Is build-mcp-server safe?
Grade A, 100/100. No meaningful risk found.
This skill should be used when the user asks to "build an MCP server", "create an MCP", "make an MCP integration", "wrap an API for Claude", "expose tools to Claude", "make an MCP app", or discusses building something with the Model Context Protocol. It is the entry point for MCP server development — it interrogates the user about their use case, determines the right deployment model (remote HTTP, MCPB, local stdio), picks a tool-design pattern, and hands off to specialized skills.
Abuild-mcp-server
plugins/mcp-server-dev/skills/build-mcp-server100/100 · No meaningful risk foundNo security findings
build-mcp-server
plugins/mcp-server-dev/skills/build-mcp-serverThis skill should be used when the user asks to "build an MCP server", "create an MCP", "make an MCP integration", "wrap an API for Claude", "expose tools to Claude", "make an MCP app", or discusses building something with the Model Context Protocol. It is the entry point for MCP server development — it interrogates the user about their use case, determines the right deployment model (remote HTTP, MCPB, local stdio), picks a tool-design pattern, and hands off to specialized skills.
- Content hash
- sha256:4c8b5276a21b774ebb8fd6b8c117013008acd57a7a4da069989e4c1a61950669
- Files
- 9
- Quality
- 100/100
Security findings
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/deploy-cloudflare-workers.md:94
npx wrangler dev # → http://localhost:8787/mcpInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/deploy-cloudflare-workers.md:95
npx wrangler deploy # → https://my-mcp-server.<account>.workers.dev/mcpInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/deploy-cloudflare-workers.md:100
Secrets (upstream API keys): `npx wrangler secret put UPSTREAM_API_KEY`, then read `env.UPSTREAM_API_KEY` inside `init()`.Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:84
pip install fastmcpInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:164
npx @modelcontextprotocol/inspectorInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:171
npx @modelcontextprotocol/inspector --cli http://localhost:3000/mcp \Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · plugins/mcp-server-dev/skills/build-mcp-server/references/remote-http-scaffold.md:174
npx @modelcontextprotocol/inspector --cli http://localhost:3000/mcp \Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md11.8 KB
- references/auth.md5.6 KB
- references/deploy-cloudflare-workers.md3.6 KB
- references/elicitation.md4.6 KB
- references/remote-http-scaffold.md6.9 KB
- references/resources-and-prompts.md4.0 KB
- references/server-capabilities.md4.6 KB
- references/tool-design.md6.9 KB
- references/versions.md1.1 KB
Questions about build-mcp-server
- Is build-mcp-server safe to install?
- Our scanner gave build-mcp-server grade A (100/100): no meaningful risk found. None of the 30 security rules matched. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install build-mcp-server in Claude Code or Codex?
- Run skillhash add github:anthropics/claude-plugins-official/plugins/mcp-server-dev/skills/build-mcp-server. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if build-mcp-server changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from anthropics/claude-plugins-official
- A
claude-automation-recommender
43kanthropics/claude-plugins-official
Analyze a codebase and recommend Claude Code automations (hooks, subagents, skills, plugins, MCP servers). Use when user asks for automation recommendations, wants to optimize their Claude Code setup, mentions improving Claude Code workflows, asks how to first set up Claude Code for a project, or wants to know what Claude Code features they should use.
No security findings - A
access
43kanthropics/claude-plugins-official
Manage Discord channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the Discord channel.
No security findings - A
siege
43kanthropics/claude-plugins-official
Work on one hard mathematics problem in rounds: each round a judge writes a few self-contained questions, independent workers answer them, and the judge keeps a ledger of what is proved, refuted and open, until the judge concludes or the rounds run out, and then a proof.md says plainly what is and is not proved. A run takes hours and dozens of worker runs. Usage: /math-proof:siege [NAME=value settings] <the problem, stated in full, or the path of a file holding it>.
No security findings - A
access
43kanthropics/claude-plugins-official
Manage iMessage channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the iMessage channel.
No security findings - A
configure
43kanthropics/claude-plugins-official
Check iMessage channel setup and review access policy. Use when the user asks to configure iMessage, asks "how do I set this up" or "who can reach me," or wants to know why texts aren't reaching the assistant.
No security findings - A
access
43kanthropics/claude-plugins-official
Manage Telegram channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the Telegram channel.
No security findings - A
configure
43kanthropics/claude-plugins-official
Set up the Telegram channel — save the bot token and review access policy. Use when the user pastes a Telegram bot token, asks to configure Telegram, asks "how do I set this up" or "who can reach me," or wants to check channel status.
No security findings - A
claude-md-improver
43kanthropics/claude-plugins-official
Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates, outputs quality report, then makes targeted updates. Also use when the user mentions "CLAUDE.md maintenance" or "project memory optimization".
No security findings