feat(hono): add mcp() middleware to serve an McpServer in one call

Adds mcp(server, options?) — a single Hono MiddlewareHandler that serves
an McpServer over Streamable HTTP with JSON body parsing and localhost
DNS-rebinding / origin protection applied (the same defaults as
createMcpHonoApp), so it can be mounted on a route you already own:

  app.all('/mcp', mcp(server))

The server is connected lazily on the first request. The inner app is
self-contained, so only the raw request is forwarded to it — this also
avoids c.executionCtx, which throws off Cloudflare Workers.

Feature and API shape inspired by yusukebe's mcp-server-hono-middleware.

- packages/middleware/hono/src/hono.ts: mcp() + McpMiddlewareOptions
- packages/middleware/hono/test/mcp.test.ts: end-to-end + protection tests
- README + docs/serving/hono.md: feature mcp() as the preferred path,
  keep createMcpHonoApp as the bring-your-own-app/factory escape hatch

Author: MathurAditya724

docs/serving/hono.md

@@ -9,39 +9,63 @@ npm install @modelcontextprotocol/server @modelcontextprotocol/hono hono
 
 ## Mount the handler
 
-`createMcpHandler` turns a server factory into a web-standard HTTP handler, and `handler.fetch` takes the `Request` a Hono route already holds as `c.req.raw` — no Node adapter. `createMcpHonoApp` is `new Hono()` with JSON body parsing and DNS rebinding protection already applied.
+`mcp(server)` is the shortest path: it returns a single Hono middleware that serves your `McpServer` over Streamable HTTP, with JSON body parsing and DNS rebinding protection already applied. Mount it on a route you already own — it connects the server on the first request.
+
+```ts source="../../examples/guides/serving/hono.examples.ts#mcp_mount"
+import { mcp } from '@modelcontextprotocol/hono';
+import { McpServer } from '@modelcontextprotocol/server';
+import { Hono } from 'hono';
+import * as z from 'zod/v4';
+
+const server = new McpServer({ name: 'notes', version: '1.0.0' });
+server.registerTool('add-note', { description: 'Append a note', inputSchema: z.object({ text: z.string() }) }, async ({ text }) => ({
+    content: [{ type: 'text', text: `Saved: ${text}` }]
+}));
+
+const app = new Hono();
+app.all('/mcp', mcp(server));
+
+export default app;
+```
+
+`app` is an ordinary Hono app, and `export default app` is the `{ fetch }` object Cloudflare Workers, Deno, and Bun serve directly; on Node, pass `app` to `serve` from `@hono/node-server`.
+
+### Bring your own app and factory
+
+When you want a fresh `McpServer` per request or full control over routing, drop down to `createMcpHandler` + `createMcpHonoApp`. `createMcpHandler` turns a server factory into a web-standard HTTP handler, and `handler.fetch` takes the `Request` a Hono route already holds as `c.req.raw` — no Node adapter. `createMcpHonoApp` is `new Hono()` with the same JSON body parsing and DNS rebinding protection applied.
 
 ```ts source="../../examples/guides/serving/hono.examples.ts#createMcpHonoApp_mount"
 import { createMcpHonoApp } from '@modelcontextprotocol/hono';
-import { createMcpHandler, McpServer } from '@modelcontextprotocol/server';
+import { createMcpHandler } from '@modelcontextprotocol/server';
 import type { Context } from 'hono';
-import * as z from 'zod/v4';
 
 const handler = createMcpHandler(() => {
-    const server = new McpServer({ name: 'notes', version: '1.0.0' });
-    server.registerTool('add-note', { description: 'Append a note', inputSchema: z.object({ text: z.string() }) }, async ({ text }) => ({
-        content: [{ type: 'text', text: `Saved: ${text}` }]
-    }));
-    return server;
+    const factoryServer = new McpServer({ name: 'notes', version: '1.0.0' });
+    factoryServer.registerTool(
+        'add-note',
+        { description: 'Append a note', inputSchema: z.object({ text: z.string() }) },
+        async ({ text }) => ({
+            content: [{ type: 'text', text: `Saved: ${text}` }]
+        })
+    );
+    return factoryServer;
 });
 
-const app = createMcpHonoApp();
-app.all('/mcp', (c: Context) => handler.fetch(c.req.raw, { parsedBody: c.get('parsedBody') }));
-
-export default app;
+const factoryApp = createMcpHonoApp();
+factoryApp.all('/mcp', (c: Context) => handler.fetch(c.req.raw, { parsedBody: c.get('parsedBody') }));
 ```
 
-`app` is an ordinary Hono app, and `export default app` is the `{ fetch }` object Cloudflare Workers, Deno, and Bun serve directly; on Node, pass `app` to `serve` from `@hono/node-server`. The factory runs once per request, so a fresh `McpServer` serves every call: [Serve over HTTP](./http.md#understand-the-per-request-factory) covers that model.
+The factory runs once per request, so a fresh `McpServer` serves every call: [Serve over HTTP](./http.md#understand-the-per-request-factory) covers that model.
 
