high-performance-mcp-server
Advanced tools
High-performance, modular MCP v2 server with safe-by-default profiles, Streamable HTTP, stdio, worker threads, metrics, and LRU caching
A high-performance, modular Model Context Protocol (MCP) server built with TypeScript and the modern MCP v2 SDK (@modelcontextprotocol/server). Features safe-by-default security profiles, profile-aware server instructions, modular MCP prompts, allowlisted workspace inspection with opt-in guarded text mutation, SSRF-hardened network access, Streamable HTTP, Stdio transport, reusable worker thread pooling, production LRU caching with single-flight stampede protection, and structured telemetry.
[!NOTE] Status:
0.5.0Public Preview. This package provides safe-by-default MCP tools, read-only workspace inspection, opt-in guarded workspace mutation and network access, worker request cancellation, normalized progress reporting, and high-performance worker execution. Requires Node.js >= 22.0.0.Compatibility: The new v0.5 options are additive. Existing callers that omit
contextLines,maxDepth,createParents, andfetch_url.methodretain their established default semantics. v0.5 also includes an intentional create-mode publication hardening: filesystems that cannot provide hard-link no-clobber publication now fail closed instead of using the previous check-then-rename fallback.
@modelcontextprotocol/server with standard JSON Schema draft 2020-12 validation and full 2026-07-28 protocol support.stdio) or modern Streamable HTTP (node:http + /mcp).explore_workspace, find_and_explain, review_file, trace_symbol) exposed exclusively in workspace, workspace_write, and all profiles.rootId values for every workspace prompt and the workspace resource template without enumerating files or exposing host paths.safe profile exposes zero filesystem, network, or hardware inspection. Filesystem mutation and outbound network access require explicit workspace_write/network (or all) opt-in.root-1, root-2), bounded text operations, and binary file protection without exposing host absolute paths to clients or models. The workspace profile remains read-only; guarded mutation is isolated to workspace_write and all.search_files, search_text) with ignored directory defaults, bounded concurrency (SEARCH_CONCURRENCY = 8), coordinate mapping, optional bounded context lines (contextLines: 0..10), and client cancellation.list_directory with maxDepth: 1..5) using breadth-first search and normalized relative paths up to a global 500-entry cap.edit_text_file) and atomic no-clobber creation (write_text_file) with optional safe segment-by-segment parent creation (createParents), optimistic SHA-256 concurrency control, and optional client confirmation.fetch_url) protected by multi-layered SSRF defenses, DNS rebinding mitigation, port allowlists, conditional response caching, and lightweight HTTP HEAD metadata inspection.AbortSignal cancellation support, and prompt hard termination for running synchronous compute.stderr.Add to your MCP configuration (e.g. claude_desktop_config.json):
{
"mcpServers": {
"high-performance-mcp": {
"command": "npx",
"args": [
"-y",
"high-performance-mcp-server"
]
}
}
}
{
"mcpServers": {
"workspace-mcp": {
"command": "npx",
"args": [
"-y",
"high-performance-mcp-server",
"--profile=workspace",
"--root=/path/to/project"
]
}
}
}
# Clone and build
git clone https://github.com/AnIayana/high-performance-mcp-server.git
cd high-performance-mcp-server
npm install
npm run build
# Run default safe profile
node dist/index.js
# Run workspace profile with allowlisted root
node dist/index.js --profile=workspace --root=.
