Skills mcp-builder

📦

mcp-builder

Name: mcp-builder
Author: Cam10001110101

Content revision r1 Medium Risk 🌐 Network access🔑 Env variables⚙️ External commands

Build Better MCP Servers

MCP server projects often fail when tools mirror APIs instead of supporting agent workflows. This skill guides design, implementation, testing, and evaluation for Python and TypeScript MCP servers.

Supports: Claude Codex Code(CC)

📊 66 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "mcp-builder" from https://skillstore.io/skills/cam10001110101-mcp-builder.md and its manifest at https://skillstore.io/api/skills/cam10001110101-mcp-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/cam10001110101-mcp-builder.md Signed manifest GET /api/skills/cam10001110101-mcp-builder/manifest Signed lockfile GET /api/skills/cam10001110101-mcp-builder/lockfile

Test it

Using "mcp-builder". Plan an MCP server for a project management API.

Expected outcome:

A prioritized workflow map for projects, tasks, users, and comments.
A proposed tool list with read-only and write operation boundaries.
Validation, pagination, and error-handling notes for each core tool.

Using "mcp-builder". Review my TypeScript MCP server implementation.

Expected outcome:

Findings about tool names, Zod schemas, annotations, response formats, and build configuration.
Concrete fixes for unclear descriptions, loose schemas, and oversized responses.

Using "mcp-builder". Create evaluations for my GitHub MCP server.

Expected outcome:

Ten independent read-only questions with stable expected answers.
A recommendation to remove questions that require writes or time-sensitive data.

Security Audit

Medium Risk

v8 • 7/5/2026 Open versioned report

Most static detections are false positives from Markdown examples, placeholder credentials, public documentation URLs, and TypeScript template strings. The real risks are in the bundled evaluation harness, which can launch user-selected MCP commands and send connected tool output to Anthropic for scoring. No evidence of prompt injection or hidden exfiltration intent was found in the reviewed files.

Files scanned

4,269

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

scripts/evaluation.py:327-354 scripts/connections.py:76-84

User-Supplied Command Execution in Evaluation Harness

The evaluation CLI accepts --command and --args, then passes them to StdioServerParameters. This is intended for local MCP testing, but untrusted commands can execute arbitrary code and receive supplied environment variables.

The command and args flow from argparse into create_connection and then into StdioServerParameters. The behavior is explicit but depends on user-supplied inputs.

Medium

scripts/evaluation.py:96-103 scripts/evaluation.py:116-144

Evaluation Data Sent to External Model Provider

The harness sends task prompts, tool schemas, and tool results to Anthropic messages.create for scoring. Data returned by connected MCP servers may include private content if users evaluate production systems.

The agent loop calls client.messages.create with the conversation and tool definitions, then appends tool results before later calls. This is expected evaluation behavior, but it creates a clear data-sharing boundary.

Risk Factors

🌐 Network access (32)

🔑 Env variables (10)

reference/evaluation.md:567 reference/evaluation.md:398 reference/evaluation.md:444 reference/evaluation.md:557 reference/node_mcp_server.md:700 reference/node_mcp_server.md:700 reference/node_mcp_server.md:700 reference/node_mcp_server.md:701 reference/python_mcp_server.md:538 reference/python_mcp_server.md:544

⚙️ External commands (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/cam10001110101-mcp-builder/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cam10001110101-mcp-builder/security.svg)](https://skillstore.io/skills/cam10001110101-mcp-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cam10001110101-mcp-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cam10001110101-mcp-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cam10001110101-mcp-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Cam10001110101. (2026). mcp-builder security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cam10001110101-mcp-builder/audits/8

BibTeX citation

@techreport{cam10001110101-cam10001110101-mcp-builder-2026,
  author = {Cam10001110101},
  title = {mcp-builder security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/cam10001110101-mcp-builder/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mcp-builder security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Cam10001110101"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cam10001110101-mcp-builder/audits/8"
identifiers:
  - type: other
    value: "skillstore:cam10001110101-mcp-builder:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

15 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Doyajin174 Recommended

doyajin174-mcp-builder

Skillstore Score 78

Evidence Confidence High

Skillstore usage 13

Updated

2026-08-21

anthropics

mcp-builder

Skillstore Score 75

Evidence Confidence High

Skillstore usage 15

Updated

2026-08-21

Azeem-2

azeem-2-mcp-builder

Skillstore Score 75

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

mcp-use

mcp-use-mcp-builder

Skillstore Score 68

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

shubhamsaboo

shubhamsaboo-mcp-builder

Skillstore Score 67

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-08-21

YYH211

yyh211-mcp-builder

Skillstore Score 66

Evidence Confidence High

Skillstore usage 68

Updated

2026-08-21

Cam10001110101 Current

cam10001110101-mcp-builder

Skillstore Score 66

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

DYAI2025

dyai2025-mcp-builder

Skillstore Score 66

Evidence Confidence High

Skillstore usage 7

Updated

2026-08-21

ZhanlinCui

zhanlincui-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 22

Updated

2026-08-21

92Bilal26

92bilal26-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 17

Updated

2026-08-21

sickn33

sickn33-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-08-21

ArtemisAI

artemisai-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

ComposioHQ

composiohq-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

AutumnsGrove

autumnsgrove-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

davila7

davila7-mcp-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design a New MCP Integration

Plan tools, schemas, errors, pagination, and response formats before implementing an external API integration.

Improve Existing MCP Tools

Review an existing server for agent usability, context efficiency, validation quality, and clear tool descriptions.

Evaluate Server Quality

Create read-only evaluation questions and run an LLM-based harness to measure whether tools solve realistic tasks.

Try These Prompts

Plan an MCP Server

Help me plan an MCP server for [service]. Identify the most valuable user workflows, proposed tools, required authentication, and response formats.

Implement Core Tools

Using this skill, implement the initial MCP server for [service] in [Python or TypeScript]. Include validation, error handling, pagination, and clear tool descriptions.

Review Tool Design

Review my MCP server for workflow coverage, naming, schemas, annotations, response size, and error messages. Suggest focused changes before adding new tools.

Create and Run Evaluations

Create ten read-only evaluation questions for this MCP server, verify the expected answers, then run the evaluation harness and summarize tool quality improvements.

Best Practices

Start with real user workflows, then design tools that complete those workflows with minimal calls.
Use strict input validation, clear annotations, bounded pagination, and concise default responses.
Evaluate only trusted MCP servers and avoid sending private tool results to external model APIs.

Avoid

Do not wrap every API endpoint as a separate tool without workflow design.
Do not run the evaluation harness with untrusted commands, URLs, headers, or environment variables.
Do not create evaluation questions that require destructive actions or unstable answers.