{"id":"cmt8kz0ts0jp0ad092rndygqu","slug":"mcp-builder","publicId":"a43e50f7-aa0c-4e71-a92c-5dcc790054cb","name":"mcp-builder","description":"Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).","version":"","author":"anthropics","license":"Complete terms in LICENSE.txt","compatibility":"","status":"completed","overallGrade":"B","scannerVersion":9,"fileCount":10,"hasSkillMd":true,"hasScripts":true,"hasReferences":false,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/anthropics/skills/tree/main/skills/mcp-builder","createdAt":"2026-08-25T11:27:33.615Z","completedAt":"2026-08-25T11:27:33.613Z","visibility":"public","publishedAt":"2026-05-01T20:47:44.380Z","category":"","frameworks":[],"badgeStatus":"conditional","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 1 warning in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"pass"}],"consensus":"warn","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmoanwm7n003iad0kpzh62o2y","findings":[{"id":"cmt8kz0tt0jpkad097d2kl6qg","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmt8kz0tt0jpmad090bypcdza","source":"cisco","category":"security","label":"Unpinned dependency","detail":"scripts/requirements.txt:1 — Dependency 'anthropic' has no pinned (==) version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"medium","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"867092bd41ebf0f13349a23ce3e09bb2","filepath":"scripts/requirements.txt"},{"id":"cmt8kz0tt0jpoad09occsu2qq","source":"cisco","category":"security","label":"Unpinned dependency","detail":"scripts/requirements.txt:2 — Dependency 'mcp' has no pinned (==) version. Unpinned dependencies in a skill package allow a later, potentially malicious release to be installed automatically (supply-chain risk).","severity":"medium","ruleId":"SUPPLY_CHAIN_UNPINNED_DEPENDENCY","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"867092bd41ebf0f13349a23ce3e09bb2","filepath":"scripts/requirements.txt"},{"id":"cmt8kz0tt0jpiad0924jzemm1","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cmt8kz0ts0jp6ad09j2nlmgn0","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cmt8kz0ts0jphad09zgxk9262","source":"vettd","category":"security","label":"No secrets or unsafe code patterns detected","detail":"Scanned all files for credentials, private keys, and code-level risks (eval, shell exec, destructive ops)","severity":"info","ruleId":"VTD-0091","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2e3428ecd3c04cac33cabd959f51437a","filepath":""},{"id":"cmt8kz0ts0jp3ad09einwnbi3","source":"vettd","category":"structure","label":"scripts/ directory present","detail":"Bundled executable scripts found","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cmt8kz0ts0jp2ad09tp626a0t","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cmt8kz0ts0jp5ad09f099mz8q","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"mcp-builder\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cmt8kz0ts0jp9ad09qld47an1","source":"vettd","category":"description","label":"Description includes usage context","detail":"Good: description explains when to activate the skill","severity":"info","ruleId":"VTD-0111","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e325ab773f2c18f6f9d864add6464110","filepath":""},{"id":"cmt8kz0ts0jp7ad09xb20b1po","source":"vettd","category":"description","label":"Description within character limit","detail":"277/1024 characters used","severity":"info","ruleId":"VTD-0110","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"66553d595a652c45a6f0d4353184b37e","filepath":""},{"id":"cmt8kz0ts0jpbad09nvo76pvk","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cmt8kz0ts0jpdad091vml08ko","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cmt8kz0ts0jpaad09acsw2vy5","source":"vettd","category":"best-practices","label":"SKILL.md body length is reasonable","detail":"231 lines (recommended: under 500)","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cmt8kz0ts0jpcad095769kdb5","source":"vettd","category":"best-practices","label":"Step-by-step workflow found","detail":"Structured procedures improve reliability for complex tasks","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cmt8kz0ts0jpfad095xsfyvxg","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/evaluation.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"03ce253d58810e6eb1ddba0301f55929","filepath":"scripts/evaluation.py"},{"id":"cmt8kz0ts0jpead09wkreydxm","source":"vettd","category":"scripts","label":"No --help support","detail":"scripts/connections.py: Add argument parsing with --help output so agents know the script's interface","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"860f229e3a5001100d41849fd0589e9d","filepath":"scripts/connections.py"},{"id":"cmt8kz0ts0jpgad09vmd6hlzx","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/evaluation.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6973eb330cce795d109586b1f868c4a8","filepath":"scripts/evaluation.py"},{"id":"cmt8kz0ts0jp4ad09r1bqsbif","source":"vettd","category":"evals","label":"No evaluation test cases","detail":"Add an evals/ directory with test prompts and expected outputs to measure skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"B","findingCount":2,"criticalCount":0,"highCount":0},{"source":"vettd","status":"success","verdict":null,"grade":"B","findingCount":17,"criticalCount":0,"highCount":0}],"user":{"name":"Will Sarg","image":"https://avatars.githubusercontent.com/u/12886992?v=4"},"repository":{"owner":"anthropics","name":"skills"},"freshness":{"status":"check_failed","reason":"auth","retryable":true,"renamedTo":null,"lastCheckedAt":"2026-10-22T06:17:40.309Z","lastVerifiedAt":"2026-08-30T13:19:49.411Z","lastChangeDetectedAt":"2026-08-12T12:32:46.816Z","scannedHash":"b866bcfb57b780c10b587c7b543e871a91661ce0","latestUpstreamHash":"b866bcfb57b780c10b587c7b543e871a91661ce0","nextCheckDueAt":"2026-10-22T12:17:40.309Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":19,"publisherSupplied":["name","description","author","version","license"]}