MCP Fusion is a TypeScript framework for building secure servers with native MCP 2.0 support. Its core idea is to push security constraints down into the architectural layer of every MCP server: raw data does not reach the large model until it passes through a typed egress firewall; when the workflow state does not allow it, tools are physically removed from the agent's namespace; every behavioral surface is hashed, locked, and auditable in version control.
-
MCP 2.0 Compatibility MCP Fusion is 100% compatible with MCP 2.0 (protocol revision 2026-07-28). Every feature defined by the specification is either implemented or handled through MCP SDK v2; every feature deprecated by the specification is likewise deprecated in MCP Fusion. All features deprecated by MCP 2.0 (SEP-2577 / SEP-2596) are marked with @deprecated and accompanied by migration guidance; they still work during the deprecation window (earliest removal date: 2027-07-28). The repository provides a deprecation registry containing a complete compliance statement and migration guide.
-
The Skill — Letting AI Write Servers MCP Fusion includes SKILL.md, which encodes the complete MVA architecture, security patterns, and governance rules into a format that AI coding agents can directly consume. Open the project in Cursor, Claude Code, GitHub Copilot, or Windsurf and describe the requirement, for example: "Build a patient medical record MCP server with Prisma, redact SSNs and diagnosis information in LLM output, and gate the discharge tool until the attending physician signs off." The agent reads the Skill and generates defineModel() declarations with m.hidden() (for sensitive fields), definePresenter() with .redactPII(['.ssn', '.diagnosis']) (for DLP compliance), FSM state gating implemented through .bindState() (for workflow enforcement), and file-based routing under src/tools/. Developers only need to review the PR. The Skill is not documentation, but a security contract: every server produced by AI inherits this governance stack, because the Skill encodes Presenter, state machine, and lock file generation as mandatory constraints.Architecture pattern.
III. Security Architecture
- Egress firewall — Presenter: Presenter validates every response through a Zod schema compiled by defineModel(); undeclared fields are stripped from memory before serialization; PII is redacted via V8-optimized fast-redact compiled functions. Rules flow with the data, rather than being written in the system prompt. The Late Guillotine pattern applies redaction after UI blocks are rendered — charts and suggestions always see the full data, while network transmission never sees it. Presenter also runs PromptFirewall — an LLM-as-Judge that evaluates dynamically generated system rules for prompt injection before they reach the agent, failing closed by default.
- State gate — FSM: Tools bound to an FSM state are physically removed from tools/list when the current state does not match; the LLM cannot call tools that do not exist in its namespace. Powered by XState v5, with a manual fallback when XState is not installed. Serverless support: FsmStateStore persists state across request boundaries to Redis/KV; each request gets an isolated gate.clone().
- Governance stack: eight introspection modules that make behavior changes visible and auditable.
IV. Sandbox and Execution Security SandboxEngine executes LLM-provided JavaScript in a sealed V8 isolated environment: no process, require, fs, or network access; one isolated environment per engine, with a fresh empty context for each execution; limits memory, enforces timeouts, limits output size, and is compatible with abort signals.
V. Usage Patterns
- YAML zero-code approach. 2. Typed MVA full-control approach. 3. FSM deterministic workflow enforcement approach: state-based gated tool discovery, where tools appear and disappear with the current state; file-based routing, where dropping in a file and restarting makes it an available MCP tool. Generators and connectors, as well as security and authentication-related capabilities, are also provided.
VI. Deployment and Scale MCP servers can be deployed to the same infrastructure, and for free. Servers run alongside 4,000+ services such as Salesforce, Stripe, and OpenAI, including V8 sandbox isolation, DLP, audittracking, and a kill switch. Register at vinkius.com, create an App Connector in the dashboard, copy the deployment token from the connector settings, build the server with MCP Fusion, and you are ready to go live. Every MCP server on Vinkius is built with MCP Fusion, covering four major verticals — AI Stack, Enterprise, Industries, and World Data — with 36+ subcategories. All servers run in V8 isolated sandboxes on AWS, use an Ed25519-signed audit chain, have cold starts under 40ms, apply DLP redaction to every response, provide a kill switch for instant shutdown, and log every tool call so it is auditable.
VII. Development and Security Guidelines See CONTRIBUTING.md for development environment setup and guidelines; see SECURITY.md for how to report vulnerabilities. The project also includes a code of conduct and a security policy.
