This guide wires a SmeltSec-generated MCP server into Claude Desktop on macOS, Windows, and Linux. It covers the config file location, the two CLI commands that generate the server, the exact JSON block Claude Desktop expects, and what to check when the server does not appear.
You need Node.js 22.22.2 or a newer supported engine, Claude Desktop, and a REST API or OpenAPI spec you want to expose as MCP tools. If you are starting from scratch, the SmeltSec init flow will scaffold a blank server. The generation flow runs the built-in gate checks and reports any external checks skipped because their binaries or inputs are unavailable.
Claude Desktop looks in a fixed path per operating system. The file is plain JSON and the app creates it on first launch if it does not exist.
On macOS the Application Support folder is hidden by default. Open Finder, press Cmd+Shift+G, and paste the path. On Windows, paste %APPDATA%\Claude into Run. If the file does not exist, create it with an empty object literal.
The public npm release is 0.1.0. Pin that version so the commands in this guide match your installed CLI. Review its package files and dependencies before installation.
npm install -g @smeltsec/cli@0.1.0 smeltsec --version
The version check confirms the binary is resolvable. If you see a command-not-found error, your npm global bin directory is not on PATH. Run npm config get prefix, add the returned path plus /bin to your shell rc file, and open a new terminal.
smeltsec init interactively creates the project layout and asks for an output directory. smeltsec ci evaluates that generated directory against configured security and quality thresholds.
smeltsec init smeltsec ci ./my-server --output ./my-server/smeltsec-ci.json cd my-server npm run build
After npm run build, the server entry point is at dist/server.js. Copy the absolute path. You will paste it into the config in the next step.
Claude Desktop expects an mcpServers object keyed by server name. Each entry sets a command and an args array. Use the absolute path to dist/server.js. Avoid relative paths since Claude Desktop runs the command from its own working directory.
{
"mcpServers": {
"my-server": {
"command": "node",
"args": ["/Users/you/projects/my-server/dist/server.js"],
"env": {
"API_KEY": "sk-..."
}
}
}
}The env block passes environment variables to the server process. Keep secrets here rather than hardcoding them in the server source. On Windows, escape backslashes in the path: C:\\Users\\you\\projects\\my-server\\dist\\server.js.
Quit Claude Desktop fully. On macOS, right-click the dock icon and pick Quit. Closing the window is not enough; the process stays alive. Relaunch and start a new chat.
A hammer or plug icon appears next to the chat input when at least one MCP server is connected. Click it to see the list of connected servers and the tools each one exposes. my-server should be there with every tool your OpenAPI spec defined.
Your JSON is invalid. Open claude_desktop_config.json in VS Code or run jq . on it. A trailing comma or unescaped backslash will silently disable MCP. Fix the JSON and restart.
Check the log at ~/Library/Logs/Claude/mcp-server-my-server.log on macOS. A crash during tool registration usually means a missing env var or an SDK version mismatch. Re-run smeltsec ci . to catch the root cause.
Claude Desktop does not inherit your shell PATH. Replace "node" with the absolute path, for example /usr/local/bin/node or the path nvm installed. Run which node to find it.
The server is exiting on stdin close. SmeltSec templates handle this by default, but a hand-edited main loop often does not. Check that the MCP stdio transport is wired to process.stdin and process.stdout, not to a spawned child.
Free tier includes Gate 1 scanning and 5 generations per month.