Training course · Model Context Protocol (MCP) · Node.js Back End

Model Context Protocol (MCP) for Node.js Back-End Developers

Build and connect MCP servers securely: tools, resources and prompts for Claude Code, Cursor, Copilot and your own AI agents.

Duration
2 days (14 hrs)
Format
Online or on-site
Language
German or English
Participants
open dates or exclusive for your team
Certificate
Certificate of attendance

Overview

“Model Context Protocol (MCP) for Node.js Back-End Developers” is a hands-on course for roles such as Back-end developers using Express, Fastify or NestJS, Full-stack developers responsible for API layers and Developers building serverless functions and integration services. Rather than learning Model Context Protocol (MCP) in the abstract, you work on tasks from your daily routine – with examples, exercises and templates from Node.js Back End.

The Model Context Protocol is an open standard that gives AI applications a uniform way to access external tools, data sources and workflows. Instead of building separate integrations for every assistant, you implement an MCP server once and use it in Claude Code, Claude Desktop, Cursor, GitHub Copilot, VS Code and your own agents. In this two-day course you learn the host, client and server architecture, the three core primitives of tools, resources and prompts, and the stdio and Streamable HTTP transports, applying each of them directly in your own code.

On day one you use the official TypeScript or Python SDK to build an MCP server that exposes internal APIs, databases or files to AI assistants in a controlled way, and you test it with the MCP Inspector. Day two covers remote servers, OAuth-based authorisation, security risks such as prompt injection and tool poisoning, and operations, logging and governance in an enterprise setting. You learn to write tool descriptions that models use reliably, and you leave knowing how to integrate MCP servers safely into your development and agent landscape.

For many teams, Node.js is the backbone of REST and GraphQL APIs, real-time services, serverless functions and integration layers. Typical back-end work follows recurring patterns: routes and validation, database access with Prisma, Drizzle or TypeORM, authentication, error handling, logging and tests against real dependencies. AI coding assistants and agents handle these patterns reliably once they understand the project architecture. They generate endpoints from OpenAPI specifications, migrate Express applications to modular structures, write integration tests with Testcontainers and analyse memory leaks or event-loop-blocking operations. This course teaches you to use agents in a way that keeps security, observability and maintainability firmly intact.

The course is delivered live – either online in a virtual classroom or on-site in our training rooms in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run it exclusively for your team.

Who is this course for?

  • Back-end developers using Express, Fastify or NestJS
  • Full-stack developers responsible for API layers
  • Developers building serverless functions and integration services
  • Software architects designing Node.js-based microservices

Typical challenges we address

  • Organically grown Express apps with no clear layering and scattered error handling
  • Insufficient input validation and weaknesses in authentication and authorisation
  • Performance issues caused by blocking code or memory leaks that are hard to diagnose
  • Missing integration tests against databases, queues and external APIs

What you will be able to do

  • You explain the MCP architecture and choose between tools, resources and prompts for each use case.
  • You develop your own MCP server in TypeScript or Python and test it systematically.
  • You connect MCP servers to Claude Code, Cursor, Copilot and custom agents.
  • You run remote servers using Streamable HTTP and OAuth-based authorisation.
  • Have AI agents build endpoints, data layers and integration tests that fit your Node.js architecture.
  • Use AI to analyse performance problems, memory leaks and security weaknesses in the back end.
  • Define guardrails so that generated back-end code meets your standards for validation, logging and error handling.

Course outline

Day 1

Module 1 Architecture and core concepts
  • Roles of host, client and server and the lifecycle of a connection
  • JSON-RPC messages, capability negotiation and notifications
  • Tools, resources and prompts: choosing the right primitive
  • Client features such as sampling, roots and elicitation at a glance
Module 2 Building your own MCP server
  • Setting up a server with the official TypeScript or Python SDK
  • Defining tools cleanly with JSON Schema for inputs and outputs
  • Exposing resources and resource templates for documents, records and configuration
  • Testing and debugging with the MCP Inspector and meaningful error messages
Module 3 Connecting to Claude Code, Cursor, Copilot and agents
  • Configuring local stdio servers and remote servers in clients
  • Project-level and user-level configuration, approvals and permissions
  • Writing tool descriptions that models reliably select correctly
  • Integrating MCP servers into custom agents built with the Claude Agent SDK or OpenAI Agents SDK
Module 4 Transport, authorisation and operations
  • Streamable HTTP, session management and stateless servers
  • OAuth-based authorisation, token validation and integration with existing identity providers
  • Deploying as containers, on serverless platforms or behind a gateway
  • Logging, monitoring, rate limiting and versioning tool interfaces

Day 2

Module 5 Security and governance
  • Threats: prompt injection via tool results, tool poisoning, confused deputy
  • Least privilege, confirmation requirements and sandboxing
  • Reviewing and approving third-party servers within the organisation
  • Data protection, logging of personal data and requirements under GDPR and the EU AI Act
Module 6 Practice lab: Node.js Back End
  • API endpoints from specifications
  • Database access and migrations
  • Integration tests with Testcontainers
  • Restructuring Express applications
  • Analysing performance and memory leaks
  • Security hardening
Module 7 Data protection, quality & transfer to daily work
  • Back ends often process personal data: production data, logs and database dumps should never go into prompts unfiltered, and credentials from environment variables must stay excluded. Vet new npm dependencies for supply-chain risk and licensing, and for critical services take the security requirements of NIS2 into account.
  • Ground rules for safe AI use in your team
  • Checking results: facts, sources, tests and the four-eyes principle
  • Personal action plan for the next 30 days
  • Open questions, outlook and resources for further learning

Practical scenarios from your field

API endpoints from specifications

From an OpenAPI or GraphQL schema, the agent generates routes or resolvers, validation with Zod or class-validator, service layers and consistent error responses – all matching your existing project structure.

