Tutorial: ship an MCP server your model can actually use

Before you start — about 45 minutes · @modelcontextprotocol/sdk · Zod · stdio transport

We rebuilt MCP servers three times before it held. The version below is the one that survived a bad Tuesday and a worse Friday.

Step 1 — Decide what "working" means

Before touching code, write down three numbers: worst acceptable latency, cost per request, and what should happen when the upstream is unavailable. Everything after this is implementation.

Step 2 — Wire @modelcontextprotocol/sdk

The whole flow is one path. No special branches for "large" inputs — express those as different limits, not different code.

server.tool(
  "search_invoices",
  "Find invoices for a customer. Use when the user asks about billing history.",
  { customerId: z.string(), since: z.string().optional() },
  async ({ customerId, since }) => ({
    content: [{ type: "text", text: JSON.stringify(await findInvoices(customerId, since)) }],
  }),
);

Why this works

The limit is enforced before the expensive call, not after it. Reserving budget up front means a burst degrades the caller that caused it instead of everyone downstream.

Step 3 — Guard the failure path

one mega-tool with a 20-field schema is worse than five small, obvious tools

Write that guard before you write the feature. It costs an hour and saves a postmortem.

Step 4 — Verify it

npx @modelcontextprotocol/inspector node dist/server.js   # then list tools

• Lower the limit and confirm the command fails loudly
• Kill the upstream and confirm you get a typed error, not a timeout
• Check the metric you emit per outcome: ok, throttled, upstream_error

Tuning knobs

Knob	Default	What we run	Why
concurrency	8	24	Most of the wait is network, not compute
retry budget	infinite	2, with jitter	Unbounded retries turn an outage into an avalanche
timeout	30s	8s, inherited from the caller	Nobody waits 30s for a chat reply

None of this was clever. It was just the work nobody wanted to do first.