MCP Fundamentals: Building a TypeScript MCP Server with Tools, Resources, Prompts, Sampling, and…

A developer built a TypeScript Model Context Protocol (MCP) server for customer support that exposes all major MCP primitives but deliberately includes critical security flaws such as a shared API key, god-mode database access, weak input validation, raw PII exposure, and non-idempotent refund actions, highlighting the gap between a working demo and production readiness.

Member-only story MCP Fundamentals: Building a TypeScript MCP Server with Tools, Resources, Prompts, Sampling, and Roots A hands-on TypeScript guide to building a complete MCP customer-support server, exposing every protocol primitive, and learning why “it works on my laptop” is nowhere near production-ready. The scariest part of this MCP server is not that it breaks — it is that it works perfectly. It can search tickets, fetch customer records, summarize threads, and issue refunds, while quietly carrying the exact security flaws that would make a production review stop cold. Article Summary:… This article introduces Part 1 of the “MCP in Production” series by building a complete Model Context Protocol server in TypeScript for a customer-support and CRM use case. The server demonstrates every major MCP primitive — tools, resources, prompts, sampling, elicitation, and roots — while using stdio transport and the MCP TypeScript SDK. Rather than presenting the demo as production-ready, the article makes its flaws explicit: a shared API key, a god-mode database connection, weak input validation, raw PII exposure, and refund actions with no guardrails or idempotency. By walking through both the working implementation and its failure modes, the