Skills mcp-resources-guide
📦

mcp-resources-guide

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables

Build MCP Resource Servers

MCP server authors need repeatable patterns for exposing files, records, and API data as resources. This skill guides URI design, listing, fetching, MIME handling, caching, streaming, and testing for Claude, Codex, and Claude Code.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "mcp-resources-guide" from https://skillstore.io/skills/emillindfors-mcp-resources-guide.md and its manifest at https://skillstore.io/api/skills/emillindfors-mcp-resources-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/emillindfors-mcp-resources-guide.md Signed manifest GET /api/skills/emillindfors-mcp-resources-guide/manifest Signed lockfile GET /api/skills/emillindfors-mcp-resources-guide/lockfile

Test it

Using "mcp-resources-guide". Design resources for a documentation folder.

Expected outcome:

  • Use a docs resource scheme with paths relative to the documentation root.
  • List markdown files with names, descriptions, and text/markdown MIME types.
  • Validate paths before fetching and keep fetched content inside the allowed root.
  • Cache metadata separately from document content when files change often.

Using "mcp-resources-guide". Review a database-backed user resource.

Expected outcome:

The review identifies table allowlisting, record-level authorization, parameter binding, cache TTLs, and tests for invalid URIs.

Using "mcp-resources-guide". Improve large binary resource delivery.

Expected outcome:

  • Use size limits before reading binary content.
  • Return accurate MIME types and avoid converting binary data to text.
  • Stream or paginate large content instead of buffering everything in memory.

Security Audit

High Risk
v4 • 7/5/2026 Open versioned report

Most static findings are false positives caused by markdown code fences or illustrative Rust examples, not active command execution, secret access, or obfuscation. The audit found real insecure guidance in the examples: file URI parsing can escape a configured root, symlink following can expose unintended files, and a database example builds SQL from URI-derived table text.

1
Files scanned
561
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (4)

High
SKILL.md:257
System reconnaissance
let query = format!("SELECT * FROM {} WHERE id = $1", table);
This line builds SQL with a table name taken from the resource URI, while only the record id is bound. If copied, an attacker could control the table identifier and reach unintended data or SQL behavior.
High
SKILL.md:117-121SKILL.md:143-148SKILL.md:469-473
Path Traversal Risk in File Resource Examples
The file resource examples strip the file URI prefix and join the remaining path to a root directory without canonicalization, allowlisting, or rejection of absolute and parent-directory paths. Copied code could expose files outside the intended resource root.
The example directly converts the URI suffix into a PathBuf and reads root_path.join(path). Rust path joining can escape the root when the child is absolute, and parent traversal is not blocked.
High
SKILL.md:253-258
Unsafe Dynamic SQL From Resource URI
The database resource example reads the table name from the db URI and inserts it into a SELECT statement with string formatting. The record id is bound, but the table identifier is not allowlisted or quoted safely.
The table variable comes from URI parts and is interpolated into SQL text. This is a clear unsafe pattern if the example is copied into a real MCP server.
Medium
SKILL.md:208-210
Symlink Traversal During Resource Listing
The documentation resource example enables symlink following while walking a documentation directory. Without canonical path checks, linked files outside the intended directory could be listed as resources.
The example explicitly calls follow_links(true) during directory walking. The surrounding code strips the documentation root but does not show checks that canonical targets remain inside it.

Risk Factors

⚙️ External commands (25)
SKILL.md:42-56 SKILL.md:56-60 SKILL.md:60-68 SKILL.md:68-74 SKILL.md:74-151 SKILL.md:151-155 SKILL.md:155-192 SKILL.md:192-198 SKILL.md:198-231 SKILL.md:231-235 SKILL.md:235-274 SKILL.md:274-278 SKILL.md:278-319 SKILL.md:319-323 SKILL.md:323-361 SKILL.md:361-367 SKILL.md:367-410 SKILL.md:410-414 SKILL.md:414-436 SKILL.md:436-442 SKILL.md:442-461 SKILL.md:461-467 SKILL.md:467-483 SKILL.md:483-489 SKILL.md:489-517
📁 Filesystem access (3)
SKILL.md:496 SKILL.md:503 SKILL.md:512
🔑 Env variables (2)
SKILL.md:285 SKILL.md:298

Detected Patterns

System reconnaissance
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/emillindfors-mcp-resources-guide/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/emillindfors-mcp-resources-guide/security.svg)](https://skillstore.io/skills/emillindfors-mcp-resources-guide?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/emillindfors-mcp-resources-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/emillindfors-mcp-resources-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/emillindfors-mcp-resources-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

EmilLindfors. (2026). mcp-resources-guide security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/emillindfors-mcp-resources-guide/audits/4

BibTeX citation

@techreport{emillindfors-emillindfors-mcp-resources-guide-2026, author = {EmilLindfors}, title = {mcp-resources-guide security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/emillindfors-mcp-resources-guide/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "mcp-resources-guide security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "EmilLindfors" date-released: "2026-07-05" url: "https://skillstore.io/skills/emillindfors-mcp-resources-guide/audits/4" identifiers: - type: other value: "skillstore:emillindfors-mcp-resources-guide:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance

What You Can Build

Expose Project Files as Resources

Design URI schemes, metadata, MIME types, and fetch behavior for project documentation or source files.

Model Database Records as Resources

Plan how database records should be addressed, listed, fetched, cached, and represented for assistant context.

Optimize Large Resource Delivery

Apply caching, lazy loading, binary handling, and streaming patterns for large or expensive resource sources.

Try These Prompts

Design a Basic Resource 
Help me design an MCP resource for [data source]. Include the URI scheme, listed metadata, MIME type, and expected fetch result.
Plan Resource Templates 
Create resource URI templates for [entities]. Explain list behavior, fetch behavior, invalid URI handling, and example resource names.
Review Resource Security 
Review my MCP resource design for path traversal, SQL injection, credential exposure, authorization gaps, cache leakage, and unsafe URI parsing.
Design Caching and Streaming 
Design a caching, invalidation, and streaming strategy for MCP resources backed by [large or expensive source]. Include limits, errors, and tests.

Best Practices

  • Validate every URI component before using it in filesystem paths, database queries, or API URLs.
  • Document resource schemes, MIME types, cache lifetimes, and invalidation rules.
  • Keep resource fetching read-only, observable, and covered by success and failure tests.

Avoid

  • Joining URI paths directly to filesystem roots without canonicalization.
  • Building SQL identifiers or queries from URI text without an allowlist.
  • Caching sensitive or tenant-specific resources without scoped keys and expiry.

Frequently Asked Questions

What does this skill help me build?
It helps you design MCP resources that expose files, database records, API responses, metrics, and binary data to AI assistants.
Which programming stack does it target?
It targets Rust MCP servers that use the rmcp crate, although the resource design ideas are broadly useful.
Does it generate a complete server?
No. It provides patterns, examples, review prompts, and implementation guidance rather than a full application scaffold.
Can I use it with Claude, Codex, and Claude Code?
Yes. The guidance is written for MCP resource design and can support Claude, Codex, and Claude Code workflows.
Does it cover security?
It mentions validation and traversal prevention, but some examples need stronger production security controls.
When should I use MCP resources instead of tools?
Use resources for read-only context such as files or records. Use tools for actions, mutations, and computations.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/EmilLindfors/claude-marketplace/tree/main/plugins/rust-mcp-server/skills/mcp-resources-guide

Ref

30c73eac2afe762f6aa9c4553158769369d47351

Maintenance freshness

7/18/2026

Usage

3 downloads · 216 views

File structure

📄 SKILL.md