MCP server for your app's knowledge in Node.js

import express from 'express';
import { z } from 'zod';
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';

// Stand-in for the product master. In production these records come from the product master's API.
const PRODUCTS = [
	{ code: 'VLM-050-TAB', name: 'Velmatra 50 mg film-coated tablet', inn: 'velmatinib', strength: '50 mg', form: 'film-coated tablet', markets: [ 'US', 'EU' ], notes: 'Starting dose in adults with moderate renal impairment.' },
	{ code: 'VLM-100-TAB', name: 'Velmatra 100 mg film-coated tablet', inn: 'velmatinib', strength: '100 mg', form: 'film-coated tablet', markets: [ 'US', 'EU', 'JP' ], notes: 'Standard maintenance dose, once daily with or without food.' },
	{ code: 'VLM-025-SOL', name: 'Velmatra 25 mg/mL oral solution', inn: 'velmatinib', strength: '25 mg/mL', form: 'oral solution', markets: [ 'EU' ], notes: 'For patients unable to swallow tablets. Not interchangeable with tablets on a mg-for-mg basis.' },
	{ code: 'ORX-200-CAP', name: 'Orvexan 200 mg hard capsule', inn: 'orvexanib', strength: '200 mg', form: 'hard capsule', markets: [ 'US' ], notes: 'Do not co-administer with velmatinib.' }
];

// Stand-in for the study registry.
const STUDIES = {
	'VLM-3021': {
		id: 'VLM-3021',
		title: 'Velmatinib versus placebo in adults with moderate to severe rheumatoid arthritis and an inadequate response to methotrexate',
		phase: 3,
		design: 'Randomized, double-blind, placebo-controlled, parallel-group, 52 weeks',
		protocolVersion: '3.0 (amendment 2, 14 May 2026)',
		arms: [
			{ name: 'Velmatinib 100 mg', regimen: '100 mg orally once daily, with background methotrexate', plannedParticipants: 300 },
			{ name: 'Velmatinib 50 mg', regimen: '50 mg orally once daily, with background methotrexate', plannedParticipants: 300 },
			{ name: 'Placebo', regimen: 'Matching placebo orally once daily, with background methotrexate', plannedParticipants: 300 }
		],
		primaryEndpoint: 'Proportion of participants achieving an ACR20 response at week 24',
		secondaryEndpoints: [
			'Change from baseline in DAS28-CRP at week 24',
			'Change from baseline in HAQ-DI at week 24',
			'Proportion of participants achieving ACR50 and ACR70 responses at week 52'
		],
		enrollment: { planned: 900, enrolled: 874, status: 'Enrollment complete' },
		sites: { active: 112, countries: 18 }
	}
};

function createServer() {
	const server = new McpServer( { name: 'study-registry', version: '1.0.0' } );

	server.registerTool( 'get_study', {
		title: 'Get study record',
		description: 'Returns the current record of a clinical study from the study registry: phase, design, protocol version, ' +
			'treatment arms with dosing, primary and secondary endpoints, enrollment, and site count. ' +
			'Use it whenever a document needs the study design, methods, or enrollment figures. ' +
			'Takes the protocol number as shown in the registry, for example VLM-3021.',
		inputSchema: { protocolId: z.string().describe( 'The protocol number, for example VLM-3021.' ) }
	}, async ( { protocolId } ) => {
		const study = STUDIES[ protocolId.toUpperCase() ];

		if ( !study ) {
			return { content: [ { type: 'text', text: `No study with protocol number ${ protocolId } exists in the registry.` } ], isError: true };
		}

		// Study-level summary only. Never return participant-level data.
		return { content: [ { type: 'text', text: JSON.stringify( study ) } ] };
	} );

	server.registerTool( 'search_products', {
		title: 'Search the product master',
		description: 'Searches the product master by product name, INN, product code, or keyword and returns up to five matches ' +
			'with strength, formulation, the markets where each is approved, and prescribing notes. ' +
			'Use it to check whether a product or strength is approved in a market, or to find the exact approved product name.',
		inputSchema: { query: z.string().describe( 'Words from the product name, INN, or code, for example "50 mg" or "velmatinib".' ) }
	}, async ( { query } ) => {
		const words = query.toLowerCase().split( /\s+/ );
		const matches = PRODUCTS
			.filter( item => words.some( word => `${ item.code } ${ item.name } ${ item.inn } ${ item.notes }`.toLowerCase().includes( word ) ) )
			.slice( 0, 5 );

		return { content: [ { type: 'text', text: JSON.stringify( matches ) } ] };
	} );

	return server;
}

const app = express();
app.use( express.json() );

