Custom Tools Advanced
Claude Code comes with powerful built-in tools, but you can extend it with custom tools via MCP servers. This lets Claude interact with databases, APIs, deployment systems, and any other service your workflow needs.
Understanding Built-in Tools
Before creating custom tools, understand what Claude Code already provides:
| Tool | Purpose | Key Capabilities |
|---|---|---|
| Read | Read file contents | Any file type, line ranges, images, PDFs |
| Write | Create/overwrite files | Full file creation and replacement |
| Edit | Modify existing files | String replacement, preserves formatting |
| Bash | Run shell commands | Any CLI tool, scripts, builds, tests |
| Glob | Find files by pattern | Fast file matching with glob syntax |
| Grep | Search file contents | Regex search, ripgrep-based |
Building a Custom MCP Server
A minimal MCP server in TypeScript that provides a custom tool:
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"; import { z } from "zod"; const server = new McpServer({ name: "my-custom-tools", version: "1.0.0" }); // Define a custom tool server.tool( "query_database", "Execute a read-only SQL query against the application database", { query: z.string().describe("SQL SELECT query to execute"), limit: z.number().optional().default(100).describe("Max rows") }, async ({ query, limit }) => { // Validate: only allow SELECT queries if (!query.trim().toUpperCase().startsWith("SELECT")) { return { content: [{ type: "text", text: "Error: Only SELECT queries allowed" }] }; } // Execute query (use your database library) const results = await db.query(`${query} LIMIT ${limit}`); return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }] }; } ); // Start the server const transport = new StdioServerTransport(); await server.connect(transport);
Registering Your Custom Server
{
"mcpServers": {
"my-tools": {
"command": "npx",
"args": ["tsx", "./mcp-server/index.ts"],
"env": {
"DATABASE_URL": "$DATABASE_URL"
}
}
}
}
Tool Permissions and Security
Input Validation
Always validate inputs. Use Zod schemas to enforce types. Reject dangerous operations like DROP, DELETE, or arbitrary file writes.
Least Privilege
Give tools the minimum permissions needed. Use read-only database users. Restrict file access to specific directories.
Audit Logging
Log every tool invocation with parameters and results. This helps debugging and provides a security audit trail.
Rate Limiting
Add rate limits to prevent excessive API calls or database queries. Return clear error messages when limits are hit.
Example: API Integration Tool
server.tool( "check_deployment_status", "Check the status of a deployment in our CI/CD system", { environment: z.enum(["staging", "production"]), deploy_id: z.string().optional() }, async ({ environment, deploy_id }) => { const url = deploy_id ? `https://api.deploy.internal/status/${deploy_id}` : `https://api.deploy.internal/latest/${environment}`; const response = await fetch(url, { headers: { "Authorization": `Bearer ${process.env.DEPLOY_TOKEN}` } }); const data = await response.json(); return { content: [{ type: "text", text: `Deployment Status (${environment}): - Status: ${data.status} - Version: ${data.version} - Deployed: ${data.deployed_at} - Health: ${data.health_check}` }] }; } );
Ready to Go Deeper?
Live instructor-led courses from our partners. Affiliate disclosure.
AI & ML Courses - 30% Off
Live instructor-led AI, machine learning, data science, and cloud courses for working professionals. Use code Limited30 at checkout.
EdurekaDataCamp - AI & Data Science
Hands-on Python, machine learning, and AI courses with interactive exercises and real projects.
DataCampedX - Top AI Courses
University-level AI courses from MIT, Harvard, Stanford. Earn certificates that employers recognize.
edX