Built a small TypeScript framework for scaffolding MCP servers nothing fancy, mostly just tried to be careful about security
Hey, I was doing something this week and wanted to share something I've been working on, CLQ. It's a pretty small TypeScript/Zod framework for building MCP servers, so you don't have to hand-write the JSON-RPC/stdio wiring yourself.
Honestly it's not doing anything wilddefineTool + createServer, Zod validates input and output, there's a CLI with init/dev/inspect/doctor. Nothing here that a determined dev couldn't build themselves in a weekend. If you're already happy with what you're using, there's genuinely no need to switch.
The one thing I did spend real time on: before shipping, I put it through a proper security pass rather than just assuming it was fine. Found a real credential leak in one of my own CLI commands (a secret value was printing to stdout on a type mismatch..., oops), fixed it, then found that my fix for a different bug had quietly broken something else (a redaction regex that stopped catching secrets in camelCase field names like userApiKey). Fixed that too, and this time went looking for cases I hadn't thought of yet before calling it done.
Wrote it all up in the repo, including the parts where the first fix didn't work figured that's more useful than a changelog that only shows the clean ending.
Not claiming it's better than what's out there, just figured a few of you might find it useful, and I'd genuinely appreciate any feedback, especially if something looks off. https://github.com/clq-sh/CLQ