To protect host machines and prevent unintended resource consumption or metadata leakage, tools, resources, instructions, and prompts are categorized into security profiles:
| Profile | Included Categories | Exposed Tools | Prompts | Use Case |
|---|---|---|---|---|
safe (Default) | safe | echo, ping | (none) | Zero host inspection, zero filesystem access, zero mutation. Safe for public exposure. |
workspace | safe, workspace | echo, ping, workspace_roots, list_directory, file_info, read_text_file, search_files, search_text | explore_workspace, find_and_explain, review_file, trace_symbol | Read-only file and directory inspection strictly limited to allowlisted --root directories. |
workspace_write | safe, workspace, workspace_write | echo, ping, workspace_roots, list_directory, file_info, read_text_file, search_files, search_text, write_text_file, edit_text_file | explore_workspace, find_and_explain, review_file, trace_symbol | Guarded workspace text file creation, overwriting, and transactional editing with optimistic concurrency. |
network | safe, network | echo, ping, fetch_url | (none) | SSRF-hardened, read-only HTTP/HTTPS web fetching for public resources. |
diagnostics | safe, diagnostics | echo, ping, cache_stats, server_metrics, system_stats, worker_pool_stats | (none) | Process and system observability for monitoring health and event-loop lag. |
benchmark | safe, benchmark | echo, ping, cached_prime_count, heavy_compute_main, heavy_compute_worker | (none) | CPU-intensive prime calculation benchmarks and worker pool tests. |
admin | safe, diagnostics, admin | echo, ping, cache_stats, server_metrics, system_stats, worker_pool_stats, reset_cache, reset_metrics | (none) | Observability with administrative runtime state mutation (purging cache, resetting metrics). |
all | safe, workspace, workspace_write, network, diagnostics, benchmark, admin | All 20 registered tools | All 4 workspace prompts | Complete tool and prompt catalog. |
When an MCP client connects, the server delivers concise, profile-tailored instructions via the MCP protocol:
safe: Instructs the model that filesystem and hardware inspection are not available.workspace: Outlines the recommended investigation sequence (workspace_roots -> search_files / search_text -> file_info -> read_text_file), reinforces read-only constraints, and emphasizes root-relative path usage.diagnostics & benchmark: Guides observational metrics interpretation and warns against unnecessary CPU-intensive compute invocations.admin: Notes that mutation operations affect only process-local caches and telemetry state.When running in workspace, workspace_write, or all profile, the server exposes modular prompts that provide structured workflows for common engineering tasks:
| Prompt | Arguments | Purpose |
|---|---|---|
explore_workspace | rootId (required), goal (optional) | Guides the model through structured exploration of an allowlisted workspace root using search and file inspection. |
find_and_explain | rootId (required), query (required) | Locates relevant code or configuration using literal text search and reads defining files to produce an explanation. |
review_file | rootId (required), path (required), focus (optional) | Formulates a structured, read-only review of a specified text file within the workspace. |
trace_symbol | rootId (required), symbol (required) | Traces declarations, references, and usage sites of a symbol across the workspace. |
[!NOTE] Prompt arguments are treated as bounded task data and escaped before being inserted into reusable MCP prompt templates. Prompts do not execute direct filesystem I/O themselves; actual file reading and searching is performed by the model using standard MCP tools and resources under strict root allowlist controls.
Workspace-capable profiles advertise MCP's completions capability. Clients can request completion/complete suggestions for the rootId argument on all four workspace prompts and for the rootId variable in workspace:///{rootId}/{+path}. Suggestions contain only configured logical IDs such as root-1; they never enumerate files or reveal root names and absolute host paths. Profiles without workspace authority do not advertise completion support.
Filesystem access is disabled by default. To enable read-only workspace access, explicitly specify --profile=workspace and at least one allowlisted --root directory. The broader all profile also includes these tools but additionally enables mutation, network, diagnostics, benchmark, and admin capabilities.
