
export API_BASE_URL="https://api.yourcompany.com"
export API_TOKEN="your-token"Step 3: Start the MCP server
Run the generated server locally. It will expose a tool catalog for Claude Desktop and forward calls to your API.
node legacyai-mcp-server.jsStep 3.5: Add validation and error handling
Ensure every tool call validates required fields and fails fast when inputs are incomplete. Consistent error responses help the model recover and choose the right next action.
LegacyAI includes validation by default, but if you add custom tools, keep error messages short and structured so the agent can respond appropriately.
Step 4: Configure Claude Desktop
Add the MCP server to your Claude Desktop config so tools appear automatically.
{
"mcpServers": [
{
"name": "LegacyAI Node",
"command": "node",
"args": ["./legacyai-mcp-server.js"],
"env": {
"API_BASE_URL": "https://api.yourcompany.com",
"API_TOKEN": "${API_TOKEN}"
}
}
]
}Step 5: Validate tool calls
Ask Claude to call a read-only endpoint first. Confirm the response, then enable write tools if needed.
Local testing checklist
- Run a tool call with missing parameters to confirm validation.
- Verify auth headers are injected correctly.
- Simulate a 500 response and ensure the error is handled.
- Inspect logs for full request and response traces.
Recommended structure
- Keep tool schemas in a generated folder so regeneration is safe.
- Add middleware for logging and request tracing.
- Use a separate token per environment.
Deployment checklist
- Run the MCP server as a separate service with health checks.
- Secure secrets with a vault or environment manager.
- Enable rate limits and request timeouts.
- Set up alerts for tool call failures.
FAQ
Do I need to hand-code tools?
No. LegacyAI can generate tools from OpenAPI, which is faster and less error-prone than manual schemas.
Can I use Express with the MCP server?
Yes. The MCP server can call any REST API, including Express apps, as long as the OpenAPI spec is valid.
How do I secure the server?
Use environment variables for tokens, enable read-only defaults, and scope access to only the tools you need.
Where do logs go?
Logs are emitted by the MCP server. Forward them to your observability stack for auditing.
How do I update tools?
Regenerate from the latest OpenAPI spec or enable dynamic sync in LegacyAI.
Related articles
Tutorials
How to Connect FastAPI to Claude Desktop in 5 Minutes
A step-by-step guide to generate MCP tools from FastAPI and register them in Claude Desktop.
MCP
MCP Architecture Explained for Developers
A detailed breakdown of MCP components and how Claude calls tools end-to-end.
Security
MCP Server Security Best Practices
Protect tools with read-only mode, scoped auth, and strong environment isolation.