Build and secure MCP servers with TypeScript
Build a TypeScript MCP server for a small ticketing service and control access to its tools.
Model Context Protocol (MCP) lets clients such as
Claude Code and Codex call those tools to work with
ticket data. The server provides two tools: get_ticket reads a ticket and close_ticket closes it.
In this example we start with a working server, connect a client, and add either browser login for people or API keys for automated jobs. Then test that a caller with read-only access can read a ticket but cannot close it.
For browser login, Ory Hydra Authorization issues access tokens. Use Ory Network for hosted login and consent pages, or run Ory Hydra Authorization and your login app on your own infrastructure. For API keys, Ory Talos Secure API Keys verifies each key, either in Ory Network or on your own infrastructure.
After browser login, the client sends a JSON Web Token (JWT) with each tool request. The MCP server verifies the token's signature using public keys from Ory Hydra Authorization. For automated jobs, the client sends an API key instead. In both cases, the server checks the caller's granted permissions, called scopes, before accessing ticket data.
Choose an authentication method
| Authentication | Deployment | Follow this guide |
|---|---|---|
| Browser login | Ory Network hosts login and consent. Clients register automatically. | Ory Network |
| Browser login | Self-hosted OEL with resource indicators and automatic registration. | OEL |
| Browser login | Self-hosted open source with one client registration per MCP server. | Open source |
| Application API keys | Automated jobs, using Ory Network or a local verifier. | Application API keys |
Browser login requires a client that supports MCP OAuth. API keys require a client that can send a bearer header.
Start building
- Build the server. You need Git, Node.js 22.19 or later, npm, Bash or Zsh, and Claude Code, Codex, or MCP Inspector, a browser interface for testing MCP tools.
- Choose a browser-login guide from the table above or follow Use API keys. Each includes a complete example and shows that read-only access lets a client read a ticket but prevents it from closing one.
The sample ticket database stays in memory and resets on restart. You can use the same authentication and permission checks when replacing it with your own ticketing service.
Browse all MCP example source files. Clone them once and select the example for each guide. The guides explain the important code and walk through configuration and testing.