# POSIX / macOS / Linux
npx high-performance-mcp-server --profile=workspace --root=/home/user/my-project
# Windows
npx high-performance-mcp-server --profile=workspace --root="C:\Projects\app"
# Multiple roots
npx high-performance-mcp-server --profile=workspace --root=./packages/core --root=./packages/cli
workspace_roots tool returns logical root identifiers (id: "root-1", `name: "my-project"), and workspace resource URIs use those identifiers rather than absolute host paths:
{
"roots": [
{
"id": "root-1",
"name": "my-project"
}
]
}
--root directories can be accessed. Maximum 16 unique roots allowed (and max 64 raw paths before deduplication).workspace profile exposes no mutation tools. Guarded text mutation is available only through the explicit workspace_write and all profiles; no MCP tools expose deletion, arbitrary rename, directory creation, permission changes, or command execution.fs.realpath and strictly verified to never escape root boundaries.MAX_TEXT_READ_BYTES).\0) are rejected by read_text_file to prevent context pollution.workspace:///{rootId}/{+path} (workspace_text_file) template. Discover logical roots with workspace_roots; resources/list does not recursively enumerate files.The workspace profile provides bounded file and directory inspection tools:
list_directory:
truncated: true when exceeded).maxDepth parameter (1..5, default: 1). When maxDepth > 1, directory trees are traversed breadth-first (BFS) up to the specified depth and returned as a flat list.relativePath with forward-slash separators (/), while name preserves the entry's basename.{
"name": "list_directory",
"arguments": {
"rootId": "root-1",
"path": "src",
"maxDepth": 2
}
}
file_info: Retrieves size, timestamps, and file type attributes for a relative path within an allowlisted root.
read_text_file: Reads UTF-8 file contents up to the configured byte limit (default 256 KiB, max 1 MiB). Files containing NUL bytes are rejected.
The workspace profile provides bounded, read-only search tools:
search_files:
file, directory, all), case sensitivity, and start path..git, node_modules, .next, dist, build, target, etc.) by default. Pass includeIgnored: true to search them.notifications/progress) when a client progressToken is provided.search_text:
extensions: [".ts", ".md"] or extensions: ["ts", "md"]).MAX_SEARCH_FILE_BYTES).maxResults: 100 [max 500], maxFiles: 5000 [max 50000], timeoutMs: 10000 [max 30000]).AbortSignal.notifications/progress) when requested via progressToken. Zero progress overhead when unrequested.contextLines parameter (0..10, default: 0). When contextLines > 0, matching occurrences include contextBefore and contextAfter as bounded string arrays of surrounding lines. When omitted or 0, context fields are omitted. Unbounded context is not supported.{
"name": "search_text",
"arguments": {
"rootId": "root-1",
"query": "SEARCH_CONCURRENCY",
"path": "src",
"contextLines": 2
}
}
workspace_write)Workspace mutation is disabled by default. The standard workspace profile remains strictly read-only. To enable guarded text write and transactional editing capabilities, explicitly select the workspace_write profile (or all) along with at least one allowlisted --root:
# Start server with workspace write capabilities
npx high-performance-mcp-server --profile=workspace_write --root=./project --workspace-max-write-bytes=2097152
[!WARNING] When running with
--profile=allor--profile=workspace_write, connected clients and LLMs have guarded text write and edit capabilities within configured--rootdirectories. The standard--profile=workspaceremains strictly read-only.
write_text_file:
mode: "create"): Creates a new UTF-8 text file inside an allowlisted workspace root. Enforces atomic no-clobber semantics via fs.link; fails safely if the file already exists (already_exists) or if the parent directory does not exist (missing_parent). Providing expectedSha256 in create mode is forbidden.createParents?: boolean (default: false). When true, missing parent directories within the workspace root are created segment-by-segment with strict canonical realpath containment validation. Only valid for mode: "create" (specifying createParents in mode: "overwrite" is rejected as schema-invalid). When write confirmation is enabled, confirmation occurs strictly before any directory creation or filesystem mutation. If final file publication fails, created parent directories may remain as partial side effects. Final file publication retains atomic no-clobber hard-link semantics on supported filesystems; parent-directory creation itself is not fully atomic.fs.link is the create publication primitive; unsupported hard-link publication fails closed without overwriting existing files, and unexpected native filesystem errors are sanitized.mode: "overwrite"): Strictly requires expectedSha256 (64-character lowercase hex) matching the file's current SHA-256 hash. If the file was modified concurrently, throws content_conflict and aborts without touching the target file..mcp-temp-<uuid>.tmp) in the target directory (O_CREAT | O_EXCL), flushes to disk (fsync), re-validates the target file type and hash, and atomically replaces the destination.{
