A production-grade TypeScript framework for building MCP Servers, introducing the MVA (Model-View-Agent) architecture pattern with 8 built-in anti-hallucination mechanisms and a Presenter outbound firewall.
Vurb.ts positions itself as "The Express.js for MCP Servers" — a TypeScript framework purpose-built for production-grade MCP (Model Context Protocol) servers, currently at version 3.17.1, structured as an npm workspaces monorepo.
MVA Architecture#
The core innovation is the MVA (Model-View-Agent) three-layer architecture:
- Model Layer: Eloquent/Laravel-style domain model factory (
defineModel()) withm.casts(),m.hidden(),m.guarded(),m.fillable(),m.timestamps(), auto-generating Zod schemas. - View Layer (Presenter): An outbound firewall controlling what the LLM sees — data, rules, and actions. Features fast-redact-based PII redaction (GDPR/LGPD/HIPAA), Zod schema whitelist memory-level filtering, Late Guillotine pattern (UI computes with real values but LLM sees
[REDACTED]), cognitive guardrails via.agentLimit(), HATEOAS-style next-step suggestions (.suggestActions()), relation composition (.embed()), and server-side UI rendering (ECharts/Mermaid). - Agent Layer (Fluent API): Semantic verbs
f.query()/f.mutation()/f.action()for type-safe tool definitions, with 12.with*()chainable methods, zero-boilerplate.proxy()API proxying (auto HTTP method inference, path parameter substitution, response unwrapping),.fromModel()parameter import, and tRPC-style.use()middleware.
Anti-Hallucination System#
Eight mechanisms: Action Consolidation (merging operations to reduce tool count), TOON Encoding (pipe-delimited compact descriptions), Zod .strict() build-time validation, Self-Healing Errors (directed correction prompts), Cognitive Guardrails (.limit() truncation), Agentic Affordances (HATEOAS next-step hints), JIT Context Rules (rules propagate with data), and State Sync (RFC 7234-style cache control signals).
FSM State Gate leverages XState finite state machines for temporal anti-hallucination — physically removing unavailable tools from tools/list based on current state, with declarative .bindState(states, event) binding that transitions only on success.
Runtime Protections#
.concurrency()— Semaphore + queue concurrency control.egress()— Maximum payload size limits- Intent Mutex — Auto-serialization of concurrent destructive tool calls
- Load shedding — Self-healing
SERVER_BUSYerrors
Governance Stack & Prompt Engine#
ToolContract materialization, BehaviorDigest (SHA-256), CapabilityLockfile (vurb.lock), CryptoAttestation (HMAC-SHA-256), with vurb lock --check CI gate validation. Prompt Engine provides definePrompt() server-side templates (Zod and JSON descriptors), with PromptMessage.fromView() sharing a single Presenter source between tools and prompts. SKILL.md delivers machine-readable architecture contracts compatible with Cursor, Claude Code, GitHub Copilot, Windsurf, and Cline.
Scaffolding & Deployment#
vurb create offers 5 vectors: vanilla (zero-dependency file routing), prisma (field-level secure CRUD), n8n (workflow bridging), openapi (OpenAPI 3.x/Swagger 2.0 → MCP auto-generation), oauth (RFC 8628 Device Flow auth). Deployment targets: Vinkius Edge, Vercel Functions, Cloudflare Workers, AWS.
Developer Experience#
- HMR hot-reload dev server (
vurb dev) - Real-time TUI Inspector dashboard (
vurb inspect) for tool calls, latency, errors - File-based routing (
src/tools/directory auto-maps to tool namespaces) - Tree-shakeable subpath exports:
@vurb/core/client,/ui,/presenter,/schema,/dev,/prompt
Key Design Patterns#
- Late Guillotine Pattern: PII redaction executes after UI/rules computation, preserving UI integrity while protecting data
- Standard Schema v1: Supports Valibot, ArkType, TypeBox beyond Zod
- Tool Exposition: Compile-time topological compiler with flat or grouped strategies
- Select Reflection:
_selectparameter for context window optimization, protected by Late Guillotine
Monorepo Packages#
| Package | Purpose |
|---|---|
@vurb/core | Core framework (Fluent API, Presenter, Model, Router, Middleware) |
@vurb/api-key | API Key authentication |
@vurb/aws | AWS adapter |
@vurb/cloudflare | Cloudflare Workers adapter |
@vurb/vercel | Vercel Functions adapter |
@vurb/inspector | Real-time TUI dashboard |
@vurb/jwt | JWT authentication |
@vurb/n8n | n8n workflow bridging |
@vurb/oauth | OAuth / RFC 8628 Device Flow |
@vurb/openapi | OpenAPI → MCP generator |
@vurb/prisma-gen | Prisma → MCP generator (field-level security) |
@vurb/skills | Agent Skills — progressive instruction dispatch |
@vurb/swarm | Federated Handoff Protocol — zero-trust B2BUA multi-agent collaboration |
@vurb/testing | Full-pipeline in-memory testing utilities |
@vurb/yaml | YAML configuration support |
Multi-Agent & Ecosystem#
@vurb/swarm enables zero-trust B2BUA multi-agent collaboration via Federated Handoff Protocol. System bridging covers OpenAPI → MCP, n8n workflows → MCP tools, Prisma → MCP (field-level security). AI client pre-configuration spans Cursor, Claude Desktop, Claude Code, Windsurf, Cline, VS Code + Copilot. Requires Node.js >= 18.0.0, uses Vitest for testing, TypeDoc + VitePress for docs, Apache-2.0 license, authored by Renato Marinho (Vinkius Labs).
Unconfirmed Information#
- https://vurb.dev returned no readable content (likely SPA/JS-rendered), official documentation availability unconfirmed
- npm package names not directly verified (presumed
@vurb/coreetc.) - Vinkius Edge deployment platform details not documented in the repo
- No production usage cases listed