mcp-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-builder (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build MCP (Model Context Protocol) servers that let LLMs interact with external services through well-designed tools. The quality of an MCP server is measured by how well it lets an LLM solve real tasks.
Building a high-quality MCP server has four main phases:
#### 1.1 Understand modern MCP design
API coverage vs. workflow tools: Balance full API endpoint coverage against specialized workflow tools. Workflow tools may be more convenient for specific tasks, while full coverage gives agents flexibility to combine operations. Performance depends on the client — some clients benefit from code execution that composes primitive tools, while others work better with higher-level tools. When in doubt, prioritize full API coverage.
Tool naming and discoverability: Clear, descriptive tool names help agents quickly locate the tool they need. Use consistent prefixes (e.g. github_create_issue, github_list_repos) and action-oriented naming.
Context management: Agents benefit from concise tool descriptions and the ability to filter or paginate results. Design tools to return focused, relevant data. Some clients support code execution, which helps agents filter and process data more efficiently.
Actionable error messages: Error messages should guide the agent to a solution with concrete hints and next steps.
#### 1.2 Study the MCP protocol documentation
Navigate the MCP specification:
Start with the sitemap to find relevant pages: https://modelcontextprotocol.io/sitemap.xml
Then fetch specific pages with the .md suffix for markdown format (e.g. https://modelcontextprotocol.io/specification/draft.md).
Key pages to review:
#### 1.3 Study the framework documentation
Recommended stack:
Load the framework documentation:
For TypeScript (recommended):
https://raw.githubusercontent.com/modelcontextprotocol/typescript-sdk/main/README.mdFor Python:
https://raw.githubusercontent.com/modelcontextprotocol/python-sdk/main/README.md#### 1.4 Plan the implementation
Understand the API: Study the service's API documentation to identify key endpoints, authentication requirements, and data models. Use web search and WebFetch as needed.
Tool selection: Prioritize full API coverage. List the endpoints to implement, starting with the most common operations.
#### 2.1 Set up the project structure
See language-specific guides for project setup:
#### 2.2 Implement the base infrastructure
Create shared utilities:
#### 2.3 Implement the tools
For each tool:
Input schema:
Output schema:
outputSchema for structured datastructuredContent in tool responses (a TypeScript SDK capability)Tool description:
Implementation:
Annotations:
readOnlyHint: true/falsedestructiveHint: true/falseidempotentHint: true/falseopenWorldHint: true/false#### 3.1 Code quality
Check for:
#### 3.2 Build and test
TypeScript:
npm run build to verify compilationnpx @modelcontextprotocol/inspectorPython:
python -m py_compile your_server.pySee language-specific guides for detailed testing approaches and quality checklists.
After implementing the MCP server, build comprehensive evaluations to verify its effectiveness.
Load the [Evaluation guide](./reference/evaluation.md) for the complete evaluation guide.
#### 4.1 Understand the purpose of evaluations
Use evaluations to verify that LLMs can effectively use your MCP server to answer realistic, complex questions.
#### 4.2 Build 10 evaluation questions
To build effective evaluations, follow the process from the evaluation guide:
#### 4.3 Evaluation requirements
Make sure each question is:
#### 4.4 Output format
Produce an XML file with this structure:
<evaluation>
<qa_pair>
<question>Find discussions about AI model launches with animal codenames. One model needed a specific safety designation that uses the format ASL-X. What number X was being determined for the model named after a spotted wild cat?</question>
<answer>3</answer>
</qa_pair>
<!-- More qa_pairs... -->
</evaluation>Load these resources as needed during development:
https://modelcontextprotocol.io/sitemap.xml, then fetch specific pages with the .md suffixhttps://raw.githubusercontent.com/modelcontextprotocol/python-sdk/main/README.mdhttps://raw.githubusercontent.com/modelcontextprotocol/typescript-sdk/main/README.md@mcp.toolserver.registerTool~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.