Anthropic / skills/mcp-builder/SKILL.md
MCP Server Builder
A guide for building MCP servers with clear tool contracts, transport choices and evaluation questions. Its included evaluation runner needs extra care around parallel tool calls and diagnostic disclosure.
Runtime probed · reviewed · A helper or bounded runtime behavior was probed. This does not establish model task effectiveness or comprehensive security.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Developing or reviewing MCP tool contracts
- Planning synthetic, stable evaluation questions before connecting live services
What it is
A development skill for creating a Model Context Protocol server: the adapter that lets an agent discover and call a system's tools. It covers API research, schemas, tool naming, pagination, implementation and evaluation, with Python and TypeScript references. Installing this skill does not itself give an agent a working connection to your systems.
Why you might use it
Use it when you need to expose a well-defined service through MCP and want a checklist that goes beyond merely starting a server. It makes the developer consider what a tool returns, how errors guide the caller and whether realistic questions can be answered. Authentication, authorization and safe tool behavior still have to be implemented and tested.
Put it in context.
Illustrative requests and outputs to review. These examples are separate from the recorded evaluation below.
Expose a synthetic policy library
Example request
Ask for a local, read-only MCP server over ten synthetic policy records. Define search and read tools, bounded results, input schemas and answers for ten stable evaluation questions before connecting any real content.
What to look for. A server draft and test plan whose contracts can be inspected and exercised against the fixture.
Before you rely on it. No complete server was generated or connected in this pass. Read-only annotations are hints; enforce read-only behavior in the implementation and underlying credentials.
Review an existing integration contract
Example request
Give the agent a synthetic inventory API specification and ask it to propose tool names, pagination, validation errors and a separate approval boundary for inventory changes.
What to look for. A concrete MCP tool specification and coverage gaps to resolve before implementation.
Before you rely on it. The bundled runner handles only the first tool request in the tested two-tool response. Review or replace it before using its scores, and redact tool errors before they reach a real provider.
02 / Setup & access
What it asks of your environment.
Requirements
- An agent able to read the skill and references; Node/TypeScript or Python and an appropriate MCP SDK for actual server development.
- Access to the target API specification and a deliberately scoped test service. Real integrations may require service credentials and network access.
- The supplied evaluation requirements name anthropic>=0.39.0 and mcp>=1.1.0. Its real model-based runner needs Anthropic API access; this account-free pass used sentinel imports and fake provider/transport objects.
Permissions & data access
- Read API documentation and project source; create code and execute builds, servers or inspector tools when allowed by the host.
- The full evaluation runner can launch a specified stdio command or connect to a remote MCP endpoint, call its exposed tools and send questions/results to a model provider. This review did none of those real operations.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Review before use
Multiple tool requests are only partly handled
In the fake-provider probe, a response requested two tool calls but the evaluation loop executed and answered only the first. This is a control-flow result with synthetic objects, not a live API response test; adapt and test the runner before relying on parallel tool use.
Review before use
Diagnostic text can disclose supplied values
A malformed credential-like header echoed its synthetic marker to stdout. A fake tool exception forwarded its marker and traceback into the next model-bound result. No real secret or provider request was used; keep sensitive values out of evaluation fixtures and sanitize logs and tool errors before connecting a real model.
Review before use
The included model evaluation is not account-free
The source runner constructs an Anthropic API client and sends questions and tool outputs to it. This pass replaced provider and transport interfaces with in-memory fixtures. A real evaluation needs provider access, approved data handling and explicit cost and tool-permission limits.
Review before use
Tool annotations do not enforce permissions
The pinned best-practices reference says annotations are hints. A server advertised as read-only still needs actual authorization, input validation and restricted underlying access.
Limits and nuances
- Three parser/logging checks and three control-flow checks with a fake provider, fake transport and synchronous coroutine dispatch. No real model, SDK transport, server or API was exercised.
