mcp-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-builder (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. The quality of an MCP server is measured by how well it enables LLMs to accomplish real-world tasks.
Microsoft provides extensive MCP infrastructure for Azure and Foundry services. Understanding this ecosystem helps you decide whether to build custom servers or leverage existing ones.
| Type | Transport | Use Case | Example |
|---|---|---|---|
| Local | stdio | Desktop apps, single-user, local dev | Azure MCP Server via NPM/Docker |
| Remote | Streamable HTTP | Cloud services, multi-tenant, Agent Service | https://mcp.ai.azure.com (Foundry) |
Before building a custom server, check if Microsoft already provides one:
| Server | Type | Description |
|---|---|---|
| Azure MCP | Local | 48+ Azure services (Storage, KeyVault, Cosmos, SQL, etc.) |
| Foundry MCP | Remote | https://mcp.ai.azure.com - Models, deployments, evals, agents |
| Fabric MCP | Local | Microsoft Fabric APIs, OneLake, item definitions |
| Playwright MCP | Local | Browser automation and testing |
| GitHub MCP | Remote | https://api.githubcopilot.com/mcp |
Full ecosystem: See 🔷 Microsoft MCP Patterns for complete server catalog and patterns.
| Scenario | Recommendation |
|---|---|
| Azure service integration | Use Azure MCP Server (48 services covered) |
| AI Foundry agents/evals | Use Foundry MCP remote server |
| Custom internal APIs | Build custom server (this guide) |
| Third-party SaaS integration | Build custom server (this guide) |
| Extending Azure MCP | Follow Microsoft MCP Patterns |
Creating a high-quality MCP server involves four main phases:
#### 1.1 Understand Modern MCP Design
API Coverage vs. Workflow Tools: Balance comprehensive API endpoint coverage with specialized workflow tools. Workflow tools can be more convenient for specific tasks, while comprehensive coverage gives agents flexibility to compose operations. Performance varies by client—some clients benefit from code execution that combines basic tools, while others work better with higher-level workflows. When uncertain, prioritize comprehensive API coverage.
Tool Naming and Discoverability: Clear, descriptive tool names help agents find the right tools quickly. Use consistent prefixes (e.g., github_create_issue, github_list_repos) and action-oriented naming.
Context Management: Agents benefit from concise tool descriptions and the ability to filter/paginate results. Design tools that return focused, relevant data. Some clients support code execution which can help agents filter and process data efficiently.
Actionable Error Messages: Error messages should guide agents toward solutions with specific suggestions and next steps.
#### 1.2 Study MCP Protocol Documentation
Navigate the MCP specification:
Start with the sitemap to find relevant pages: https://modelcontextprotocol.io/sitemap.xml
Then fetch specific pages with .md suffix for markdown format (e.g., https://modelcontextprotocol.io/specification/draft.md).
Key pages to review:
#### 1.3 Study Framework Documentation
Language Selection:
| Language | Best For | SDK |
|---|---|---|
| TypeScript (recommended) | General MCP servers, broad compatibility | @modelcontextprotocol/sdk |
| Python | Data/ML pipelines, FastAPI integration | mcp (FastMCP) |
| C#/.NET | Azure/Microsoft ecosystem, enterprise | Microsoft.Mcp.Core |
Transport Selection:
| Transport | Use Case | Characteristics |
|---|---|---|
| Streamable HTTP | Remote servers, multi-tenant, Agent Service | Stateless, scalable, requires auth |
| stdio | Local servers, desktop apps | Simple, single-user, no network |
Load framework documentation:
For TypeScript (recommended):
https://raw.githubusercontent.com/modelcontextprotocol/typescript-sdk/main/README.mdFor Python:
https://raw.githubusercontent.com/modelcontextprotocol/python-sdk/main/README.mdFor C#/.NET (Microsoft ecosystem):
#### 1.4 Plan Your Implementation
Understand the API: Review the service's API documentation to identify key endpoints, authentication requirements, and data models. Use web search and WebFetch as needed.
Tool Selection: Prioritize comprehensive API coverage. List endpoints to implement, starting with the most common operations.
#### 2.1 Set Up Project Structure
See language-specific guides for project setup:
#### 2.2 Implement Core Infrastructure
Create shared utilities:
#### 2.3 Implement Tools
For each tool:
Input Schema:
Output Schema:
outputSchema where possible for structured datastructuredContent in tool responses (TypeScript SDK feature)Tool Description:
Implementation:
Annotations:
readOnlyHint: true/falsedestructiveHint: true/falseidempotentHint: true/falseopenWorldHint: true/false#### 3.1 Code Quality
Review for:
#### 3.2 Build and Test
TypeScript:
npm run build to verify compilationnpx @modelcontextprotocol/inspectorPython:
python -m py_compile your_server.pySee language-specific guides for detailed testing approaches and quality checklists.
After implementing your MCP server, create comprehensive evaluations to test its effectiveness.
Load [✅ Evaluation Guide](./reference/evaluation.md) for complete evaluation guidelines.
#### 4.1 Understand Evaluation Purpose
Use evaluations to test whether LLMs can effectively use your MCP server to answer realistic, complex questions.
#### 4.2 Create 10 Evaluation Questions
To create effective evaluations, follow the process outlined in the evaluation guide:
#### 4.3 Evaluation Requirements
Ensure each question is:
#### 4.4 Output Format
Create an XML file with this structure:
<evaluation>
<qa_pair>
<question>Find discussions about AI model launches with animal codenames. One model needed a specific safety designation that uses the format ASL-X. What number X was being determined for the model named after a spotted wild cat?</question>
<answer>3</answer>
</qa_pair>
<!-- More qa_pairs... -->
</evaluation>Load these resources as needed during development:
https://modelcontextprotocol.io/sitemap.xml, then fetch specific pages with .md suffixhttps://raw.githubusercontent.com/modelcontextprotocol/python-sdk/main/README.mdhttps://raw.githubusercontent.com/modelcontextprotocol/typescript-sdk/main/README.md@mcp.toolserver.registerTool{Resource}{Operation}Command).AsRequired() / .AsOptional()~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.