Agent skill

MCP Builder

by softspark in softspark/ai-toolkit

Builds production MCP servers via 4-phase methodology: research, implement, test, evaluate.

Apache-2.0Auto-check: notesAgent Workflows

Install MCP Builder

skills CLI
$ npx skills add softspark/ai-toolkit --skill mcp-builder -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install softspark/ai-toolkit mcp-builder --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/softspark/ai-toolkit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/app/skills/mcp-builder .claude/skills/mcp-builder && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
mcp-builder
GitHub stars
179
Token cost
~2.1k tokens
SKILL.md length
1,024 words
Files
1
Skills in repo
112
Repo updated
First seen
Licence
Apache-2.0

At a glance

Builds production MCP servers via 4-phase methodology: research, implement, test, evaluate.

  • Works in 4 steps: Research & Planning → Implementation → Review & Testing → …
  • Tasks that involve MCP servers
  • SKILL.md covers When to Use, 4-Phase Workflow, Tool Design Checklist and Transport Cheat Sheet, plus 6 more sections
  • Calls npm, npx and claude; needs GITHUB_TOKEN and API_KEY

What it does

MCP Builder is an agent skill from softspark/ai-toolkit. Builds production MCP servers via 4-phase methodology: research, implement, test, evaluate. Triggers: build MCP, new MCP, MCP integration, MCP server scaffold.

Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Agent Workflows, covering MCP servers. It works with Model Context Protocol, npm and Python. The repository describes itself as: Professional-grade AI coding toolkit: 94 skills, 44 agents, multi-platform (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment, Antigravity, Codex CLI… The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve MCP servers

Example prompts

  • “Use the mcp-builder skill to build production MCP servers via 4-phase methodology: research, implement, test, evaluate”
  • “/mcp-builder”

Requirements

  • Python 3
  • Node.js
  • A credential in GITHUB_TOKEN
  • A credential in API_KEY
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Bash, Grep, Glob

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Research & Planning
  2. Implementation
  3. Review & Testing
  4. Evaluation

What it can do on your machine

Read from SKILL.md and the folder at commit d64db2b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Bash
    • Grep
    • Glob

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npm
    • npx
    • claude
    • ruff
    • mypy
    • pytest

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • modelcontextprotocol.io
    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GITHUB_TOKEN
    • API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

MCP Builder loads about 2.1k tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 1,024 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~43
When it runs · the whole SKILL.md, loaded when a task matches
~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Read, Write, Edit, Bash, Grep, Glob

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from softspark/ai-toolkit at commit d64db2b, republished under its Apache-2.0 licence (© softspark). 1,024 words, ~2,125 tokens.

Download SKILL.mdSave it as .claude/skills/mcp-builder/SKILL.md (or your agent's skills folder).
name
mcp-builder
description
Builds production MCP servers via 4-phase methodology: research, implement, test, evaluate. Triggers: build MCP, new MCP, MCP integration, MCP server scaffold.
allowed-tools
Read, Write, Edit, Bash, Grep, Glob
effort
high
disable-model-invocation
true
argument-hint
[service name or API description]

MCP Builder

$ARGUMENTS

Build a production-grade MCP server following Anthropic's 4-phase methodology.

When to Use

  • Wrapping a third-party REST API as MCP tools
  • Exposing an internal database or service to Claude
  • Creating reusable integrations for the team
  • Migrating a custom tool into the MCP ecosystem

For MCP protocol theory, see mcp-patterns knowledge skill (auto-loaded).

4-Phase Workflow

Phase 1 — Research & Planning
  1. Read the target API's documentation (OpenAPI spec, README, changelog).
  2. Identify the 5-15 most useful operations. Prefer workflow-oriented tools over 1:1 API mirror.
  3. Decide transport: stdio for local dev tools, streamable-http for remote/shared.
  4. Decide language: TypeScript recommended (best SDK), Python acceptable (mcp package).
  5. List required secrets (API keys, tokens) and their env var names.

Output: PLAN.md with tool list, transport choice, auth model.

Phase 2 — Implementation

Scaffold:

my-mcp/
├── package.json         # or pyproject.toml
├── src/
│   ├── server.ts        # entry point
│   ├── client.ts        # API client (axios/httpx)
│   ├── tools/           # one file per tool
│   ├── schemas.ts       # Zod/Pydantic schemas
│   └── errors.ts        # typed errors
├── .env.example
└── README.md

Per tool:

  • Input/output schemas (Zod for TS, Pydantic for Python)
  • Clear name with service prefix (e.g. github_create_issue)
  • Description starts with a verb, mentions trigger keywords
  • Annotations: readOnlyHint, destructiveHint, idempotentHint, openWorldHint
  • Pagination support via cursor or page parameters
  • Focused responses — filter noise, don't dump raw API payloads
Phase 3 — Review & Testing
  • TypeScript: npm run typecheck && npm run lint && npm test
  • Python: ruff check . && mypy --strict src/ && pytest
  • MCP Inspector dry-run:
    bash
    npx @modelcontextprotocol/inspector node dist/server.js
  • Verify each tool's schema validates a real request and rejects malformed input.
Phase 4 — Evaluation

Write 10 realistic end-user questions that an LLM should be able to answer using your server. Run them through Claude with the server attached. Grade: did the model call the right tool? Did the response give enough to answer? Fix the description, schema, or response format of any tool that failed.

