
Security News
TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem
TeamPCP is targeting security tools across the OSS ecosystem, turning scanners and CI pipelines into infostealers to access enterprise secrets.
@smithery/sdk
Advanced tools
TypeScript types for building MCP servers on the Smithery hosted runtime.
Docs: https://smithery.ai/docs/build
npm install @smithery/sdk
The SDK provides types for the Smithery runtime context that your MCP server receives when deployed.
import type {
ServerModule,
ServerContext,
Session,
} from "@smithery/sdk"
import { z } from "zod"
// Define your configuration schema
export const configSchema = z.object({
apiKey: z.string(),
})
// Create your server
export default const createServer = async (context: ServerContext<z.infer<typeof configSchema>>) => {
const { config, env } = context
// Access user configuration
console.log(config.apiKey)
// Access environment variables
console.log(env.MY_SECRET)
// For stateful servers, access session storage
if ("session" in context) {
await context.session.set("key", "value")
const value = await context.session.get("key")
}
// Return your MCP server instance
return new Server({ name: "my-server", version: "1.0.0" }, { capabilities: {} })
}
ServerContext<TConfig>The context object passed to your server factory function:
config: TConfig - User-provided configuration (validated against your configSchema)env: Record<string, string | undefined> - Environment variablessession?: Session - Session storage (only for stateful servers)SessionKey-value storage scoped to the user session:
get<T>(key: string): Promise<T | undefined>set(key: string, value: unknown): Promise<void>delete(key: string): Promise<void>ServerModule<TConfig>The expected exports from your server entry point:
default: CreateServerFn<TConfig> - Factory function that creates your MCP serverconfigSchema?: z.ZodSchema<TConfig> - Zod schema for configuration validationcreateSandboxServer?: CreateSandboxServerFn - Optional function for deployment scanningstateful?: boolean - Whether the server maintains state between requests (default: false)For complete documentation, see:
MIT
FAQs
SDK to develop with Smithery
The npm package @smithery/sdk receives a total of 6,559 weekly downloads. As such, @smithery/sdk popularity was classified as popular.
We found that @smithery/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP is targeting security tools across the OSS ecosystem, turning scanners and CI pipelines into infostealers to access enterprise secrets.

Security News
TypeScript 6.0 introduces new standard APIs, modern default settings, and deprecations as it prepares projects for the upcoming TypeScript 7.0 release.

Security News
/Research
Newly published Trivy Docker images (0.69.4, 0.69.5, and 0.69.6) were found to contain infostealer IOCs and were pushed to Docker Hub without corresponding GitHub releases.