スキル mcp-builder
📦
mcp-builder
コンテンツリビジョン r1 中リスク 🔑 環境変数⚙️ 外部コマンド🌐 ネットワークアクセス
Build MCP Servers with mcp-use
Building MCP servers requires consistent tool, resource, prompt, and widget patterns. This deprecated skill documents mcp-use patterns and directs users to the newer mcp-app-builder skill.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "mcp-builder" from https://skillstore.io/skills/mcp-use-mcp-builder.md and its manifest at https://skillstore.io/api/skills/mcp-use-mcp-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「mcp-builder」を使用しています。 Create a tool that gets weather by city.
期待される結果:
- A tool plan with a city input, validation guidance, and missing-key error behavior.
- A response outline that returns a concise weather summary to the model.
「mcp-builder」を使用しています。 Build a recipe search widget.
期待される結果:
- A widget flow with search inputs, result props, loading states, and empty-result behavior.
- A server-side tool outline that connects structured results to the widget.
「mcp-builder」を使用しています。 Add user profile resources to my server.
期待される結果:
- A resource design with stable URIs, MIME type selection, and read-only response guidance.
- A note to use parameterized resources when user identifiers are part of the URI.
セキュリティ監査
中リスクv4 • 2026/7/5 バージョン別レポートを開く
Static findings are false positives from Markdown examples, TypeScript template literals, placeholder environment variables, and sample URLs. No prompt injection or malicious exfiltration intent was found. The main risk is the deprecated skill telling agents to install a replacement with npx without explicit confirmation.
12
スキャンされたファイル
1,666
解析済み行数
0
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
中
Agent-Directed Replacement Skill Installation
SKILL.md deprecates this skill and instructs the agent to install mcp-app-builder with npx if it is missing. This can trigger network package execution and skill installation outside the user's immediate request, so it should require explicit user confirmation.
The install instruction is explicit and appears in the activation description, so agents may treat it as workflow guidance. It points to a same-repository replacement and is not disguised as a system override, so severity is medium.
リスク要因
🔑 環境変数 (18)
evals/implementation.json:16 evals/implementation.json:16 evals/implementation.json:16 references/tools-and-resources.md:18 references/tools-and-resources.md:275 references/tools-and-resources.md:312 references/tools-and-resources.md:18 references/tools-and-resources.md:275 references/tools-and-resources.md:312 references/tools-and-resources.md:275 references/tools-and-resources.md:280 references/tools-and-resources.md:281 references/tools-and-resources.md:283 references/tools-and-resources.md:292 references/widgets.md:86 references/widgets.md:359 references/widgets.md:86 references/widgets.md:359
⚙️ 外部コマンド (37)
references/resource-templates.md:105-131 references/resource-templates.md:137-139 references/response-helpers.md:37-38 references/response-helpers.md:72 references/response-helpers.md:74 references/response-helpers.md:75-76 references/response-helpers.md:88-89 references/response-helpers.md:100-107 references/response-helpers.md:107-109 references/response-helpers.md:224-226 references/response-helpers.md:226-230 references/response-helpers.md:263-277 references/response-helpers.md:277-279 references/tools-and-resources.md:34-37 references/tools-and-resources.md:63-67 references/tools-and-resources.md:87-90 references/tools-and-resources.md:104-109 references/tools-and-resources.md:109-116 references/tools-and-resources.md:218-219 references/tools-and-resources.md:219-222 references/tools-and-resources.md:259-263 references/tools-and-resources.md:263-267 references/tools-and-resources.md:283-287 references/widgets.md:106-112 references/widgets.md:171-173 references/widgets.md:389-395 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:26 SKILL.md:27 SKILL.md:33-54 SKILL.md:54-58 SKILL.md:58-60 SKILL.md:60 SKILL.md:62
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/mcp-use-mcp-builder/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/mcp-use-mcp-builder?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/mcp-use-mcp-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mcp-use-mcp-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/mcp-use-mcp-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
mcp-use. (2026). mcp-builder security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mcp-use-mcp-builder/audits/4BibTeX形式の引用
@techreport{mcp-use-mcp-use-mcp-builder-2026,
author = {mcp-use},
title = {mcp-builder security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/mcp-use-mcp-builder/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mcp-builder security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "mcp-use"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/mcp-use-mcp-builder/audits/4"
identifiers:
- type: other
value: "skillstore:mcp-use-mcp-builder:audit:4"
description: "Skillstore immutable audit report identifier"
バリアントを比較
インストール可能なバリアント 15 件各作者のスキルは個別のインストール項目として維持されます。推奨バリアントは Skillstore の証拠で順位付けされます。
このバリアントが首位の理由
Skillstore スコアが最高
作者 / ソース Skillstore スコア 証拠の信頼度 Skillstore 利用状況 更新済み
cam10001110101-mcp-builder
Skillstore スコア 66
証拠の信頼度 高
Skillstore 利用状況 10
更新済み
2026-09-09
Skillstore スコア
このスコアの理由 証拠の信頼度: 高 45
アーキテクチャ
85
保守性
87
コンテンツ
69
コミュニティ
91
仕様準拠
作成できるもの
Prototype MCP Tools
Create typed MCP tools with inputs, outputs, error handling, and response helpers.
Design Interactive Widgets
Connect MCP tools to React TSX widgets that display structured results.
Review mcp-use Patterns
Find concise examples for resources, prompts, server startup, and widget metadata.
これらのプロンプトを試す
Create a Basic Tool
Use this skill to create a simple MCP tool for [task]. Include schema fields, descriptions, and error behavior.
Add a Resource
Design an MCP resource for [data source]. Explain the URI, MIME type, response helper, and read-only behavior.
Build a Widget Flow
Plan an MCP tool with a React widget for [workflow]. Define tool inputs, widget props, loading states, and follow-up actions.
Audit a Production Server
Review my mcp-use server design for [system]. Check tools, resources, prompts, widgets, environment variables, and destructive actions.
ベストプラクティス
- Use the newer mcp-app-builder skill for new projects when it is available.
- Add descriptions and validation to every schema field before exposing a tool.
- Ask users before running install commands or adding external services.
回避
- Do not treat example API URLs as production-ready integration code.
- Do not create destructive tools without clear annotations and user confirmation.
- Do not pass secrets in logs, widget props, or model-visible output.
よくある質問
Is this skill current?
No. It is marked deprecated and recommends mcp-app-builder for new MCP projects.
What framework does it cover?
It covers mcp-use patterns for MCP servers, tools, resources, prompts, response helpers, and widgets.
Can it create a full project scaffold?
No. It provides implementation guidance and examples, not a complete scaffold generator.
Does it support visual widgets?
Yes. It includes React TSX widget examples and explains how tools pass props to widgets.
Does it manage secrets?
No. It shows placeholder environment variable patterns and expects users to configure secrets safely.
Should agents run its install command automatically?
No. Agents should ask the user before running npx or installing another skill.
開発者情報
作成者
mcp-useライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
62e2a730c5cd74eab4c7164309d810de660fcea3
メンテナンスの新しさ
2026/7/18
利用状況
5 ダウンロード · 161 閲覧