mcp-best-practicesBuild production MCP servers with the TypeScript SDK. Covers spec 2025-11-25, SDK v1.29+/v2 alpha, transport selection, tool design, error handling, security...
Install via ClawdBot CLI:
clawdbot install tenequm/mcp-best-practicesGrade Limited — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaSends data to undocumented external endpoint (potential exfiltration)
post → https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/2026-01Potentially destructive shell commands in tool definitions
rm -rf /Accesses system directories or attempts privilege escalation
sudo rmGenerated May 5, 2026
A SaaS offering multiple AI-powered tools (e.g., data analysis, CRM integration). Each customer gets an isolated MCP server instance per request using the stateless pattern, ensuring no cross-tenant data leakage. Tools are registered per customer based on their subscription tier.
An internal AI assistant for HR, IT, and finance that can query databases, update tickets, and run scripts. Uses stdio transport for on-premise deployment with strict ACL annotations (destructiveHint, readOnlyHint) to prevent unauthorized modifications.
A lightweight MCP server deployed on Cloudflare Workers using WebStandardStreamableHTTPServerTransport with stateless session handling. Handles public-facing APIs like weather or translation, optimized for low latency and no persistent sessions.
An MCP server that provides product recommendations via tools and pushes real-time inventory changes through SSE subscriptions. Uses stateful transport with session tracking for long-lived connections and structuredContent for rich product responses.
An MCP server for analyzing anonymized patient data, registered in the MCP Registry for use by authorized medical AI agents. Tools enforce read-only access and outputSchema for structured results, with security best practices to meet HIPAA guidelines.
Charge customers based on the number of tool invocations (e.g., $0.01 per search_tweets call). Use annotations like idempotentHint to ensure idempotent billing, and implement rate limiting via toolAnnotations to prevent abuse.
Offer Basic ($10/mo, 3 tools) and Pro ($50/mo, 10 tools, streaming). Dynamically register tools based on subscription using the McpServer per request pattern. Extensions like MCP Apps can provide interactive UIs for higher tiers.
Operate an MCP Registry where developers publish tools with outputSchema and annotations. Charge a listing fee and revenue share (e.g., 20%) on tool usage. Businesses discover and integrate tools via the Registry.
💬 Integration Tip
Start by defining your transport strategy (stateless vs stateful) before writing any tool logic; this ensures your architecture scales and avoids common pitfalls like session leaks.
Scored Apr 19, 2026
Calls external URL not in known-safe list
https://spec.modelcontextprotocol.ioAI Analysis
This is a legitimate technical documentation skill about MCP server development best practices. The 'signals' appear to be false positives from pattern matching on example code snippets (like SSH key paths, rm commands, and spec URLs) that are part of instructional content, not actual malicious functionality. The skill does not execute code or exfiltrate data.
Audited Apr 16, 2026 · audit v1.0
Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type generation.
Secure, sandboxed filesystem access enabling agents to list, read, write, create, move, delete, search files and directories within allowed paths.
Provides access to MCP tools for web search, advanced search, code context, deep research, crawling, company research, and LinkedIn search.
Use Model Context Protocol servers to access external tools and data sources. Enable AI agents to discover and execute tools from configured MCP servers (legal databases, APIs, database connectors, weather services, etc.).
Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type gene...
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).