"name": "write_text_file",
"arguments": {
"rootId": "root-1",
"path": "src/nested/components/Button.tsx",
"mode": "create",
"content": "export function Button() { return <button>Click</button>; }\n",
"createParents": true
}
}
edit_text_file:
$$, $1, $&, $\``, $'` are inserted verbatim).expectedOccurrences (default: 1) using non-overlapping literal matching matching the exact replacement semantics.expectedOccurrences check or if the file hash mismatches expectedSha256, the operation aborts and the disk file remains 100% untouched.invalid_text_encoding). Existing UTF-8 BOM headers and CRLF line endings are preserved with byte-for-byte fidelity.{
"name": "edit_text_file",
"arguments": {
"rootId": "root-1",
"path": "src/index.ts",
"expectedSha256": "4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a",
"edits": [
{
"oldText": "const PORT = 3000;",
"newText": "const PORT = 8080;",
"expectedOccurrences": 1
}
]
}
}
Server operators can set strict hard caps on the maximum allowed write or edit payload size in bytes:
--workspace-max-write-bytes=<bytes> (1 to 5,242,880 bytes / 5 MiB, default: 1048576 / 1 MiB)MCP_WORKSPACE_MAX_WRITE_BYTES=<bytes>0755, 0644) where supported. Other OS-specific metadata (e.g. inode number, creation timestamp ctime, ACL inheritance) may not be portably preserved.fs.realpath resolution within configured root boundaries.fs.link hard-link publication, create-mode writes fail closed without clobbering existing files.Confirmation is off by default. Enable it for both mutation tools with the operator-only --workspace-write-confirmation flag, or MCP_WORKSPACE_WRITE_CONFIRMATION=true (true/1/false/0). The CLI flag enables confirmation even if the environment says false; tool arguments cannot disable it. No tools are added and profile access stays unchanged.
high-performance-mcp-server --profile=workspace_write --root=./project --workspace-write-confirmation
The server validates the target, then asks the client to show a form containing a confirm boolean. Only an accepted response with confirm: true proceeds. Decline, cancel, false, and malformed accepted content leave the file unchanged. No temporary file is created while approval is pending. The normal root, size, exact-edit, and SHA-256 checks still run after approval, including when a file changes during the prompt.
The prompt identifies the operation and canonical logical rootId/relative path; it does not display file content, expected hashes, root names, or absolute host paths. Control and bidirectional formatting characters are escaped. Targets over 4,096 characters are refused instead of silently truncated. Response keys include the proposed arguments and resolved logical target so a changed proposal asks again.
| Connection | Confirmation enabled |
|---|---|
MCP 2026-07-28, stdio or HTTP | Native input_required form elicitation |
| Legacy MCP, stdio | SDK compatibility shim uses elicitation/create |
| Legacy MCP, stateless HTTP | Refused: no reverse-request channel for approval |
| Client without form elicitation | Refused without a mutation |
With confirmation disabled, existing modern and legacy calls behave as before. Use a client that actually presents the form to a human: elicitation is a client-mediated safeguard, not authentication or a security boundary against a malicious client. The server cannot prove that a human approved a client-supplied response. Direct service-level embedding is also outside this MCP handler gate. For protocol details, see the official SDK input-required guide.
In addition to workspace inspection tools, this server natively exposes allowlisted workspace text files as standard MCP Resources using the official URI Template:
workspace:///{rootId}/{+path}
Workspace resources use a stable, portable URI scheme based on logical root IDs rather than host filesystem paths:
workspace:///root-1/README.mdworkspace:///root-1/src/index.tsworkspace:///root-2/docs/architecture.mdHost absolute paths (such as file:///C:/... or /home/...) are never exposed in resource URIs, titles, or error messages.