 ::: tip
 Keep the explicit `c: Context` annotation: on an inferred callback context `c.get`'s key parameter narrows to `never` and `c.get('parsedBody')` does not compile.
 :::
 
 ## Protect against DNS rebinding
 
-A malicious page can DNS-rebind its own domain to `127.0.0.1` and reach a localhost server as if it were same-origin. `createMcpHonoApp` validates the `Host` and `Origin` headers against that: with the default `127.0.0.1` bind (and `localhost` / `::1`), a request carrying a non-localhost value gets `403` before your handler runs.
+A malicious page can DNS-rebind its own domain to `127.0.0.1` and reach a localhost server as if it were same-origin. `mcp()` and `createMcpHonoApp` both validate the `Host` and `Origin` headers against that: with the default `127.0.0.1` bind (and `localhost` / `::1`), a request carrying a non-localhost value gets `403` before your handler runs.
 
-Binding to all interfaces drops that default — name the hosts you serve instead.
+Binding to all interfaces drops that default — name the hosts you serve instead. `mcp()` takes the same `host` / `allowedHosts` / `allowedOrigins` options.
 
 ```ts source="../../examples/guides/serving/hono.examples.ts#createMcpHonoApp_allowedHosts"
 const publicApp = createMcpHonoApp({ host: '0.0.0.0', allowedHosts: ['api.example.com'] });
@@ -82,8 +106,8 @@ data: {"result":{"tools":[{"name":"add-note","description":"Append a note","inpu
 
 ## Recap
 
-- One install line, one file: `createMcpHonoApp()` plus one `app.all('/mcp', …)` route over `createMcpHandler(factory).fetch`.
+- `mcp(server)` is one Hono middleware — `app.all('/mcp', mcp(server))` serves the whole endpoint with body parsing and Host/Origin validation applied.
+- Need a fresh server per request or custom routing? Use `createMcpHonoApp()` plus one `app.all('/mcp', …)` route over `createMcpHandler(factory).fetch`.
 - Hono hands `c.req.raw` straight to `handler.fetch` — no Node adapter.
-- A fresh server instance from your factory serves every request.
 - The default `127.0.0.1` bind validates `Host` and `Origin`; pass `allowedHosts` when binding to `0.0.0.0`.
 - `authInfo` and `parsedBody` travel in `handler.fetch`'s second argument; handlers read auth as `ctx.http.authInfo`.

examples/guides/serving/hono.examples.ts

@@ -15,24 +15,42 @@
 /* eslint-disable no-console */
 import type { AuthInfo } from '@modelcontextprotocol/server';
 
+//#region mcp_mount
+import { mcp } from '@modelcontextprotocol/hono';
+import { McpServer } from '@modelcontextprotocol/server';
+import { Hono } from 'hono';
+import * as z from 'zod/v4';
+
+const server = new McpServer({ name: 'notes', version: '1.0.0' });
+server.registerTool('add-note', { description: 'Append a note', inputSchema: z.object({ text: z.string() }) }, async ({ text }) => ({
+    content: [{ type: 'text', text: `Saved: ${text}` }]
+}));
+
+const app = new Hono();
+app.all('/mcp', mcp(server));
+
+export default app;
+//#endregion mcp_mount
+
 //#region createMcpHonoApp_mount
 import { createMcpHonoApp } from '@modelcontextprotocol/hono';
-import { createMcpHandler, McpServer } from '@modelcontextprotocol/server';
+import { createMcpHandler } from '@modelcontextprotocol/server';
 import type { Context } from 'hono';
-import * as z from 'zod/v4';
 
 const handler = createMcpHandler(() => {
-    const server = new McpServer({ name: 'notes', version: '1.0.0' });
-    server.registerTool('add-note', { description: 'Append a note', inputSchema: z.object({ text: z.string() }) }, async ({ text }) => ({
-        content: [{ type: 'text', text: `Saved: ${text}` }]
-    }));
-    return server;
+    const factoryServer = new McpServer({ name: 'notes', version: '1.0.0' });
+    factoryServer.registerTool(
+        'add-note',
+        { description: 'Append a note', inputSchema: z.object({ text: z.string() }) },
+        async ({ text }) => ({
+            content: [{ type: 'text', text: `Saved: ${text}` }]
+        })
+    );
+    return factoryServer;
 });
 
-const app = createMcpHonoApp();
-app.all('/mcp', (c: Context) => handler.fetch(c.req.raw, { parsedBody: c.get('parsedBody') }));
-
-export default app;
+const factoryApp = createMcpHonoApp();
+factoryApp.all('/mcp', (c: Context) => handler.fetch(c.req.raw, { parsedBody: c.get('parsedBody') }));
 //#endregion createMcpHonoApp_mount
 
 //#region createMcpHonoApp_allowedHosts

packages/middleware/hono/README.md

@@ -6,6 +6,7 @@ This package is a thin Hono integration layer for [`@modelcontextprotocol/server
 
 It does **not** implement MCP itself. Instead, it helps you:
 
+- serve an `McpServer` as a single Hono middleware with `mcp(server)`
 - create a Hono app with sensible defaults for MCP servers
 - parse JSON request bodies and expose them as `c.get('parsedBody')` for Streamable HTTP transports
 - add DNS rebinding protection via Host header validation (recommended for localhost servers)
@@ -18,17 +19,53 @@ npm install @modelcontextprotocol/server @modelcontextprotocol/hono hono
 
 ## Exports
 
+- `mcp(server, options?)` — the one-call way to serve an MCP server as a Hono middleware
 - `createMcpHonoApp(options?)`
 - `hostHeaderValidation(allowedHostnames)`
 - `localhostHostValidation()`
 
 ## Usage
 
-### Streamable HTTP endpoint (Hono)
+### Serve an MCP server in one call (recommended)
+
+`mcp(server)` returns a single Hono middleware that serves your `McpServer` over
+Streamable HTTP. It wires JSON body parsing and localhost DNS-rebinding / origin
+protection for you, and connects the server on the first request — mount it on a
+route you already own:
+
+```ts
+import { mcp } from '@modelcontextprotocol/hono';
+import { McpServer } from '@modelcontextprotocol/server';
+import { Hono } from 'hono';
+
+const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+
+const app = new Hono();
+app.all('/mcp', mcp(server));
+```
+
+Binding to a public interface? Pass `allowedHosts` / `allowedOrigins` the same way
+as `createMcpHonoApp`, plus any transport options:
+
+```ts
+app.all(
+    '/mcp',
+    mcp(server, {
+        host: '0.0.0.0',
+        allowedHosts: ['api.example.com'],
+        transport: { enableJsonResponse: true }
+    })
+);
+```
+
+### Build the app yourself (`createMcpHonoApp`)
+
+When you need full control over routing or want to wire the transport by hand,
+`createMcpHonoApp()` returns a `Hono` app with the same defaults pre-applied:
 
