MCP Server Dev Kit
Everything to build a Model Context Protocol server and ship it safely, in one kit. Scaffold a spec-compliant MCP server with the right transport, auth, and tool schemas; audit your server and tool definitions for the agentic-security risks before it goes live; and tighten the AGENTS.md / agent-config that drives it. Build → secure → configure — the full path from empty repo to a server you can trust in production. Save about 20% versus buying the three skills separately.
Works with every agent that reads SKILL.md — Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot, Windsurf, OpenClaw, and more.
One payment, lifetime access. 3 skills unlock instantly in your library.
30-day refund guarantee
Instant unlock in your library
Free updates from the creator
What's included
3 skills
Scaffold a secure, spec-compliant MCP server from a description of the tools you want to expose. Sets up the official SDK (TypeScript or Python/FastMCP), defines tools/resources/prompts with strict JSON Schema, wires the right transport (stdio or Streamable HTTP), adds OAuth 2.1 for remote, and hardens against the MCP-specific footguns — prompt injection via tool output, token passthrough, over-broad scopes, command/path/SSRF injection, leaked secrets — before it ships. Returns a runnable skeleton plus a security checklist. Built by someone who's shipped production MCP servers.
An adversarial gate that audits an MCP server or agent tool definition — schemas, descriptions, scopes, auth — for tool poisoning, excessive agency, injectable descriptions, and missing access controls, then returns one SAFE/REVIEW/BLOCK verdict.
An adversarial reviewer for AGENTS.md and agent instruction files. It flags ambiguous or contradictory rules, missing guardrails, vague tool and scope definitions, and untestable instructions, then returns a PASS / REVISE / BLOCK verdict — before the config drives your agent.
See it in action
You say
Build me an MCP server in Python that lets Claude query our internal Postgres read replica. We want to deploy it remotely.
Your agent does
Plan: Python + FastMCP, Streamable HTTP (remote). Flags raw SQL as dangerous and recommends a scoped get_records(table, filters) tool (or parameterized queries on a read-only role with a statement allowlist) instead of free-form SQL. Confines access to the read replica. OAuth 2.1 + PKCE on the endpoint; a scoped service credential from the secret store (no token passthrough to the DB). Structured errors that never echo the raw DB error. Audit-logs every query. Delivers a runnable skeleton with one implemented tool plus a Security Checklist Report flagging "replace placeholder OAuth provider config" and "confirm the DB role is read-only."
How to install
Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.