Skills mcp-transport-guide

📦

mcp-transport-guide

Name: mcp-transport-guide
Author: EmilLindfors

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access

選擇安全的 MCP 傳輸方式

MCP 伺服器需要適合本機、Web 和雲端部署的傳輸方式。此技能會比較 stdio、SSE、HTTP streaming 和自訂選項。

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Maintain this Skill? Claim it ⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "mcp-transport-guide" from https://skillstore.io/skills/emillindfors-mcp-transport-guide.md and its manifest at https://skillstore.io/api/skills/emillindfors-mcp-transport-guide/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/emillindfors-mcp-transport-guide.md Signed manifest GET /api/skills/emillindfors-mcp-transport-guide/manifest Signed lockfile GET /api/skills/emillindfors-mcp-transport-guide/lockfile

Test it

Using "mcp-transport-guide". 我需要一個用於同一台機器上 Claude Desktop 的 MCP 伺服器。

Expected outcome:

建議傳輸方式：stdio。它適合本機子行程使用，讓設定保持簡單，並避免暴露網路監聽器。

Using "mcp-transport-guide". 我需要一個供多個 Web 用戶端使用的遠端 MCP 伺服器。

Expected outcome:

建議傳輸方式：HTTP streaming 或 SSE。在正式環境使用前，請加入 TLS、驗證、速率限制和受限來源。

Using "mcp-transport-guide". 我需要在部署前測試我的傳輸層。

Expected outcome:

建議檢查項目：訊息框架、錯誤回應、中斷連線處理、驗證失敗路徑、延遲，以及請求記錄安全性。

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown code fences and Rust examples, including tokio::spawn and placeholder TLS filenames. The confirmed risks are all-interface listener examples, permissive CORS guidance, and full request logging guidance.

Files scanned

617

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:393-403

Permissive CORS Example

The CORS example uses allow_origin(Any) while permitting authorization and content-type headers. Copied to production, it can allow untrusted browser origins.

The example explicitly allows any origin on an HTTP route. It is documentation, so impact depends on users copying it.

Low

SKILL.md:534-536

Full Request Logging Example

The observability example logs the complete request with debug formatting. MCP requests can contain tool inputs, identifiers, or credentials.

The snippet directly logs request data. The risk is reduced because it is illustrative documentation, not executable package code.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:74

Hardcoded IP address

let listener = TcpListener::bind("0.0.0.0:3000").await?;

The example binds an MCP server to 0.0.0.0, exposing it on all network interfaces if copied. Starter remote transport snippets lack complete production hardening at that point.

Medium

SKILL.md:121

Hardcoded IP address

let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;

The example binds an MCP server to 0.0.0.0, exposing it on all network interfaces if copied. Starter remote transport snippets lack complete production hardening at that point.

Medium

SKILL.md:226

Hardcoded IP address

let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;

The example binds an MCP server to 0.0.0.0, exposing it on all network interfaces if copied. Starter remote transport snippets lack complete production hardening at that point.

Medium

SKILL.md:278

Hardcoded IP address

let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;

The example binds a remote HTTP server to 0.0.0.0, which exposes it on all interfaces if copied. Authentication is shown nearby, but the broad bind should still be explicit configuration.

Risk Factors

⚙️ External commands (37)

🌐 Network access (12)

SKILL.md:128 SKILL.md:132 SKILL.md:535 SKILL.md:538 SKILL.md:568 SKILL.md:75 SKILL.md:122 SKILL.md:441 SKILL.md:74 SKILL.md:121 SKILL.md:226 SKILL.md:278

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/emillindfors-mcp-transport-guide/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/emillindfors-mcp-transport-guide/security.svg)](https://skillstore.io/skills/emillindfors-mcp-transport-guide?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/emillindfors-mcp-transport-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/emillindfors-mcp-transport-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/emillindfors-mcp-transport-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

EmilLindfors. (2026). mcp-transport-guide security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/emillindfors-mcp-transport-guide/audits/4

BibTeX citation

@techreport{emillindfors-emillindfors-mcp-transport-guide-2026,
  author = {EmilLindfors},
  title = {mcp-transport-guide security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/emillindfors-mcp-transport-guide/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mcp-transport-guide security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "EmilLindfors"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/emillindfors-mcp-transport-guide/audits/4"
identifiers:
  - type: other
    value: "skillstore:emillindfors-mcp-transport-guide:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

為新的 MCP 伺服器選擇傳輸方式

比較本機與遠端部署需求，然後選擇 stdio、SSE、HTTP streaming 或自訂傳輸方式。

準備遠端 MCP 服務

規劃 HTTP 或 SSE 託管，並納入驗證、TLS、速率限制和監控考量。

審查傳輸設計選擇

檢查現有 MCP 伺服器是否使用符合其用戶端、規模和安全需求的傳輸方式。

Try These Prompts

挑選傳輸方式

請協助我為我的伺服器選擇 MCP 傳輸方式。我的用戶端是本機桌面使用者，而且我需要簡單的設定。

比較部署選項

比較位於負載平衡器後方的 MCP 伺服器使用 stdio、SSE 和 HTTP streaming 的差異。請包含安全性取捨。

審查傳輸實作

審查我的 MCP 傳輸設計是否適合正式環境。請聚焦於驗證、TLS、速率限制、記錄和失敗處理。

設計自訂傳輸方式

為受限裝置設計自訂 MCP 傳輸方式。請說明訊息框架、背壓、重試和可觀測性。

Best Practices

從支援你的用戶端和部署模型的最小範圍傳輸方式開始。
對每個遠端 MCP 傳輸方式使用 TLS、驗證和速率限制。
將傳輸行為與工具業務邏輯分開測試。

Avoid

不要預設將本機開發用 MCP 伺服器暴露在所有介面上。
不要對已驗證的遠端 MCP endpoints 使用開放的 CORS 設定。
不要在可能包含敏感資料時記錄完整的 MCP requests。

Frequently Asked Questions

Claude Desktop 應使用哪種傳輸方式？

Claude Desktop 應使用 stdio，因為它會將 MCP 伺服器作為本機子行程執行。

何時應使用 SSE？

當遠端用戶端需要伺服器推送事件，且你的基礎架構支援長時間存在的 HTTP 連線時，請使用 SSE。

何時應使用 HTTP streaming？

對於 Web 服務、API 閘道、負載平衡器和標準雲端基礎架構，請使用 HTTP streaming。

此技能會產生正式環境就緒的程式碼嗎？

不會。它提供範例和決策指引，仍需要依專案進行審查與強化。

它涵蓋驗證嗎？

會。它描述 bearer token 檢查，並建議遠端傳輸方式使用驗證。

它可以協助處理自訂傳輸方式嗎？

可以。它說明自訂傳輸設計，並包含以 WebSocket 為導向的範例結構。

Developer Details

Author

EmilLindfors

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/EmilLindfors/claude-marketplace/tree/main/plugins/rust-mcp-server/skills/mcp-transport-guide

Ref

30c73eac2afe762f6aa9c4553158769369d47351

Maintenance freshness

7/18/2026

Usage

4 downloads · 148 views

File structure

📄 SKILL.md