mcp-builder
Audited by Runlayer on Feb 21, 2026
Malicious tool definition detected
Tool: LICENSE.txt [1/2] Description: Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1.
Tool: LICENSE.txt [2/2] Description: this License.
Malicious tool definition detected
Tool: SKILL.md [1/2] Description: --- name: mcp-builder description: Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools.
Tool: SKILL.md [2/2] Description: Load [🐍 Python Implementation Guide](./reference/python_mcp_server.md) and ensure the following:** - Using MCP Python SDK with proper tool registration - Pydantic v2 models with `model_config` - Type hints throughout - Async/await for all I/O operations - Proper imports organization - Module-level constants (CHARACTER_LIMIT, API_BASE_URL) **For Node/TypeScript: Load [⚡ TypeScript Implementation Guide](./reference/node_mcp_server.md) and ensure the following:** -
Malicious tool definition detected
Tool: reference/evaluation.md [1/4] Description: # MCP Server Evaluation Guide ## Overview This document provides guidance on creating comprehensive evaluations for MCP servers.
Tool: reference/evaluation.md [2/4] Description: address, phone number - Channel concept: channel ID, channel name, channel topic - Message concept: message ID, message string, timestamp, month, day, year 6.
Tool: reference/evaluation.md [3/4] Description: me who created it.</question> <answer>developer123</answer> </qa_pair> ``` This question is poor because: - Can be solved with a straightforward keyword search for exact title - Doesn't require deep exploration or understanding - No synthesis or analysis needed **Example 3: Ambiguous answer format** ```xml <qa_pair> <question>List all the repositories that have Python as their primary language.</question> <answer>repo1, repo2, repo3, data-pipeline
Tool: reference/evaluation.md [4/4]
Malicious tool definition detected
Tool: reference/mcp_best_practices.md [1/4] Description: # MCP Server Development Best Practices and Guidelines ## Overview This document compiles essential best practices and guidelines for building Model Context Protocol (MCP) servers.
Tool: reference/mcp_best_practices.md [2/4] Description: No | Yes | --- ## 7. Tool Development Best Practices ### General Guidelines 1.
Tool: reference/mcp_best_practices.md [3/4] Description: * **Flexibility**: Tools can range from simple calculations to complex API interactions Like [resources](/docs/concepts/resources), tools are identified by unique names and can include descriptions to guide their usage. However, unlike resources, tools represent dynamic operations that can modify state or interact with external systems.
Tool: reference/mcp_best_practices.md [4/4] Description: text: `Error: ${error.message}` } ] }; } ``` </Tab> <Tab title="Python"> ```python try: # Tool operation result = perform_operation() return types.CallToolResult( content=[ types.TextContent( type="text", text=f"Operation successful: {result}" ) ] ) except Exception as error: return types.CallToolResult( isError=True, content=[ types.TextContent( type="text", text=f"Error: {str(error)}" ) ] ) ``` </Tab> </Tabs> This approach allows the LLM
Malicious tool definition detected
Tool: reference/node_mcp_server.md [1/4] Description: # Node/TypeScript MCP Server Implementation Guide ## Overview This document provides Node/TypeScript-specific best practices and examples for implementing MCP servers using the MCP TypeScript SDK.
Tool: reference/node_mcp_server.md [2/4] Description: ); ``` ## Zod Schemas for Input Validation Zod provides runtime type validation: ```typescript import { z } from "zod"; // Basic schema with validation const CreateUserSchema = z.object({ name: z.string() .min(1, "Name is required") .max(100, "Name must not exceed 100 characters"), email: z.string() .email("Invalid email format"), age: z.number() .int("Age must be a whole number") .min(0, "Age cannot be negative") .max(150, "Age cannot be gre
Tool: reference/node_mcp_server.md [3/4] Description: to match against names/emails"), limit: z.number() .int() .min(1) .max(100) .default(20) .describe("Maximum results to return"), offset: z.number() .int() .min(0) .default(0) .describe("Number of results to skip for pagination"), response_format: z.nativeEnum(ResponseFormat) .default(ResponseFormat.MARKDOWN) .describe("Output format: 'markdown' for human-readable or 'json' for machine-readable") }).strict(); type UserSearchInput = z.infer<typ
Tool: reference/node_mcp_server.md [4/4]
Malicious tool definition detected
Tool: reference/python_mcp_server.md [1/4] Description: # Python MCP Server Implementation Guide ## Overview This document provides Python-specific best practices and examples for implementing MCP servers using the MCP Python SDK.
Tool: reference/python_mcp_server.md [2/4] Description: ```python # Shared API request function async def _make_api_request(endpoint: str, method: str = "GET", **kwargs) -> dict: '''Reusable function for all API calls.''' async with httpx.AsyncClient() as client: response = await client.request( method, f"{API_BASE_URL}/{endpoint}", timeout=30.0, **kwargs ) response.raise_for_status() return response.json() ``` ## Async/Await Best Practices Always use async/await for network requests and I/O ope
Tool: reference/python_mcp_server.md [3/4] Description: users.''' # Request sensitive information when needed api_key = await ctx.elicit( prompt="Please provide your API key:", input_type="password" ) # Use the provided key return await api_call(resource_id, api_key) ``` **Context capabilities:** - `ctx.report_progress(progress, message)` - Report progress for long operations - `ctx.log_info(message, data)` / `ctx.log_error()` / `ctx.log_debug()` - Logging - `ctx.elicit(prompt, input_type)` - Re
Tool: reference/python_mcp_server.md [4/4]
Malicious tool definition detected
Tool: scripts/connections.py Description: """Lightweight connection handling for MCP servers.""" from abc import ABC, abstractmethod from contextlib import AsyncExitStack from typing import Any from mcp import ClientSession, StdioServerParameters from mcp.client.sse import sse_client from mcp.client.stdio import stdio_client from mcp.client.streamable_http import streamablehttp_client class MCPConnection(ABC): """Base class for MCP server connections.""" def __init__(self): self.session = None s
Malicious tool definition detected
Tool: scripts/evaluation.py [1/2] Description: """MCP Server Evaluation Harness This script evaluates MCP servers by running test questions against them using Claude.
Tool: scripts/evaluation.py [2/2] Description: {env_var}") return env async def main(): parser = argparse.ArgumentParser( description="Evaluate MCP servers using test questions", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=""" Examples: # Evaluate a local stdio MCP server python evaluation.py -t stdio -c python -a my_server.py eval.xml # Evaluate an SSE MCP server python evaluation.py -t sse -u https://example.com/mcp -H "Authorization: Bearer token" eval.xml # Evaluate an HTTP
Malicious tool definition detected
Tool: scripts/example_evaluation.xml Description: <evaluation> <qa_pair> <question>Calculate the compound interest on $10,000 invested at 5% annual interest rate, compounded monthly for 3 years.
Malicious tool definition detected
Tool: scripts/requirements.txt