mcp-typescript-starter

The server uses Express for HTTP transport and handles session IDs from request headers, which requires standard web application security practices. Input validation is handled by Zod schemas for tools and prompts, which helps mitigate common injection vulnerabilities. The 'ask_llm' tool delegates LLM interaction to the client, so its security relies on the client's configuration. No direct 'eval' or unvalidated file system operations are evident. Overall, the starter template follows good practices for a server interacting with AI clients, but deployment in production would require further security hardening typical for any web application.