Example eval questions for a github-mcp:

  1. "What issues are open on repo X with label bug?"
  2. "Create an issue titled Y in repo Z"
  3. "Who has the most commits this month in repo X?"

When a tool fails an eval, the cause is almost always the description, not the schema. Score each tool against the description rubric in mcp-patterns (one-line purpose, WHEN TO USE, WHEN NOT TO USE, CRITICAL, self-test). A tool with an empty WHEN NOT TO USE is under-specified — it will misfire the moment a second tool in the same server overlaps with it, so add the boundary before re-running the eval. See mcp-patterns → "How to Write a Tool Description" for the full rubric and worked example.

Tool Design Checklist

  • Name has service prefix and is verb-led
  • Description mentions when to use it and includes trigger keywords
  • Description carries a non-empty WHEN NOT TO USE that names overlapping tools (see mcp-patterns rubric)
  • Input schema is strict, no free-form object with additionalProperties: true
  • Output is focused — essential fields only, with pagination cursor if applicable
  • Error responses are actionable ("API returned 403 — check GITHUB_TOKEN env var")
  • Annotations set correctly (readonly/destructive/idempotent)
  • No secrets logged or echoed in errors
  • Rate limiting respects the upstream API

Transport Cheat Sheet

ScenarioTransport
Local dev tool, 1 userstdio
Remote server, multiple usersstreamable-http with SSE
Internal company tool, auth requiredstreamable-http + OAuth proxy
Embedded in IDE/editorstdio spawned by editor

Registration Cheat Sheet

Local Claude Code (.mcp.json):

json
{
  "mcpServers": {
    "my-mcp": {
      "command": "node",
      "args": ["dist/server.js"],
      "env": { "API_KEY": "$MY_API_KEY" }
    }
  }
}

Global Claude Code (user-scope):

bash
claude mcp add my-mcp --scope user -- node /path/to/server.js

Claude Desktop: same JSON, placed in ~/Library/Application Support/Claude/claude_desktop_config.json (macOS).

Common Pitfalls

MistakeFix
1:1 API mirror with 80 toolsPick 10 workflow-oriented tools
description: "wrapper for /users endpoint"description: "Find users by email, role, or team. Use when the user mentions employees, staff, or access"
Dumping raw JSON responsesFilter to 3-5 fields the agent actually needs
Logging API keys on errorRedact all env vars in error formatters
exit 1 on transient errorsRetry with exponential backoff, surface final error
Stdout pollution (MCP stdio)All logs go to stderr, stdout is JSON-RPC only
Show full SKILL.md (414 more words)Show less

Rules

  • MUST pick 5-15 workflow-oriented tools, not a 1:1 API mirror. The model routes by task, not by endpoint.
  • MUST use strict input schemas (Zod for TS, Pydantic for Python). additionalProperties: true lets the model invent fields and drift.
  • MUST set correct tool annotations: readOnlyHint, destructiveHint, idempotentHint, openWorldHint — the host uses these for safety UIs and auto-approval policies
  • NEVER expose an MCP server on a public network without auth. MCP clients default to trusting the transport — attackers reach tools directly.
  • NEVER log API keys, tokens, or env vars in error messages. A verbose error thrown at the model becomes a stored credential in the conversation.
  • CRITICAL: with stdio transport, all logs go to stderr. Any stdout write that is not a JSON-RPC message breaks the client.
  • MANDATORY: every server ships with a README documenting env vars, required scopes, rate limits, and a minimal invocation example.

Gotchas

  • stdio transport sends the server's stdout directly to the client as protocol frames. A stray print() or console.log() crashes the client with a parse error and no clear diagnostic. Route all logs through a logger that writes to stderr.
  • MCP tool descriptions are the only thing the LLM sees when routing. description: "calls POST /api/v2/tickets" tells the model nothing about intent. Describe when to use, not what it does at the HTTP level.
  • Annotations (readOnlyHint, etc.) are optional in the spec but some hosts (Claude Desktop, Cursor) gate auto-approval on them. Missing destructiveHint: true on a delete tool may cause the client to run it silently.
  • streamable-http with SSE requires the server to handle client reconnects with a Last-Event-ID header. Many quick-start templates skip this and drop events on flaky networks.
  • Pagination cursors must be opaque from the client's perspective but stable across retries. A timestamp cursor that advances on every poll fails if the client retries the same cursor after a transient error.
  • Claude Desktop caches server capabilities on first connection. After changing tool schemas, users must explicitly reload the server (quit + reopen or remove/re-add the server) — simply restarting the server process is not enough.

When NOT to Use

  • For in-toolkit skills (slash commands, knowledge docs) — use /skill-creator
  • For agents inside ai-toolkit — use /agent-creator
  • For plugin packs bundling multiple agents/skills — use /plugin-creator
  • For protocol-level MCP theory and transport trade-offs — use /mcp-patterns (knowledge skill)
  • For conformance/integration testing of an MCP server — delegate to the mcp-testing-engineer agent

© softspark, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in app/skills/mcp-builder of softspark/ai-toolkit.