Database access and migrations

The AI models schemas for Prisma, Drizzle or TypeORM, writes migrations, optimises queries with indexes and transactions and explains the impact on existing data before rollout.

Integration tests with Testcontainers

The assistant writes tests that spin up real databases, Redis or message brokers in containers, seed data and exercise API endpoints end to end with Supertest against realistic dependencies.

Restructuring Express applications

Monolithic Express projects are split into modules with controllers, services and repositories, middleware is standardised and callback code moved to async/await – backed by existing and new tests.

Analysing performance and memory leaks

The AI interprets heap snapshots, profiler output and logs, identifies operations blocking the event loop and proposes fixes such as streams, worker threads or caching.

Security hardening

The agent reviews authentication flows using JWTs or sessions, adds rate limiting, secure HTTP headers and input validation and checks the code against the OWASP API security risks.

Possible hands-on projects

Webhook relay service

A Fastify service that receives webhooks from various SaaS providers, verifies signatures, queues events and forwards them to internal systems with retry logic.

Job queue with dashboard

A background-processing service built on BullMQ and Redis, with retry strategies, a monitoring UI and integration tests. Failed jobs can be inspected and retried directly from the UI.

API gateway prototype

A lean gateway service with authentication, rate limiting, request logging and routing to several back-end services, developed entirely by an AI agent.

Prerequisites

Solid programming skills in TypeScript/JavaScript or Python and a basic understanding of HTTP APIs and JSON. Some experience using AI assistants in day-to-day development is helpful. Back-end development experience with Node.js and JavaScript or TypeScript, plus a working knowledge of databases, HTTP and Git.

Technical requirements

A laptop with Node.js or Python, Git and a code editor, plus access to at least one MCP-capable client such as Claude Code, Claude Desktop, Cursor or VS Code with Copilot.

Data protection & compliance

Back ends often process personal data: production data, logs and database dumps should never go into prompts unfiltered, and credentials from environment variables must stay excluded. Vet new npm dependencies for supply-chain risk and licensing, and for critical services take the security requirements of NIS2 into account.

Suggested dates

All dates are suggestions – your preferred date is always possible.

  • Wed, 25 November 2026 – Thu, 26 November 2026 Online Request
  • Thu, 10 December 2026 – Fri, 11 December 2026 Salzburg Request
  • Wed, 16 December 2026 – Thu, 17 December 2026 Online Request
  • Thu, 7 January 2027 – Fri, 8 January 2027 Online Request
  • Mon, 11 January 2027 – Tue, 12 January 2027 Bremen Request
  • Mon, 18 January 2027 – Tue, 19 January 2027 Online Request

Frequently asked questions

Why would I need my own MCP server?

Whenever AI assistants need access to internal systems such as ticketing tools, databases, documentation or line-of-business applications. Your own server defines precisely which actions and data are available and can then be reused across several clients. That avoids isolated one-off integrations and keeps access firmly under your control.

Which programming language does the course use?

You can choose between TypeScript and Python, both of which have official SDKs. The concepts are identical and all exercises are available in both versions. Developers working in other languages still benefit, because the protocol is language-agnostic and SDKs for other languages follow a similar structure.

How secure is MCP for enterprise use?

The protocol provides mechanisms for authorisation and permissions, but real-world security depends on implementation and operations. Risks such as prompt injection through tool results or over-privileged servers are genuine. We cover concrete countermeasures, approval processes for third-party servers and how to handle personal data.

Is the course suitable for both NestJS and Express?

Yes. We work with framework-neutral principles such as layering, validation and testability, and show with examples how to capture the conventions of Express, Fastify or NestJS in instruction files. That way the assistant generates code that fits your framework and your project structure rather than generic boilerplate.

How do I stop the AI from producing insecure back-end code?

Through clear rules, automated checks and critical review. On the course you define security rules for validation, authentication and data access, plug in static analysis and dependency scanning, and learn to spot typical weaknesses in generated code, such as missing authorisation checks or unsafe queries.

How much does “Model Context Protocol (MCP) for Node.js Back-End Developers” cost?

The course costs a flat €949 plus VAT per participant – whether online or on-site. This includes 2 training day(s) with a live trainer, course materials, a lab environment and a certificate of attendance.

Can I suggest my own date?

Yes. Our suggested dates are just a guide. In the request form you can always describe your preferred date or period in free text – we check availability and confirm within one working day.

Is the course online or on-site?

Both are possible: live online in a virtual classroom or on-site in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart or Kaiserslautern. We can also run the course exclusively for your team.

More courses for Node.js Back-End Developers

More Model Context Protocol (MCP) courses

All 29 Model Context Protocol (MCP) courses

Model Context Protocol (MCP) · MunichModel Context Protocol (MCP) · SalzburgModel Context Protocol (MCP) · BerlinModel Context Protocol (MCP) · AugsburgModel Context Protocol (MCP) · HanoverModel Context Protocol (MCP) · BremenModel Context Protocol (MCP) · StuttgartModel Context Protocol (MCP) · KaiserslauternModel Context Protocol (MCP) · Online