Skills mcp-builder
📦

mcp-builder

Content revision r1 Medium Risk 🔑 Env variables⚙️ External commands🌐 Network access

Build MCP Servers with mcp-use

Building MCP servers requires consistent tool, resource, prompt, and widget patterns. This deprecated skill documents mcp-use patterns and directs users to the newer mcp-app-builder skill.

Supports: Claude Codex Code(CC)
📊 68 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "mcp-builder" from https://skillstore.io/skills/mcp-use-mcp-builder.md and its manifest at https://skillstore.io/api/skills/mcp-use-mcp-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mcp-use-mcp-builder.md Signed manifest GET /api/skills/mcp-use-mcp-builder/manifest Signed lockfile GET /api/skills/mcp-use-mcp-builder/lockfile

Test it

Using "mcp-builder". Create a tool that gets weather by city.

Expected outcome:

  • A tool plan with a city input, validation guidance, and missing-key error behavior.
  • A response outline that returns a concise weather summary to the model.

Using "mcp-builder". Build a recipe search widget.

Expected outcome:

  • A widget flow with search inputs, result props, loading states, and empty-result behavior.
  • A server-side tool outline that connects structured results to the widget.

Using "mcp-builder". Add user profile resources to my server.

Expected outcome:

  • A resource design with stable URIs, MIME type selection, and read-only response guidance.
  • A note to use parameterized resources when user identifiers are part of the URI.

Security Audit

Medium Risk
v4 • 7/5/2026 Open versioned report

Static findings are false positives from Markdown examples, TypeScript template literals, placeholder environment variables, and sample URLs. No prompt injection or malicious exfiltration intent was found. The main risk is the deprecated skill telling agents to install a replacement with npx without explicit confirmation.

12
Files scanned
1,666
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
SKILL.md:4-7
Agent-Directed Replacement Skill Installation
SKILL.md deprecates this skill and instructs the agent to install mcp-app-builder with npx if it is missing. This can trigger network package execution and skill installation outside the user's immediate request, so it should require explicit user confirmation.
The install instruction is explicit and appears in the activation description, so agents may treat it as workflow guidance. It points to a same-repository replacement and is not disguised as a system override, so severity is medium.

Risk Factors

🔑 Env variables (18)
evals/implementation.json:16 evals/implementation.json:16 evals/implementation.json:16 references/tools-and-resources.md:18 references/tools-and-resources.md:275 references/tools-and-resources.md:312 references/tools-and-resources.md:18 references/tools-and-resources.md:275 references/tools-and-resources.md:312 references/tools-and-resources.md:275 references/tools-and-resources.md:280 references/tools-and-resources.md:281 references/tools-and-resources.md:283 references/tools-and-resources.md:292 references/widgets.md:86 references/widgets.md:359 references/widgets.md:86 references/widgets.md:359
⚙️ External commands (37)
references/resource-templates.md:105-131 references/resource-templates.md:137-139 references/response-helpers.md:37-38 references/response-helpers.md:72 references/response-helpers.md:74 references/response-helpers.md:75-76 references/response-helpers.md:88-89 references/response-helpers.md:100-107 references/response-helpers.md:107-109 references/response-helpers.md:224-226 references/response-helpers.md:226-230 references/response-helpers.md:263-277 references/response-helpers.md:277-279 references/tools-and-resources.md:34-37 references/tools-and-resources.md:63-67 references/tools-and-resources.md:87-90 references/tools-and-resources.md:104-109 references/tools-and-resources.md:109-116 references/tools-and-resources.md:218-219 references/tools-and-resources.md:219-222 references/tools-and-resources.md:259-263 references/tools-and-resources.md:263-267 references/tools-and-resources.md:283-287 references/widgets.md:106-112 references/widgets.md:171-173 references/widgets.md:389-395 SKILL.md:4 SKILL.md:5 SKILL.md:6 SKILL.md:7 SKILL.md:26 SKILL.md:27 SKILL.md:33-54 SKILL.md:54-58 SKILL.md:58-60 SKILL.md:60 SKILL.md:62
🌐 Network access (6)
references/tools-and-resources.md:283 references/tools-and-resources.md:18 references/tools-and-resources.md:283 references/widgets.md:86 references/widgets.md:204 references/widgets.md:359
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/mcp-use-mcp-builder/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mcp-use-mcp-builder/security.svg)](https://skillstore.io/skills/mcp-use-mcp-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mcp-use-mcp-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mcp-use-mcp-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mcp-use-mcp-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

mcp-use. (2026). mcp-builder security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mcp-use-mcp-builder/audits/4

