mcp-builder
Audited by Runlayer on Feb 24, 2026
Malicious tool definition detected
Tool: SKILL.md [1/2] Description: --- name: mcp-builder description: Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools.
Tool: SKILL.md [2/2] Description: quality checklists.
Malicious tool definition detected
Tool: reference/evaluation.md [1/4] Description: # MCP Server Evaluation Guide ## Overview This document provides guidance on creating comprehensive evaluations for MCP servers.
Tool: reference/evaluation.md [2/4] Description: address, phone number - Channel concept: channel ID, channel name, channel topic - Message concept: message ID, message string, timestamp, month, day, year 6.
Tool: reference/evaluation.md [3/4] Description: me who created it.</question> <answer>developer123</answer> </qa_pair> ``` This question is poor because: - Can be solved with a straightforward keyword search for exact title - Doesn't require deep exploration or understanding - No synthesis or analysis needed **Example 3: Ambiguous answer format** ```xml <qa_pair> <question>List all the repositories that have Python as their primary language.</question> <answer>repo1, repo2, repo3, data-pipeline
Tool: reference/evaluation.md [4/4]
Malicious tool definition detected
Tool: reference/mcp_best_practices.md [1/2] Description: # MCP Server Best Practices ## Quick Reference ### Server Naming - **Python**: `{service}_mcp` (e.g., `slack_mcp`) - **Node/TypeScript**: `{service}-mcp-server` (e.g., `slack-mcp-server`) - **C#/.NET (Microsoft)**: `{Service}.Mcp.Server` (e.g., `Azure.Mcp.Server`) ### Tool Naming - Use snake_case with service prefix - Format: `{service}_{action}_{resource}` - Example: `slack_send_message`, `github_create_issue` - **C# Commands**: `{Resourc
Tool: reference/mcp_best_practices.md [2/2] Description: to prevent directory traversal - Validate URLs and external identifiers - Check parameter sizes and ranges - Prevent command injection in system calls - Use schema validation (Pydantic/Zod) for all inputs ### Error Handling - Don't expose internal errors to clients - Log security-relevant errors server-side - Provide helpful but not revealing error messages - Clean up resources after errors ### DNS Rebinding Protection For streamable HTTP
Malicious tool definition detected
Tool: reference/microsoft_mcp_patterns.md [1/3] Description: # Microsoft MCP Patterns This document covers patterns from Microsoft's official MCP implementations, including the Azure MCP Server and Foundry MCP services.
Tool: reference/microsoft_mcp_patterns.md [2/3] Description: a credential chain that tries multiple authentication methods: ``` 1.
Tool: reference/microsoft_mcp_patterns.md [3/3] Description: conventions --- ## Integration with Foundry Agent Service ### MCP Tool Declaration (Python) ```python from azure.ai.projects import AIProjectClient from azure.ai.projects.models import PromptAgentDefinition, MCPTool mcp_tool = MCPTool( server_label="azure-storage", server_url="https://{app}.azurewebsites.net/runtime/webhooks/mcp", require_approval="always", allowed_tools=["storage_container_list"], project_connection_id=connection_name
Malicious tool definition detected
Tool: reference/node_mcp_server.md [1/4] Description: # Node/TypeScript MCP Server Implementation Guide ## Overview This document provides Node/TypeScript-specific best practices and examples for implementing MCP servers using the MCP TypeScript SDK.
Tool: reference/node_mcp_server.md [2/4] Description: on requested format let textContent: string; if (params.response_format === ResponseFormat.MARKDOWN) { const lines = [`# User Search Results: '${params.query}'`, "", `Found ${total} users (showing ${users.length})`, ""]; for (const user of users) { lines.push(`## ${user.name} (${user.id})`); lines.push(`- **Email**: ${user.email}`); if (user.team) lines.push(`- **Team**: ${user.team}`); lines.push(""); } textContent = lines.join(" "); } else
Tool: reference/node_mcp_server.md [3/4] Description: provides tools to interact with Example API, including user search, * project management, and data export capabilities.
Tool: reference/node_mcp_server.md [4/4]
Malicious tool definition detected
Tool: reference/python_mcp_server.md [1/3] Description: # Python MCP Server Implementation Guide ## Overview This document provides Python-specific best practices and examples for implementing MCP servers using the MCP Python SDK.
Tool: reference/python_mcp_server.md [2/3] Description: ## Type Hints Use type hints throughout: ```python from typing import Optional, List, Dict, Any async def get_user(user_id: str) -> Dict[str, Any]: data = await fetch_user(user_id) return {"id": data["id"], "name": data["name"]} ``` ## Tool Docstrings Every tool must have comprehensive docstrings with explicit type information: ```python async def search_users(params: UserSearchInput) -> str: ''' Search for users in the Example system by na
Tool: reference/python_mcp_server.md [3/3] Description: parameters.
Malicious tool definition detected
Tool: references/acceptance-criteria.md [1/2] Description: # MCP Server Builder Acceptance Criteria **Skill**: `mcp-builder` **Purpose**: Build high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services **Focus**: Tool definitions, server structure, transport configuration, Python/Node/C# implementations --- ## 1.
Tool: references/acceptance-criteria.md [2/2] Description: mcp = FastMCP("my-server") if __name__ == "__main__": mcp.run(transport="http", port=8080) ``` ### 7.3 Transport Selection Guide | Transport | Use Case | Characteristics | |-----------|----------|-----------------| | stdio | Local servers, desktop apps | Simple, single-user | | HTTP | Remote servers, cloud | Scalable, requires auth | --- ## 8.
Malicious tool definition detected
Tool: scripts/requirements.txt
Tool passed security scan
Passed Files (2)Click to expand
Tool passed security scan
Tool passed security scan