# Patterns

Canonical URL: https://vercel-mcp-reference.vercel.app/patterns/
Markdown: https://vercel-mcp-reference.vercel.app/patterns.md
Audience: engineer, architect, security. MCP spec version: 2026-07-28. Last reviewed: 2026-08-26. Status: stable.

Reusable ways to structure MCP servers and the systems around them, re-grounded
for Vercel. Each pattern states a problem, the shape that solves it, and the
security trade-offs; most also have a runnable TypeScript server under
`examples` (in the repository) and an illustrative infrastructure companion
under `terraform/patterns/` (`terraform/README.md`, in the repository). Where the platform
changes the pattern (no resident processes, no server-to-server network, edge
controls in front of every route), the page says so instead of pretending the
translation is free.

## Pages

- [Adapter](https://vercel-mcp-reference.vercel.app/patterns/adapter/) - a thin server that wraps one **untouched** backend
  (REST, SQL, CLI) and exposes a curated slice as tools; on Vercel that is one
  Function route in its own project, and the backend credential's scope is its
  blast radius.
- [Sidecar](https://vercel-mcp-reference.vercel.app/patterns/sidecar/) - isolation for risky work. Vercel has no
  pod-with-two-containers, so the pattern reshapes: Vercel Sandbox for
  per-request isolation, or a separate project gated by Deployment Protection
  for a long-lived service sidecar.
- [Facade](https://vercel-mcp-reference.vercel.app/patterns/facade/) - one MCP surface fronting many backends behind a single
  namespaced endpoint; rewrites and the Firewall attach at the same edge, and
  one process spans every backend credential.
- [Least privilege](https://vercel-mcp-reference.vercel.app/patterns/least-privilege/) - grant each server, tool, and
  credential the minimum capability it needs and deny everything else by
  default; OIDC federation instead of static cloud keys.
- [Trust boundaries](https://vercel-mcp-reference.vercel.app/patterns/trust-boundaries/) - mutually untrusted servers with no
  direct server-to-server path; the host mediates any cross-server composition.
- [Orchestrator](https://vercel-mcp-reference.vercel.app/patterns/orchestrator/) - the host-side pattern for composing several
  deployed servers into one coherent, isolated surface (it lives in the host,
  not in a server).
- [Query vs command](https://vercel-mcp-reference.vercel.app/patterns/query-vs-command/) - a tool-design pattern: keep read
  ("query") tools separate from write or side-effecting ("command") tools, with
  tool annotations carrying the difference.
- [Async jobs](https://vercel-mcp-reference.vercel.app/patterns/async-jobs/) - return an opaque handle fast, do the work out
  of band, stream progress, and fetch the result idempotently by handle;
  `maxDuration` makes this pattern load-bearing on Vercel.

## Where to look now

- `terraform/patterns/` (`terraform/README.md`, in the repository) - the infra-relevant
  patterns expressed with the official `vercel/vercel` provider
  (validate-checked, never applied in CI).
- `examples` (in the repository) - runnable TypeScript MCP servers that
  implement these patterns at the protocol level.
- [Least privilege](https://vercel-mcp-reference.vercel.app/patterns/least-privilege/) and
  [Trust boundaries](https://vercel-mcp-reference.vercel.app/patterns/trust-boundaries/) - the security backbone the other
  patterns lean on.
- [Serverless sessions](https://vercel-mcp-reference.vercel.app/internals/serverless-sessions/) - how every one of
  these shapes behaves when a request may land on a fresh function instance.