BibTeX citation

@techreport{mcp-use-mcp-use-mcp-builder-2026, author = {mcp-use}, title = {mcp-builder security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/mcp-use-mcp-builder/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "mcp-builder security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "mcp-use" date-released: "2026-07-05" url: "https://skillstore.io/skills/mcp-use-mcp-builder/audits/4" identifiers: - type: other value: "skillstore:mcp-use-mcp-builder:audit:4" description: "Skillstore immutable audit report identifier"

Compare variants

15 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
Doyajin174 Recommended

doyajin174-mcp-builder

Skillstore Score 78
Evidence Confidence High
Skillstore usage 13
Updated

2026-08-21

anthropics

mcp-builder

Skillstore Score 75
Evidence Confidence High
Skillstore usage 15
Updated

2026-08-21

Azeem-2

azeem-2-mcp-builder

Skillstore Score 75
Evidence Confidence High
Skillstore usage 8
Updated

2026-08-21

mcp-use Current

mcp-use-mcp-builder

Skillstore Score 68
Evidence Confidence High
Skillstore usage 10
Updated

2026-08-21

shubhamsaboo

shubhamsaboo-mcp-builder

Skillstore Score 67
Evidence Confidence Medium
Skillstore usage 5
Updated

2026-08-21

YYH211

yyh211-mcp-builder

Skillstore Score 66
Evidence Confidence High
Skillstore usage 68
Updated

2026-08-21

Cam10001110101

cam10001110101-mcp-builder

Skillstore Score 66
Evidence Confidence High
Skillstore usage 10
Updated

2026-08-21

DYAI2025

dyai2025-mcp-builder

Skillstore Score 66
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

ZhanlinCui

zhanlincui-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 22
Updated

2026-08-21

92Bilal26

92bilal26-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 17
Updated

2026-08-21

sickn33

sickn33-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 13
Updated

2026-08-21

ArtemisAI

artemisai-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated

2026-08-21

ComposioHQ

composiohq-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated

2026-08-21

AutumnsGrove

autumnsgrove-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated

2026-08-21

davila7

davila7-mcp-builder

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High
45
Architecture
85
Maintainability
87
Content
69
Community
91
Spec Compliance

What You Can Build

Prototype MCP Tools

Create typed MCP tools with inputs, outputs, error handling, and response helpers.

Design Interactive Widgets

Connect MCP tools to React TSX widgets that display structured results.

Review mcp-use Patterns

Find concise examples for resources, prompts, server startup, and widget metadata.

Try These Prompts

Create a Basic Tool 
Use this skill to create a simple MCP tool for [task]. Include schema fields, descriptions, and error behavior.
Add a Resource 
Design an MCP resource for [data source]. Explain the URI, MIME type, response helper, and read-only behavior.
Build a Widget Flow 
Plan an MCP tool with a React widget for [workflow]. Define tool inputs, widget props, loading states, and follow-up actions.
Audit a Production Server 
Review my mcp-use server design for [system]. Check tools, resources, prompts, widgets, environment variables, and destructive actions.

Best Practices

  • Use the newer mcp-app-builder skill for new projects when it is available.
  • Add descriptions and validation to every schema field before exposing a tool.
  • Ask users before running install commands or adding external services.

Avoid

  • Do not treat example API URLs as production-ready integration code.
  • Do not create destructive tools without clear annotations and user confirmation.
  • Do not pass secrets in logs, widget props, or model-visible output.

Frequently Asked Questions

Is this skill current?
No. It is marked deprecated and recommends mcp-app-builder for new MCP projects.
What framework does it cover?
It covers mcp-use patterns for MCP servers, tools, resources, prompts, response helpers, and widgets.
Can it create a full project scaffold?
No. It provides implementation guidance and examples, not a complete scaffold generator.
Does it support visual widgets?
Yes. It includes React TSX widget examples and explains how tools pass props to widgets.
Does it manage secrets?
No. It shows placeholder environment variable patterns and expects users to configure secrets safely.
Should agents run its install command automatically?
No. Agents should ask the user before running npx or installing another skill.

Developer Details

Author

mcp-use

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/mcp-use/mcp-use/tree/main/skills/mcp-builder/

Ref

62e2a730c5cd74eab4c7164309d810de660fcea3

Maintenance freshness

7/18/2026

Usage

5 downloads · 161 views

File structure

📁 evals/

📄 architecture.json

📄 implementation.json

📄 README.md

📄 skill.json

📄 widgets.json

📁 references/

📄 design-and-architecture.md

📄 resource-templates.md

📄 response-helpers.md

📄 tools-and-resources.md

📄 widgets.md

📄 LICENSE.txt

📄 SKILL.md