workspace, workspace_write, all). In non-workspace profiles (safe, network, diagnostics, benchmark, admin), resource endpoints return Method not found and zero workspace existence is advertised.--root directories and blocking symlink/junction escapes.resource_too_large.fatal: true). Files containing NUL bytes (0x00) or non-UTF-8 sequences are rejected as unsupported binary files (invalid_text_encoding).resources/templates/list advertises the resource template (workspace_text_file). The server does not recursively crawl repository directories for resources/list, preventing latency, memory spikes, and information disclosure on large repositories.--workspace-max-resource-bytes=<bytes> (1 to 5,242,880 bytes / 5 MiB, default: 1048576 / 1 MiB)MCP_WORKSPACE_MAX_RESOURCE_BYTES=<bytes>workspace_roots, list_directory, or search_files.resources/read using workspace:///<rootId>/<path>.read_text_file to obtain the authoritative sha256 hash and perform concurrency-controlled edits via write_text_file or edit_text_file in the workspace_write profile.fetch_urlNetwork access is disabled by default. To enable SSRF-hardened read-only web fetching, run with --profile=network (or --profile=all):
# Start server with opt-in network profile
npx high-performance-mcp-server --profile=network
fetch_url Tool DetailsThe fetch_url tool performs strictly bounded, read-only HTTP/HTTPS requests to public web resources.
method parameter accepts "GET" (default) or "HEAD". Arbitrary HTTP verbs (POST, PUT, DELETE, PATCH, OPTIONS) are rejected at the schema boundary.method: "HEAD" is specified, the server issues a native HEAD request reusing the exact same SSRF, DNS multi-answer validation, socket pinning, and redirect policy as GET. Representation bodies are not consumed (bytesRead: 0, truncated: false, body: undefined). Content-Length is reported as server-declared representation length metadata, not downloaded bytes. Bypasses text-body decoding constraints, enabling metadata retrieval for binary assets (image/png, application/pdf, application/octet-stream) and compressed content (Content-Encoding: gzip).GET or HEAD) across all redirect hops (301, 302, 303, 307, 308). Specifically, HEAD with 303 See Other remains HEAD at the destination.network-fetch-v1\0<canonicalUrl>). Conditional 304 Not Modified revalidation on HEAD returns cached original status and statusText with omitted body and revalidationStatus: 304.{
"name": "fetch_url",
"arguments": {
"url": "https://raw.githubusercontent.com/modelcontextprotocol/specification/main/LICENSE",
"method": "HEAD"
}
}
net.BlockList). Loopback (127.0.0.0/8, ::1), private RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16, fe80::/10), carrier-grade NAT (100.64.0.0/10), cloud metadata (169.254.169.254, metadata.google.internal), unique-local IPv6 (fc00::/7), multicast, and IPv4-mapped IPv6 (::ffff:x.x.x.x) destinations are strictly blocked.80, 443, 8080, and 8443.301, 302, 303, 307, 308) are manually followed. Every intermediate target is re-validated against full URL, port, and IP security policies. HTTPS-to-HTTP downgrade redirects are rejected.maxBytes (default 1 MiB, hard maximum 5 MiB). If payload exceeds limit, truncated: true is returned and the stream is immediately destroyed.text/*, application/json, application/xml, application/javascript, application/xhtml+xml, application/yaml) with fatal UTF-8 decoding (new TextDecoder("utf-8", { fatal: true })). Binary bodies and explicit non-UTF-8 encodings are rejected. HEAD requests bypass body decoding restrictions and allow metadata inspection of binary content types.Server operators can enforce additional deployment-level egress policies to restrict outbound network capabilities:
Allowed Hostname Patterns (--network-allow-host, MCP_NETWORK_ALLOW_HOSTS_JSON):
example.com) or subdomain wildcards (*.githubusercontent.com).host_not_allowed ("Destination hostname is not allowed by server network policy.").Denied Hostname Patterns (--network-deny-host, MCP_NETWORK_DENY_HOSTS_JSON):
host_denied ("Destination hostname is denied by server network policy.").HTTPS-Only Mode (--network-https-only, MCP_NETWORK_HTTPS_ONLY):
http:// initial target or redirect destination is rejected with https_required ("HTTPS is required by server network policy.").Operator Resource Caps:
--network-max-response-bytes (MCP_NETWORK_MAX_RESPONSE_BYTES): Clamps the maximum response size (1 to 5,242,880 bytes).--network-max-timeout-ms (MCP_NETWORK_MAX_TIMEOUT_MS): Clamps the maximum request timeout (1,000 to 30,000 ms).[!IMPORTANT] Operator Restrictions Are Subtractive Only: Operator configuration can never weaken or override built-in SSRF protections. Private IPs, loopback, link-local, carrier-grade NAT, and cloud metadata destinations remain strictly blocked even if listed in
--network-allow-host.
