The TypeScript framework for secure, MCP 2.0-native servers.
Vercel adapter for MCP Fusion. Deploy your MCP server as a Next.js App Router route handler or standalone Vercel Function — Edge Runtime or Node.js, stateless JSON-RPC, zero config.
MCP Fusion is a TypeScript framework that enforces security at the architectural level of every MCP server. Raw data never reaches the LLM without passing through a typed egress firewall. Tools are physically removed from the agent's namespace when the workflow state forbids them. Every behavioral surface is hashed, locked, and auditable in version control.
The framework ships with a SKILL.md — a machine-readable architectural contract. AI coding agents read the Skill and produce correct, governed servers on the first pass.
MCP 2.0 (2026-07-28) — Full Compliance
MCP Fusion is 100% compatible with MCP 2.0 (protocol revision 2026-07-28). Every feature the spec defines is implemented or handled via the MCP SDK v2. Every feature the spec deprecates is deprecated in MCP Fusion.
Implemented MCP 2.0 Features
Feature
Status
How
Stateless protocol
✅
transport: 'stateless' — per-request serving, no sessions, no initialize handshake, Mcp-Method/Mcp-Name header routing
Multi Round-Trip Requests (MRTR)
✅
requireInput() + readInput() — native InputRequiredResult / resultType: "input_required" model
Request State Sealing
✅
requestStateKey — HMAC-SHA256 sealed state for multi-round elicitation (SEP-2322)
Structured Content
✅
successStructured() + structuredContent field on ToolResponse
Output Schema
✅
outputSchema in compileToolDefinition() wire format
List Caching
✅
ttlMs / cacheScope directly on result root (SEP-2549) — public / private scope
Pagination
✅
cursor / nextCursor on prompts/list (extensible to all list ops)
server/discover
✅
Handled by MCP SDK v2 Server
resultType
✅
Handled by MCP SDK v2 Server ("complete" / "input_required")
Per-request _meta
✅
io.modelcontextprotocol/* fields handled by MCP SDK v2
resources/templates/list
✅
URI template resources with pagination
subscriptions/listen
✅
MCP 2.0 stream-based subscription pattern with filter + acknowledgment
x-mcp-header
✅
.withHeaderParam() on FluentToolBuilder — parameter mirroring to HTTP headers
Defaults to 2026-07-28 in all server metadata (Server Card, introspection)
Deprecated Features (mirrored from MCP 2.0)
All features deprecated by MCP 2.0 (SEP-2577 / SEP-2596) are deprecated in MCP Fusion with @deprecated markers and migration guidance. They remain functional during the deprecation window (earliest removal: 2027-07-28).
Deprecated Feature
Migration Path
Roots
Pass directories/files via tool parameters, resource URIs, or server configuration
Sampling
Integrate directly with LLM provider APIs
Logging (notifications/message)
Log to stderr for stdio; use OpenTelemetry (TelemetrySink / DebugObserver)
Dynamic Client Registration
Client ID Metadata Documents
HTTP+SSE transport
Streamable HTTP (transport: 'http') or stateless (transport: 'stateless')
MCP Fusion includes a SKILL.md that encodes the entire MVA architecture, security patterns, and governance rules into a format AI coding agents consume directly.
Open your project in Cursor, Claude Code, GitHub Copilot, or Windsurf and describe what you need:
"Build an MCP server for patient records with Prisma. Redact SSN and diagnosis from LLM output. Gate discharge tools until attending physician signs off."
The agent reads the Skill. It produces defineModel() declarations with m.hidden() for sensitive fields, definePresenter() with .redactPII(['*.ssn', '*.diagnosis']) for DLP compliance, FSM state gating via .bindState() for workflow enforcement, and file-based routing under src/tools/. You review the PR.
The Skill is not documentation. It is the security contract. Every server the AI produces inherits the governance stack because the Skill encodes Presenters, state machines, and lockfile generation as mandatory structural patterns.