// CKEditor AI sends this header on every call. Reject everything else.
app.use( '/mcp', ( req, res, next ) => {
	if ( req.headers.authorization !== `Bearer ${ process.env.MCP_TOKEN }` ) {
		res.sendStatus( 401 );
		return;
	}
	next();
} );

// Stateless mode: a fresh server and transport per request, so no state is shared between calls.
app.post( '/mcp', async ( req, res ) => {
	const server = createServer();
	const transport = new StreamableHTTPServerTransport( { sessionIdGenerator: undefined } );

	res.on( 'close', () => {
		transport.close();
		server.close();
	} );

	await server.connect( transport );
	await transport.handleRequest( req, res, req.body );
} );

// A stateless server has no session stream to open or close.
app.get( '/mcp', ( req, res ) => res.sendStatus( 405 ) );
app.delete( '/mcp', ( req, res ) => res.sendStatus( 405 ) );

app.listen( 3020, () => console.log( 'MCP server listening on http://localhost:3020/mcp' ) );

const HOST = process.env.CKEDITOR_AI_HOST;				// https://ai.cke-cs.com, https://ai.cke-cs-eu.com, or your on-premises CKEditor AI
const ADMIN_TOKEN = process.env.CKEDITOR_AI_ADMIN_TOKEN;  // a token with ai:admin
const TOKEN = process.env.CKEDITOR_AI_TOKEN;			  // an end user's token

async function post( path, body, token ) {
	const response = await fetch( `${ HOST }${ path }`, {
		method: 'POST',
		headers: { 'Authorization': `Bearer ${ token }`, 'Content-Type': 'application/json' },
		body: JSON.stringify( body )
	} );

	if ( !response.ok ) {
		throw new Error( `${ response.status } ${ await response.text() }` );
	}

	return response.json();
}

async function stream( path, body ) {
	const response = await fetch( `${ HOST }${ path }`, {
		method: 'POST',
		headers: { 'Authorization': `Bearer ${ TOKEN }`, 'Content-Type': 'application/json', 'Accept': 'text/event-stream' },
		body: JSON.stringify( body )
	} );

	if ( !response.ok ) {
		throw new Error( `${ response.status } ${ await response.text() }` );
	}

	const decoder = new TextDecoder();
	let buffer = '';

	for await ( const chunk of response.body ) {
		buffer += decoder.decode( chunk, { stream: true } );

		let end;
		while ( ( end = buffer.indexOf( '\n\n' ) ) >= 0 ) {
			const lines = buffer.slice( 0, end ).split( '\n' );
			buffer = buffer.slice( end + 2 );

			const event = lines.find( line => line.startsWith( 'event: ' ) )?.slice( 7 );
			const data = lines.find( line => line.startsWith( 'data: ' ) )?.slice( 6 );

			console.log( `event: ${ event }\ndata: ${ data }\n` );
		}
	}
}

await post( '/v1/admin/mcp-servers', {
	name: 'study-registry',
	url: 'https://registry.pharma.example/mcp',
	headers: {
		Authorization: 'Bearer <service token>'
	}
}, ADMIN_TOKEN );

await post( '/v1/conversations', { id: 'vlm-3021-study-report' }, TOKEN );

const { id: documentId } = await post( '/v1/conversations/vlm-3021-study-report/documents', {
	content: '<h1>Clinical study report: VLM-3021</h1><h2>1. Synopsis</h2><p>This report presents the results of study VLM-3021, a phase 3 study of velmatinib in adults with moderate to severe rheumatoid arthritis.</p><h2>2. Methods</h2><p>To be completed.</p><h2>3. Results</h2><p>To be completed after database lock.</p>'
}, TOKEN );

await stream( '/v1/conversations/vlm-3021-study-report/messages', {
	prompt: 'Add the study design to the Methods section for protocol VLM-3021.',
	model: 'agent-1',
	content: [ { type: 'document', id: documentId } ]
} );

const servers = await fetch( `${ HOST }/v1/admin/mcp-servers`, {
	headers: { 'Authorization': `Bearer ${ ADMIN_TOKEN }` }
} );

console.log( await servers.json() );