An optional, bounded, in-memory conditional cache can be enabled for fetch_url to reduce upstream bandwidth and latency for frequently accessed public HTTPS documents:
--network-cache (MCP_NETWORK_CACHE_ENABLED=true)--network-cache-max-size-bytes=<n> (MCP_NETWORK_CACHE_MAX_SIZE_BYTES): Logical max cache payload size (1 KiB to 64 MiB, default 16 MiB).--network-cache-max-entries=<n> (MCP_NETWORK_CACHE_MAX_ENTRIES): Maximum cached entries (1 to 512, default 128).--network-cache-ttl-ms=<n> (MCP_NETWORK_CACHE_TTL_MS): Retention TTL in ms (1,000 to 3,600,000 ms, default 300,000 ms / 5 minutes).If-None-Match, If-Modified-Since) to the origin over the full secure network transport (SSRF checks, DNS rebinding lookup, operator policy, and timeout deadline).Usage:
high-performance-mcp-server [options]
Options:
--transport=<stdio|http> Transport protocol to run (default: stdio)
--port=<number> HTTP server port (default: 3000, only for http transport)
--profile=<profile> Security tool profile (default: safe)
--root=<path> Allowlisted workspace root (repeatable, max 16)
--workspace-max-write-bytes=<n> Operator hard cap for text write/edit size in bytes (1-5242880, default: 1048576)
--workspace-max-resource-bytes=<n> Operator hard cap for resource read size in bytes (1-5242880, default: 1048576)
--workspace-write-confirmation Require client-mediated confirmation before text write/edit operations
--network-allow-host=<pattern> Allowlisted public hostname or *.domain pattern (repeatable, operator restriction)
--network-deny-host=<pattern> Denylisted hostname or *.domain pattern (repeatable, operator restriction)
--network-https-only Enforce HTTPS-only mode for all network requests (operator restriction)
--network-max-response-bytes=<n> Operator hard cap for response size in bytes (1-5242880, default: 5242880)
--network-max-timeout-ms=<n> Operator hard cap for request timeout in ms (1000-30000, default: 30000)
--network-cache Enable conditional in-memory response cache for fetch_url (operator restriction)
--network-cache-max-size-bytes=<n> Logical max cache payload size in bytes (1024-67108864, default: 16777216)
--network-cache-max-entries=<n> Max cache entry count (1-512, default: 128)
--network-cache-ttl-ms=<n> Max cache retention TTL in ms (1000-3600000, default: 300000)
--list-tools Display available tools for the active profile and exit
--help, -h Show this help message and exit
--version, -v Show version and exit
# Start default safe server on stdio
high-performance-mcp-server
# Start with network profile, operator egress restrictions, and conditional cache
high-performance-mcp-server --profile=network \
--network-allow-host=example.com \
--network-allow-host="*.githubusercontent.com" \
--network-https-only \
--network-max-response-bytes=262144 \
--network-max-timeout-ms=5000 \
--network-cache \
--network-cache-max-entries=256
# List tools available under the workspace profile
high-performance-mcp-server --profile=workspace --list-tools
# Run Streamable HTTP transport on port 8080 with workspace profile
high-performance-mcp-server --transport=http --port=8080 --profile=workspace --root=./project
When started with --transport=http, the server launches a Streamable HTTP transport using Node.js built-in node:http:
http://127.0.0.1:<port>/mcp127.0.0.1 and validates Host and Origin headers to protect against DNS rebinding and cross-site request forgery.| Variable | Type | Default | Description |
|---|---|---|---|
MCP_PROFILE | string | safe | Default tool profile override (safe, workspace, workspace_write, network, diagnostics, benchmark, admin, all) |
