production-deployment

You are an expert in deploying production MCP servers with the following stack:

• PostgreSQL 17 on Neon with @neondatabase/serverless v1.0.1
• Drizzle ORM v0.44.4 with drizzle-kit v0.31.4
• pgvector v0.8.0 for semantic search
• Zod v4.0.17 for validation
• HTTPS transport with StreamableHTTP

Production Architecture

System Architecture Overview

graph TB
    subgraph "Client Layer"
        C1[AI Companion Client 1]
        C2[AI Companion Client 2]
        CN[AI Companion Client N]
    end
    
    subgraph "API Gateway"
        AG[Nginx/Traefik]
        RL[Rate Limiter]
        AUTH[Auth Service]
    end
    
    subgraph "Application Layer"
        LB[Load Balancer]
        MCP1[MCP Server 1]
        MCP2[MCP Server 2]
        MCPN[MCP Server N]
    end
    
    subgraph "Data Layer"
        REDIS[(Redis Cache)]
        NEON[(Neon PostgreSQL)]
        S3[(S3 Storage)]
    end
    
    subgraph "Observability"
        PROM[Prometheus]
        GRAF[Grafana]
        LOGS[Loki/ELK]
    end
    
    C1 & C2 & CN --> AG
    AG --> LB
    LB --> MCP1 & MCP2 & MCPN
    MCP1 & MCP2 & MCPN --> REDIS
    MCP1 & MCP2 & MCPN --> NEON
    MCP1 & MCP2 & MCPN --> S3
    MCP1 & MCP2 & MCPN --> PROM
    MCP1 & MCP2 & MCPN --> LOGS

HTTPS Server Implementation

Production Express Server

// src/server.ts
import express from "express";
import https from "https";
import fs from "fs";
import helmet from "helmet";
import cors from "cors";
import compression from "compression";
import rateLimit from "express-rate-limit";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { CompanionSessionManager } from "./services/companionSessionManager";
import { AuthMiddleware } from "./middleware/auth";
import { MetricsMiddleware } from "./middleware/metrics";
import { LoggingMiddleware } from "./middleware/logging";

const app = express();

// Security middleware
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
}));

// CORS configuration for companion clients
app.use(cors({
  origin: process.env.ALLOWED_ORIGINS?.split(",") || ["https://companions.example.com"],
  credentials: true,
  methods: ["GET", "POST", "DELETE", "OPTIONS"],
  allowedHeaders: ["Content-Type", "Authorization", "mcp-session-id"],
  exposedHeaders: ["Mcp-Session-Id"],
}));

// Compression
app.use(compression());

// Body parsing
app.use(express.json({ limit: "10mb" }));
app.use(express.urlencoded({ extended: true, limit: "10mb" }));

// Rate limiting
const limiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 100, // Limit each IP to 100 requests per minute
  standardHeaders: true,
  legacyHeaders: false,
  handler: (req, res) => {
    res.status(429).json({
      error: "Too many requests",
      retryAfter: req.rateLimit.resetTime,
    });
  },
});
app.use("/mcp", limiter);

// Custom middleware
app.use(LoggingMiddleware);
app.use(MetricsMiddleware);
app.use("/mcp", AuthMiddleware);

// Health checks
app.get("/health", (req, res) => {
  res.json({ status: "healthy", timestamp: new Date().toISOString() });
});

app.get("/ready", async (req, res) => {
  try {
    // Check database connection
    await checkDatabaseHealth();
    // Check Redis connection
    await checkRedisHealth();
    
    res.json({ status: "ready" });
  } catch (error) {
    res.status(503).json({ status: "not ready", error: error.message });
  }
});

// MCP endpoints
const sessionManager = new CompanionSessionManager();

app.post("/mcp", async (req, res) => {
  try {
    const sessionId = req.headers["mcp-session-id"] as string;
    
    if (sessionId) {
      const session = await sessionManager.getSession(sessionId);
      if (session) {
        await session.transport.handleRequest(req, res, req.body);
        return;
      }
    }
    
    // New session initialization
    if (isInitializeRequest(req.body)) {
      const companionId = req.headers["x-companion-id"] as string;
      const userId = req.user?.id; // From auth middleware
      
      if (!companionId) {
        return res.status(400).json({
          jsonrpc: "2.0",
          error: { code: -32000, message: "Companion ID required" },
          id: null,
        });
      }
      
      const newSessionId = await sessionManager.createSession({
        companionId,
        userId,
        metadata: {
          ip: req.ip,
          userAgent: req.headers["user-agent"],
        },
      });
      
      const session = await sessionManager.getSession(newSessionId);
      await session!.transport.handleRequest(req, res, req.body);
    } else {
      res.status(400).json({
        jsonrpc: "2.0",
        error: { code: -32000, message: "Invalid request" },
        id: null,
      });
    }
  } catch (error) {
    console.error("MCP request error:", error);
    res.status(500).json({
      jsonrpc: "2.0",
      error: { code: -32603, message: "Internal server error" },
      id: null,
    });
  }
});

// SSE endpoint for notifications
app.get("/mcp", async (req, res) => {
  const sessionId = req.headers["mcp-session-id"] as string;
  
  if (!sessionId) {
    return res.status(400).send("Session ID required");
  }
  
  const session = await sessionManager.getSession(sessionId);
  if (!session) {
    return res.status(404).send("Session not found");
  }
  
  // Set SSE headers
  res.setHeader("Content-Type", "text/event-stream");
  res.setHeader("Cache-Control", "no-cache");
  res.setHeader("Connection", "keep-alive");
  res.setHeader("X-Accel-Buffering", "no");
  
  await session.transport.handleRequest(req, res);
});

// Start HTTPS server
const httpsOptions = {
  key: fs.readFileSync(process.env.SSL_KEY_PATH || "/certs/key.pem"),
  cert: fs.readFileSync(process.env.SSL_CERT_PATH || "/certs/cert.pem"),
};

const server = https.createServer(httpsOptions, app);

const PORT = process.env.PORT || 443;
server.listen(PORT, () => {
  console.log(`MCP server running on https://localhost:${PORT}`);
});

// Graceful shutdown
process.on("SIGTERM", async () => {
  console.log("SIGTERM received, shutting down gracefully");
  
  server.close(() => {
    console.log("HTTP server closed");
  });
  
  await sessionManager.shutdown();
  process.exit(0);
});