mcp-server-template-nodejs-19

The server uses Express.js and the Model Context Protocol SDK. Input validation for tools and prompts is handled via Zod schemas, which is a good practice to prevent common injection vulnerabilities. Environment variables are loaded using `dotenv`, promoting separation of configuration. No hardcoded secrets, direct `eval` of user input, or obvious insecure patterns were found in the provided source code. The main `/mcp` endpoint explicitly disallows GET and DELETE requests, focusing on POST for protocol communication. This template provides a good, secure starting point, but custom logic added by developers will require careful security review.