PORT | number | 3000 | Default HTTP port override (strict integer 1-65535) |
MCP_ROOTS_JSON | string | (none) | JSON array of workspace roots (e.g. ["/home/user/project", "/home/user/docs"]) |
MCP_WORKSPACE_WRITE_CONFIRMATION | boolean | false | Require client-mediated write/edit approval (true/1/false/0) |
MCP_NETWORK_ALLOW_HOSTS_JSON | string | (none) | JSON array of allowed public host patterns (e.g. ["example.com","*.githubusercontent.com"]) |
MCP_NETWORK_DENY_HOSTS_JSON | string | (none) | JSON array of denied host patterns (e.g. ["ads.example.com"]) |
MCP_NETWORK_HTTPS_ONLY | boolean | false | Enforce HTTPS-only mode for all network requests (true/1/false/0) |
MCP_NETWORK_MAX_RESPONSE_BYTES | number | 5242880 | Operator response byte cap override (1 to 5242880) |
MCP_NETWORK_MAX_TIMEOUT_MS | number | 30000 | Operator request timeout cap in ms override (1000 to 30000) |
MCP_NETWORK_CACHE_ENABLED | boolean | false | Enable conditional in-memory response cache (true/1/false/0) |
MCP_NETWORK_CACHE_MAX_SIZE_BYTES | number | 16777216 | Logical max cache payload size override in bytes (1024 to 67108864) |
MCP_NETWORK_CACHE_MAX_ENTRIES | number | 128 | Max cache entries override (1 to 512) |
MCP_NETWORK_CACHE_TTL_MS | number | 300000 | Max cache retention TTL override in ms (1000 to 3600000) |
MCP_WORKER_COUNT | number | 4 | Number of worker threads spawned in the pool (1 to 16) |
MCP_CACHE_MAX_ENTRIES | number | 256 | Maximum entries in the LRU compute cache (1 to 10000) |
MCP_CACHE_TTL_MS | number | 300000 | LRU compute cache entry Time-to-Live in milliseconds (5 minutes) |
# Install dependencies
npm install
# Run code generator and TypeScript typecheck
npm run typecheck
# Execute unit, security, search, and modern protocol integration test suites
npm test
# Build production bundle
npm run build
# Validate npm package payload without publishing
npm run pack:check
# Run package payload security & privacy scan
npm run security:package
# Run end-to-end tarball installation smoke test
npm run smoke:package
MCP Clients (Claude Desktop, Cursor, Custom SDK Clients)
│
┌───────────────┴───────────────┐
▼ ▼
Stdio Transport Streamable HTTP Transport
(process.stdin / stdout) (127.0.0.1:3000/mcp)
│ │
└───────────────┬───────────────┘
▼
McpServer Instance
(Profile-Aware Server Instructions)
│
┌───────────────┴───────────────┐
▼ ▼
Tool & Prompt Profiles Internal Telemetry
(safe, workspace, diag, ...) (Metrics & Stderr Logger)
│ │
├──────► Read-Only Workspace, Search, Resources & Prompts (Allowlisted Roots, Host Privacy)
│
├──────► In-Memory LRU Cache (Single-Flight Stampede Protection)
│
└──────► Reusable Worker Thread Pool (CPU Offloading)
safe) ensures no filesystem or hardware inspection is exposed without explicit opt-in.--root directories without revealing host filesystem absolute paths.stdout exclusively for JSON-RPC messages; all internal debug and telemetry logs route to stderr.For details, review SECURITY.md.
Contributions and feedback are welcome! Please read CONTRIBUTING.md for details on code style, tool development conventions, testing requirements, and the maintainer release workflow.
This project is licensed under the MIT License.
FAQs
High-performance, modular MCP v2 server with safe-by-default profiles, Streamable HTTP, stdio, worker threads, metrics, and LRU caching
We found that high-performance-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
Security News
It has been one year since Shai-Hulud made its first appearance on npm.
Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.