mcp-builder

anthropics/skills/skills/mcp-builder

This skill provides guidelines, code templates, and a Python evaluation harness to help AI coding agents build and test Model Context Protocol (MCP) servers in TypeScript and Python. It contains no malicious behavior, though a couple of older reference code examples show insecure patterns (an unsanitized file path and an HTTP server bound to all network interfaces) that an agent could copy into generated code.

What it can reach

Files

The evaluation script reads XML test files and writes Markdown report files, while the skill instructions guide the agent to create and edit MCP server source files.

Network

The evaluation harness sends prompts and tool outputs to the Anthropic API and connects to target MCP servers over HTTP or SSE; the skill also instructs the agent to fetch official MCP documentation from GitHub and modelcontextprotocol.io.

Shell commands

The evaluation harness spawns local MCP server commands provided via command-line flags, and the skill instructs the agent to run npm, npx, and python build and test commands.

Secrets

The evaluation harness uses the ANTHROPIC_API_KEY environment variable and can pass user-supplied environment variables or HTTP headers (such as API tokens) to the MCP server under test.

Findings

1. LowPath traversal pattern in Python resource example

   skills/mcp-builder/reference/python_mcp_server.md:539

   The Python implementation guide illustrates how to expose local files as MCP resources by directly interpolating the user-supplied URI parameter into a file path without checking for directory traversal sequences (such as '..'). If an agent copies this pattern when generating a server for a user, someone controlling tool or resource arguments could read arbitrary files outside the intended './docs/' directory.

   Fix: Resolve the path with pathlib.Path.resolve() and verify that it stays within the intended base directory before opening the file, matching the advice given in the TypeScript v2 guide.

2. LowHTTP server example in v1 TypeScript guide binds to all interfaces without Origin protection

   skills/mcp-builder/reference/node_mcp_server.md:740

   In the legacy v1 TypeScript guide, the Streamable HTTP example calls Express's app.listen(port) without a host address and without Host or Origin header validation. In Node.js, omitting the host binds the server to all network interfaces (0.0.0.0 / ::), which can expose a generated local server to other devices on the network and to browser-based DNS rebinding attacks.

   Fix: Bind explicitly to '127.0.0.1' by calling app.listen(port, '127.0.0.1', ...) and validate the Origin and Host headers, as shown in the v2 TypeScript guide.