AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data roomsxmcp
xmcp is a TypeScript framework for building and deploying MCP (Model Context Protocol) servers. It provides file-system routing, hot reloading, middleware support, and streamlined deployment to platforms like Vercel, lowering the barrier to entry for developers building tools on the MCP ecosystem.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | basementstudio/xmcp |
| Owner | basementstudio |
| Primary language | TypeScript |
| License | MIT — OSI-approved |
| Stars | 1.3k |
| Forks | 89 |
| Open issues | 23 |
| Latest release | v0.6.13 (2026-06-22) |
| Last updated | 2026-06-30 |
| Source | https://github.com/basementstudio/xmcp |
What xmcp is
xmcp abstracts MCP server development through TypeScript with auto-registered tools/prompts via file routing, development-time hot reloading, extensible middleware for authentication, and first-class Vercel deployment support. It supports integration with existing Next.js or Express projects.
Get the xmcp source
Clone the repository and explore it locally.
git clone https://github.com/basementstudio/xmcp.gitcd xmcp# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- File-system routing convention is enforced; verify directory structure (tools/, prompts/) aligns with your project layout to avoid scaffolding conflicts.
- Hot reloading is development-focused; production behavior, reload safety, and state consistency need explicit testing and documentation review.
- Middleware chaining order and precedence require careful design to avoid authentication bypass or unexpected request filtering; test layering order early.
- Vercel deployment is zero-config, but custom environments require manual runtime configuration; confirm deployment target before committing to framework.
- MCP ecosystem maturity unknown; validate that AI models and clients you target have stable MCP support and xmcp compatibility.
When to avoid it — and what to weigh
- Non-TypeScript Environments — If your team uses Python, Go, or other languages, xmcp is TypeScript-first and not a fit without additional abstraction layers.
- Platform Lock-In Concerns — If you require multi-cloud or on-premise-only deployments, the framework's emphasis on Vercel may introduce vendor coupling; custom deployment is possible but less streamlined.
- Mature, Battle-Tested Dependencies — Project created May 2025 with latest release June 2026; early-stage frameworks carry higher risk of breaking changes, API instability, or community fragmentation.
- Low-Resource or Embedded Systems — As a Node.js/TypeScript runtime, xmcp requires adequate CPU and memory; not suitable for edge devices, embedded systems, or severely constrained environments.
License & commercial use
MIT License (MIT). Permissive OSI-approved license allowing free use, modification, and distribution in commercial and private projects, with minimal restrictions (attribution recommended, liability disclaimed).
MIT is a permissive license compatible with commercial use. You may use, modify, and distribute xmcp in closed-source commercial products without negotiation. Verify compliance with MIT terms (license notice, liability disclaimer) in your specific use case. Consult legal counsel if unclear.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Low |
| DEV.co fit | Good |
| Assessment confidence | Medium |
Framework provides middleware toolkit for authentication but does not expose pre-built security controls. Security contact ([email protected]) is published. No security audit, vulnerability history, or OWASP guidance visible. Consult security@ if you discover vulnerabilities. Middleware correctness and MCP protocol compliance are developer responsibilities; validate authentication logic and input sanitization in your tools.
Alternatives to consider
Anthropic MCP SDK (Python/TypeScript)
Official MCP implementation; lower-level control, less framework overhead, but requires manual server scaffolding and routing logic.
LangChain / LlamaIndex Tool Agents
General-purpose AI framework with tool/agent abstractions; broader ecosystem but not MCP-specific, may lack native MCP protocol support.
Node.js Express + manual MCP adapter
Full control, no framework lock-in, but higher setup complexity; suitable if you need deep customization or multi-protocol support.
Build on xmcp with DEV.co software developers
Start with xmcp today using `npx create-xmcp-app@latest`. Review documentation at xmcp.dev/docs and validate MCP compatibility with your AI platform before production.
Talk to DEV.coRelated on DEV.co
Explore the category and the services that help you build with it.
xmcp FAQ
Can I use xmcp outside Vercel?
Is xmcp production-ready?
What happens if basement.studio stops maintaining xmcp?
Do I need to know MCP protocol details?
Custom software development, end to end
If xmcp is on your shortlist, DEV.co can build around it. We are a custom software development company covering architecture, implementation, and production operations for mcp servers workloads.
Ready to build MCP servers?
Start with xmcp today using `npx create-xmcp-app@latest`. Review documentation at xmcp.dev/docs and validate MCP compatibility with your AI platform before production.