The second gate between a working prototype and a product: the day after you
deploy, someone has to refund an order or retry a failed job. @spfn/mcp answers
it without an admin dashboard — one application-defined set of tools, resources, and prompts
served over authenticated Streamable HTTP or local stdio. The official SDK owns the protocol;
your application supplies identity and owns policy, context, and business logic.
MCP negotiation, JSON-RPC, schema validation, and legacy compatibility belong to the official SDK. A transport-neutral dispatcher keeps tool behavior identical across network and process transports while authentication and domain policy stay at the application boundary.
Use HTTP when clients connect over a network and need OAuth plus Host and Origin validation. Use stdio when an Agent host starts a local child process; the executable, arguments, and process configuration become the capability boundary.
Define tools, resources, prompts, validation, and error policy once.
Mount an MCP endpoint with application-supplied authentication.
Attach an existing dispatcher to Streamable HTTP.
Run the same contract through a thin local process bridge.
Protocol frames use stdout; redacted diagnostics stay on stderr.
EOF, signals, disconnects, and fatal transport errors close cleanly.
Explicit McpError messages; internal failures stay internal.
Import dispatcher, HTTP, and stdio APIs without transport internals.