Build a Production MCP Server in TypeScript for Next.js & Node.js (2026 Guide)

3. Production Tools for a Next.js / Prisma Stack

A useful MCP server exposes the same operations your app already performs — through a controlled, schema-validated interface. Below is a realistic pattern: list projects for an authenticated user and create a project, both backed by a server-only data-access layer.

3.1 Shared Prisma client and DAL

// src/lib/prisma.ts
import { PrismaClient } from '@prisma/client';

const globalForPrisma = globalThis as unknown as { prisma?: PrismaClient };
export const prisma = globalForPrisma.prisma ?? new PrismaClient();
if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;

// src/data/projects.ts
import 'server-only'; // if this module is ever imported from a Next.js boundary
import { prisma } from '../lib/prisma.js';

export async function listProjectsForUser(userId: string) {
  return prisma.project.findMany({
    where: { ownerId: userId },
    select: { id: true, name: true, updatedAt: true },
    orderBy: { updatedAt: 'desc' },
    take: 50,
  });
}

export async function createProjectForUser(userId: string, name: string) {
  return prisma.project.create({
    data: { name, ownerId: userId },
    select: { id: true, name: true, createdAt: true },
  });
}

3.2 Register tools with ownership checks

import { listProjectsForUser, createProjectForUser } from './data/projects.js';

function requireUserId(userId: string | undefined): string {
  if (!userId || typeof userId !== 'string') {
    throw new Error('Authenticated user id is required');
  }
  return userId;
}

server.registerTool(
  'list_projects',
  {
    description: 'List projects owned by the current user. Returns id, name, updatedAt.',
    inputSchema: z.object({
      userId: z.string().uuid().describe('Authenticated user id from the host session'),
    }),
  },
  async ({ userId }) => {
    const id = requireUserId(userId);
    const projects = await listProjectsForUser(id);
    return {
      content: [{ type: 'text', text: JSON.stringify(projects, null, 2) }],
    };
  }
);

server.registerTool(
  'create_project',
  {
    description: 'Create a new project for the current user.',
    inputSchema: z.object({
      userId: z.string().uuid(),
      name: z.string().min(1).max(120),
    }),
  },
  async ({ userId, name }) => {
    const id = requireUserId(userId);
    const project = await createProjectForUser(id, name);
    return {
      content: [{ type: 'text', text: JSON.stringify(project, null, 2) }],
    };
  }
);

Never accept a raw connection string or admin token from the model. Pass only the authenticated user id that the host already verified, and scope every query to that id.

3.3 Resources for schema and docs

server.registerResource(
  'schema://projects',
  {
    description: 'JSON Schema description of the Project model the tools operate on',
    mimeType: 'application/json',
  },
  async () => ({
    contents: [{
      uri: 'schema://projects',
      mimeType: 'application/json',
      text: JSON.stringify({
        type: 'object',
        properties: {
          id: { type: 'string', format: 'uuid' },
          name: { type: 'string' },
          ownerId: { type: 'string', format: 'uuid' },
          updatedAt: { type: 'string', format: 'date-time' },
        },
        required: ['id', 'name', 'ownerId'],
      }, null, 2),
    }],
  })
);