mcp
An MCP server in one line.
The host owns the connection and credentials; an unreachable server is a ConfigError naming it.
Import from @threads/mcp (TypeScript) or threads.mcp (Python).
function mcp(options: {
name: Name;
url?: string;
headers?: Record<string, string | Secret>;
command?: string;
args?: readonly string[];
env?: Record<string, string | Secret>;
runs?: "host" | "sandbox";
tools?: { allow?: readonly string[]; deny?: readonly string[] };
effect?: EffectClass;
}): McpServerParameters
nameNamerequiredTools are named mcp__<name>__<tool>.
urlstringThe server's URL, for a server reached over HTTP: Streamable HTTP, with an SSE fallback in TypeScript. Exactly one of url or command; omit it for a stdio server.
headersRecord<string, string | Secret>default {}HTTP headers sent with every request to a url server, such as an Authorization header. A value can be a secret(), revealed only on the host. Default {} sends none.
commandstringThe command that starts a stdio server, run on the host with args. Exactly one of url or command; omit it for a url server.
argsreadonly string[]default []Arguments passed to command. Default [] passes none.
envRecord<string, string | Secret>default {}Environment variables for the command's process. Only PATH and HOME come from the host; everything else must be given here. A value can be a secret(), revealed only on the host. Default {}.
runs"host" | "sandbox"default hostsandbox: stdio server inside the sandbox, with no host credentials. Only "host" is supported today; "sandbox" is a setup error.
tools{ allow?: readonly string[]; deny?: readonly string[] }Filters the server's tools, by the server's own tool names, before they are pinned. Omitted: every tool the server lists is pinned.
tools.allowreadonly string[]Only tools with these names are kept. Omitted: every name is allowed.
tools.denyreadonly string[]Tools with these names are dropped, even when allow lists them. Omitted: none are dropped.
effectEffectClassdefault unguardedThe effect class every tool from this server is pinned with. Use read_only for a server whose tools change nothing; the default unguarded means an uncertain call parks and is never retried. idempotent is refused in Python and needs a dedup window in TypeScript.