meta-mcp-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited meta-mcp-builder (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create MCP servers that enable LLMs to interact with external services.
MCP (Model Context Protocol) servers expose tools that AI agents can use. Quality is measured by how well they enable agents to accomplish real tasks.
Recommended: TypeScript with MCP SDK
Alternative: Python with FastMCP
my-mcp-server/
├── src/
│ ├── index.ts # Entry point
│ ├── tools/ # Tool implementations
│ │ ├── search.ts
│ │ └── create.ts
│ └── utils/ # Shared utilities
│ ├── api-client.ts
│ └── error-handler.ts
├── package.json
├── tsconfig.json
└── README.md// ✅ Good - action-oriented, prefixed
'github_create_issue'
'github_list_repos'
'slack_send_message'
// ❌ Avoid - vague
'process'
'handle'
'do_thing'{
name: 'github_search_issues',
description: 'Search GitHub issues by query, state, and labels. Returns issue title, number, and URL.',
}import { z } from 'zod';
const searchIssuesSchema = z.object({
query: z.string().describe('Search query string'),
state: z.enum(['open', 'closed', 'all']).default('open'),
labels: z.array(z.string()).optional().describe('Filter by labels'),
limit: z.number().min(1).max(100).default(10),
});// ❌ Bad
throw new Error('Failed');
// ✅ Good
throw new Error(
`GitHub API rate limit exceeded. ` +
`Resets at ${resetTime}. ` +
`Try again later or authenticate for higher limits.`
);import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { z } from 'zod';
const server = new McpServer({
name: 'my-service',
version: '1.0.0',
});
// Define tool
server.tool(
'service_action',
'Description of what this tool does and when to use it',
{
param1: z.string().describe('What this param is for'),
param2: z.number().optional().describe('Optional param'),
},
async ({ param1, param2 }) => {
// Implementation
const result = await performAction(param1, param2);
return {
content: [
{
type: 'text',
text: JSON.stringify(result, null, 2),
},
],
};
}
);server.tool(
'delete_item',
'Delete an item permanently',
{ id: z.string() },
async ({ id }) => { /* ... */ },
{
annotations: {
readOnlyHint: false, // Modifies data
destructiveHint: true, // Cannot be undone
idempotentHint: true, // Safe to retry
openWorldHint: false, // Closed set of operations
},
}
);| Approach | When to Use |
|---|---|
| full API coverage | Agent needs flexibility to compose operations |
| Workflow tools | Specific task needs multi-step automation |
Default: Start with full API coverage, add workflow tools for common patterns.
// Return structured data
return {
content: [{
type: 'text',
text: JSON.stringify({
success: true,
data: results,
metadata: { count: results.length },
}, null, 2),
}],
};const listItemsSchema = z.object({
limit: z.number().min(1).max(100).default(20),
cursor: z.string().optional().describe('Pagination cursor from previous response'),
});
// Return cursor in response
return {
items: results,
nextCursor: hasMore ? lastId : null,
};npm run build # Must pass without errorsnpx @modelcontextprotocol/inspectorconst apiKey = process.env.SERVICE_API_KEY;
if (!apiKey) {
throw new Error('SERVICE_API_KEY environment variable required');
}import { RateLimiter } from 'limiter';
const limiter = new RateLimiter({
tokensPerInterval: 100,
interval: 'minute',
});
async function callApi() {
await limiter.removeTokens(1);
// Make API call
}const cache = new Map<string, { data: any; expiry: number }>();
async function getCached(key: string, fetcher: () => Promise<any>) {
const cached = cache.get(key);
if (cached && cached.expiry > Date.now()) {
return cached.data;
}
const data = await fetcher();
cache.set(key, { data, expiry: Date.now() + 60000 });
return data;
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.