Skills MCP Integration

📦

MCP Integration

Name: MCP Integration
Author: anthropics

v0.1.0 Content revision r1 Medium Risk 🌐 Network access🔑 Env variables⚙️ External commands

Configure MCP Servers for Claude Code

Plugin developers need a clear path for connecting external tools and services. This skill explains MCP configuration, authentication, tool naming, testing, and secure usage patterns.

Supports: Claude Codex Code(CC)

📊 68 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "MCP Integration" from https://skillstore.io/skills/mcp-integration.md and its manifest at https://skillstore.io/api/skills/mcp-integration/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mcp-integration.md Signed manifest GET /api/skills/mcp-integration/manifest Signed lockfile GET /api/skills/mcp-integration/lockfile

Test it

Using "MCP Integration". A developer asks which MCP transport to use for a cloud project tracker.

Expected outcome:

The skill recommends a hosted transport with OAuth, explains why local stdio is not needed, and lists required setup checks.

Using "MCP Integration". A plugin author needs authentication documentation for an API-backed MCP server.

Expected outcome:

The skill produces a setup checklist covering environment variables, token permissions, secure storage, and troubleshooting steps.

Using "MCP Integration". A team wants to validate MCP tools before publishing a plugin.

Expected outcome:

The skill returns a test plan for connection checks, tool discovery, invalid credentials, rate limits, and user-facing errors.

Security Audit

Medium Risk

v9 • 7/20/2026 Open versioned report

The static alerts are predominantly documentation examples, Markdown formatting, placeholder URLs, and credential placeholders rather than executable behavior in this skill. No prompt injection, credential exfiltration, or hidden execution was found. Installing an MCP configuration can still cause a local process or third-party package to run, so users must review and pin servers before enabling them.

Files scanned

2,249

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:72-80

Unpinned Third-Party MCP Package Execution

The stdio example configures npx with automatic acceptance for an MCP package. Enabling this configuration can install and run third-party package code without a version pin or review step.

The configuration explicitly uses npx with -y and a package name. This behavior can execute a package, though it is presented as an example rather than automatic skill behavior.

Risk Factors

🌐 Network access (37)

🔑 Env variables (22)

⚙️ External commands (50)

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/mcp-integration/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mcp-integration/security.svg)](https://skillstore.io/skills/mcp-integration?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mcp-integration?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mcp-integration/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mcp-integration.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

anthropics. (2026). MCP Integration security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/mcp-integration/audits/9

BibTeX citation

@techreport{anthropics-mcp-integration-2026,
  author = {anthropics},
  title = {MCP Integration security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/mcp-integration/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "MCP Integration security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "anthropics"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/mcp-integration/audits/9"
identifiers:
  - type: other
    value: "skillstore:mcp-integration:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

4 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

anthropics Recommended Current

mcp-integration

Skillstore Score 68

Evidence Confidence High

Skillstore usage 18

Updated

2026-08-21

Joseph OBrien

89jobrien-mcp-integration

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 16

Updated

2026-08-21

anthropics

anthropics-mcp-integration

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

davila7

davila7-mcp-integration

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add External Service Tools

Configure a Claude Code plugin to expose service actions through MCP tools.

Standardize Secure Authentication

Document OAuth, token, and environment variable setup for plugin users.

Validate MCP Plugin Behavior

Test server connections, tool discovery, authentication failures, and error handling before release.

Try These Prompts

Choose a Server Type

Help me choose the right MCP server type for a Claude Code plugin that connects to [service]. Explain the tradeoffs.

Draft Setup Guidance

Create user-facing setup instructions for an MCP plugin that uses [authentication method] and needs [required permissions].

Review Tool Permissions

Review this MCP tool plan for least-privilege access. Identify broad permissions, risky wildcards, and safer alternatives.

Design a Multi-Server Workflow

Design an MCP integration that combines [local server] and [hosted service]. Include authentication, testing, failure handling, and documentation needs.

Best Practices

Use specific MCP tool allow-lists instead of broad wildcards whenever possible.
Use HTTPS, WSS, OAuth, and environment variables for sensitive service access.
Document required permissions, setup steps, and failure modes before publishing.

Avoid

Hardcoding tokens, passwords, or service secrets in plugin configuration.
Granting agents unrestricted access to all tools from a sensitive MCP server.
Publishing example endpoints or local paths without explaining how users must replace them.