📄 SKILL.md · llms.txt(complete API reference for LLM consumption)
Security Architecture
Egress Firewall — Presenter
The Presenter validates every response through a Zod schema compiled from defineModel(). Undeclared fields are stripped in RAM before serialization. PII is redacted via V8-optimized fast-redact compiled functions. Rules travel with data, not in the system prompt. The Late Guillotine pattern applies redaction after UI blocks render — charts and suggestions always see full data, the wire never does.
The Presenter also runs a PromptFirewall — an LLM-as-Judge that evaluates dynamically generated system rules for prompt injection before they reach the agent. Fail-closed by default.
State Gate — FSM
Tools bound to FSM states are physically removed from tools/list when the current state does not match. The LLM cannot call what does not exist in its namespace. Powered by XState v5 with manual fallback when XState is not installed.
Serverless-compatible: FsmStateStore persists state to Redis/KV across request boundaries. Each request gets an isolated gate.clone().
Governance Stack
Eight introspection modules that make behavioral changes visible and auditable:
Module
What it does
ToolContract
Materializes the complete behavioral surface of each tool
BehaviorDigest
SHA-256 hash of the behavioral surface
CapabilityLockfile
mcpfusion.lock — git-diffable behavioral snapshot, CI gate via fusion lock --check
CryptoAttestation
HMAC-SHA256 runtime verification — fail-fast if behavioral digest drifts
ContractDiff
Per-field diff between lockfile versions
EntitlementScanner
Static analysis of handler source for I/O capabilities (fs, network, subprocess, eval) with evasion heuristics
SemanticProbe
LLM-as-Judge for detecting semantic drift in handler output
TokenEconomics
Context window inflation risk profiling
Sandbox
SandboxEngine executes LLM-provided JavaScript in a sealed V8 isolate. No process, require, fs, or network access. One isolate per engine, fresh empty context per execution. Memory-limited, timeout-enforced, output-capped, abort-signal-compatible.
Ship Your MCP Server to the Same Infrastructure — Free
Your server runs alongside Salesforce, Stripe, OpenAI, and 4,000+ others. V8 sandbox isolation, DLP, audit trails, and kill switch — all included. No credit card required.
Industries — Hospitality, Healthcare, Energy & Commodities, Construction, Real Estate, Agriculture, Wine & Spirits, Education, Logistics, Insurance, Fitness, Travel.
World Data — Economy & Finance, Central Banks, Securities & Markets, Weather & Climate, Demographics, Space & Astronomy, Health & Medicine, Environment, Energy, Food & Nutrition, Government, Trade & Labor.
Every server runs inside V8 isolate sandboxes on AWS. Ed25519 signed audit chains. Sub-40ms cold starts. DLP redaction on every response. Kill switch for instant shutdown. Every tool call logged and auditable.
Vercel adapter for MCP Fusion. Deploy your MCP server as a Next.js App Router route handler or standalone Vercel Function — Edge Runtime or Node.js, stateless JSON-RPC, zero config.
Belum ada daftar tool. Server remote mendapatkannya setelah pemeriksaan kesehatan pertama.
FAQ
Pertanyaan
Bagaimana cara menginstal @mcpfusion/vercel?
Salin konfigurasi stdio untuk Cursor, Claude Desktop, Claude Code, atau VS Code di halaman ini. Konfigurasi ini memakai instalasi dari penerbit, bukan proxy PlugMCP.
Apakah @mcpfusion/vercel memerlukan kunci API?
Tidak ada variabel lingkungan wajib yang tercantum di catatan ini.
Transport apa yang digunakan @mcpfusion/vercel?
@mcpfusion/vercel berjalan secara lokal melalui stdio.
Kapan @mcpfusion/vercel terakhir diperiksa?
Terakhir diperiksa 2026-11-10. Vercel adapter for MCP Fusion. Deploy your MCP server as a Next.js App Router route handler or standalone Vercel Function — Edge Runtime or Node.js, stateless JSON-RPC, zero config.