- No generated-server quality, OAuth behavior, multitenant isolation, prompt-injection resistance, concurrency, cost control or effectiveness improvement was established.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- Parser and diagnostic helpers executed unchanged; evaluation-loop control flow exercised with synthetic provider/transport objects. Documentation and connection paths inspected.
- Pinned entrypoint, per-skill license and each file named in the report source manifest
Not tested or established
- Three parser/logging checks and three control-flow checks with a fake provider, fake transport and synchronous coroutine dispatch. No real model, SDK transport, server or API was exercised.
- No generated-server quality, OAuth behavior, multitenant isolation, prompt-injection resistance, concurrency, cost control or effectiveness improvement was established.
- One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.
- No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited.
- Review date
- Source revision
dbd4588f9e1033efb41dad4bef2f7947c8993d44- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Helper probe
Results with their limits attached.
Six bounded checks: three met expectations and three exposed practical limits. The parser/logging functions ran locally; model and MCP interactions were fake. No API, account or generated server was tested.
- Passed
- 3
- Failed
- 3
- Total recorded
- 6
These counts refer to the cases in this report. They are not a benchmark against other skills. A helper probe does not measure model task effectiveness or establish comprehensive security.
Read the evidence reportDownload the authored reproduction harness (JSON bundle) ↗
The report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Python 3.12.10 on Windows 11; synthetic files only
- Application-level no-network/no-child-process guards and isolated configuration; not an OS sandbox
- Sentinel provider/transport imports, fake objects and synchronous in-memory coroutine dispatch
Recorded commands (1)
Commands document this evaluation. They are not setup instructions for your environment.
python -B helper_probe.py --sources <retrieved-skills-directory> --runtime-libs <existing-bundled-site-packages>Findings from this evaluation
Needs attention
Multiple tool requests are only partly handled
In the fake-provider probe, a response requested two tool calls but the evaluation loop executed and answered only the first. This is a control-flow result with synthetic objects, not a live API response test; adapt and test the runner before relying on parallel tool use.
Needs attention
Diagnostic text can disclose supplied values
A malformed credential-like header echoed its synthetic marker to stdout. A fake tool exception forwarded its marker and traceback into the next model-bound result. No real secret or provider request was used; keep sensitive values out of evaluation fixtures and sanitize logs and tool errors before connecting a real model.
Needs attention
The included model evaluation is not account-free
The source runner constructs an Anthropic API client and sends questions and tool outputs to it. This pass replaced provider and transport interfaces with in-memory fixtures. A real evaluation needs provider access, approved data handling and explicit cost and tool-permission limits.
Evaluation limitations
- Three parser/logging checks and three control-flow checks with a fake provider, fake transport and synchronous coroutine dispatch. No real model, SDK transport, server or API was exercised.
- No generated-server quality, OAuth behavior, multitenant isolation, prompt-injection resistance, concurrency, cost control or effectiveness improvement was established.
- One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.
- No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited.
05 / Reuse & discovery
License, attribution & popularity.
Apache-2.0
The separate per-skill LICENSE.txt contains the Apache License 2.0. Dependency and third-party asset terms are separate.
Why it is in this collection
Selected from a widely followed repository and dated skills.sh directory observations. Installs are rounded directory displays, not independently verified users or evidence of quality, safety or growth.
182,031 repository stars
- Scope
- Entire anthropics/skills repository, not this individual skill
- Observed
- Time window
- Snapshot observed 2026-10-19
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
Dated discovery signal
Discovery snapshots.
128,100 skill installs on skills.sh · Page labels this Installs without stating a time window
Observed . Scope: Individual mcp-builder directory listing; rounded display.
Selection snapshot; displayed K value converted to an approximate integer. No rate, rank or measured trend is inferred.
Snapshot source ↗06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Per-skill license github.com
- evaluation.py inspected source github.com
- connections.py inspected source github.com
- requirements.txt inspected source github.com
- mcp_best_practices.md inspected source github.com
- Dated directory interest signal www.skills.sh
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.