 ```ts
-import { McpServer, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
 import { createMcpHonoApp } from '@modelcontextprotocol/hono';
+import { McpServer, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
 
 const server = new McpServer({ name: 'my-server', version: '1.0.0' });
 const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });

packages/middleware/hono/src/hono.ts

@@ -1,5 +1,6 @@
-import { isJsonContentType } from '@modelcontextprotocol/server';
-import type { Context } from 'hono';
+import type { McpServer, WebStandardStreamableHTTPServerTransportOptions } from '@modelcontextprotocol/server';
+import { isJsonContentType, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import type { Context, MiddlewareHandler } from 'hono';
 import { Hono } from 'hono';
 
 import { hostHeaderValidation, localhostHostValidation } from './middleware/hostHeaderValidation';
@@ -113,3 +114,56 @@ export function createMcpHonoApp(options: CreateMcpHonoAppOptions = {}): Hono {
 
     return app;
 }
+
+/**
+ * Options for the {@link mcp} middleware.
+ *
+ * Extends {@link CreateMcpHonoAppOptions} (host/origin protection) with the
+ * options forwarded to the underlying `WebStandardStreamableHTTPServerTransport`.
+ */
+export interface McpMiddlewareOptions extends CreateMcpHonoAppOptions {
+    /**
+     * Options forwarded to the `WebStandardStreamableHTTPServerTransport` that
+     * serves the connected server. Defaults to stateless mode
+     * (`sessionIdGenerator: undefined`).
+     */
+    transport?: WebStandardStreamableHTTPServerTransportOptions;
+}
+
+/**
+ * Serves an `McpServer` as a single Hono middleware — the one-call way to mount
+ * MCP on a route you already own.
+ *
+ * It wires the same defaults as {@link createMcpHonoApp} (JSON body parsing and
+ * localhost DNS-rebinding / origin protection) in front of a
+ * `WebStandardStreamableHTTPServerTransport`, connecting the server lazily on
+ * the first request.
+ *
+ * @example
+ * ```ts
+ * const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+ * const app = new Hono();
+ * app.all('/mcp', mcp(server));
+ * ```
+ *
+ * @param server - The MCP server to serve.
+ * @param options - Host/origin protection and transport options.
+ * @returns A Hono `MiddlewareHandler` that serves the MCP endpoint.
+ */
+export function mcp(server: McpServer, options?: McpMiddlewareOptions): MiddlewareHandler {
+    const { transport: transportOptions, ...appOptions } = options ?? {};
+    const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, ...transportOptions });
+    const app = createMcpHonoApp(appOptions);
+    app.all('*', (c: Context<{ Variables: { parsedBody: unknown } }>) =>
+        transport.handleRequest(c.req.raw, { parsedBody: c.get('parsedBody') })
+    );
+    return async c => {
+        if (!server.isConnected()) {
+            await server.connect(transport);
+        }
+        // The inner app is self-contained (its body parser and Host/Origin guards
+        // read only the request), so forwarding just the raw request is enough —
+        // and it avoids `c.executionCtx`, which throws off Cloudflare Workers.
+        return await app.fetch(c.req.raw);
+    };
+}