Open the folder on GitHubat commit d64db2b

Compare with similar skills

MCP Builder next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

MCP Builder compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
MCP Builder this skillsoftspark/ai-toolkit179—~2.1kAutomated safety check: NotesApache-2.0
MCP Server BuildershareAI-lab/learn-claude-code78k5 repos~1.2kAutomated safety check: PassMIT
Context7 MCP Skillholon-run/uxc116—~564Automated safety check: PassMIT
MCP AuthoringOtoDock/oto-dock190—~1.3kAutomated safety check: NotesCustom licence
Fmodel Unpackpa001024/dna-builder136—~2.6kAutomated safety check: PassMIT
Zizkadb ReleaseZIZKA-AI-SL/ZizkaDB123—~399Automated safety check: PassCustom licence

Similar skills

  • MCP Server Builder

    shareAI-lab/learn-claude-code

    Walks through building MCP servers in Python or TypeScript that expose tools, resources and prompts to Claude, with templates, registration and testing.

    78k GitHub starsUsed in 5 repos~1.2k tokens
    Agent WorkflowsAuto-check passed
  • Context7 MCP Skill

    holon-run/uxc

    Query up-to-date library documentation and code examples using Context7 MCP.

    116 GitHub stars~564 tokensUpdated 23 days ago
    Agent WorkflowsAuto-check passed
  • MCP Authoring

    OtoDock/oto-dock

    Author an MCP package for OtoDock: the manifest.json fields and their rules, the package layout, what the installer refuses or drops, credentials and instances, skills bundled with an MCP, and the…

    190 GitHub stars~1.3k tokensUpdated today
    Agent WorkflowsAuto-check: notes
  • Fmodel Unpack

    pa001024/dna-builder

    This skill documents how to use the fmodel-mcp toolkit (a CUE4Parse-based .NET CLI plus a thin Python MCP server) to inspect and export Unreal Engine game assets — pak files, textures, meshes…

    136 GitHub stars~2.6k tokensUpdated today
    Game DevelopmentAuto-check passed
  • Zizkadb Release

    ZIZKA-AI-SL/ZizkaDB

    Bumps versions, runs pre-push verification, and publishes ZizkaDB SDK and MCP packages.

    123 GitHub stars~399 tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • Code Review

    oaslananka/kicad-mcp-pro

    A skill your agent uses for GitHub Copilot pull request and code reviews in oaslananka/kicad-mcp-pro.

    120 GitHub stars~3.9k tokensUpdated today
    DevelopmentAuto-check passed

More from softspark/ai-toolkit

All 112 skills in this repo
  • Prepare Test Env

    softspark/ai-toolkit

    Prepare or verify a project QA environment with source identity, readiness, browser access, evidence paths and owned cleanup.

    179 GitHub stars~1.8k tokensUpdated yesterday
    Auto-check: notes
  • A11y Validate

    softspark/ai-toolkit

    Accessibility validator: WCAG 2.1 AA, EN 301 549, EAA. An agent skill from softspark/ai-toolkit.

    179 GitHub stars~3.8k tokensUpdated yesterday
    Auto-check: notes
  • Analyze

    softspark/ai-toolkit

    Analyzes code quality, complexity, patterns across codebase.

    179 GitHub stars~1k tokensUpdated yesterday
    Auto-check passed
  • Autonomous Dev

    softspark/ai-toolkit

    Drives a brief, specification, issue or existing PR through implementation, review, tests and QA to a ready PR.

    179 GitHub stars~2.6k tokensUpdated yesterday
    Auto-check: notes
  • Brand Voice

    softspark/ai-toolkit

    Direct technical voice for docs, README, user-facing text. An agent skill from softspark/ai-toolkit.

    179 GitHub stars~2.1k tokensUpdated yesterday
    Auto-check passed
  • CI

    softspark/ai-toolkit

    Detect/generate/debug CI pipeline config (GitHub Actions, GitLab CI).

    179 GitHub stars~1.1k tokensUpdated yesterday
    Auto-check: notes

Categories

Questions about MCP Builder

What does MCP Builder do?

Builds production MCP servers via 4-phase methodology: research, implement, test, evaluate. MCP Builder is an agent skill from softspark/ai-toolkit. Builds production MCP servers via 4-phase methodology: research, implement, test, evaluate.

When should I use MCP Builder?

MCP Builder fits situations like: tasks that involve MCP servers.

How do I install MCP Builder in Claude Code?

Run `npx skills add softspark/ai-toolkit --skill mcp-builder -a claude-code`. Or copy the skill folder (app/skills/mcp-builder in softspark/ai-toolkit) into .claude/skills/mcp-builder in your project. Claude Code loads it when a task matches its description.

How do I install MCP Builder in Codex?

Run `npx skills add softspark/ai-toolkit --skill mcp-builder -a codex`. Or copy the skill folder (app/skills/mcp-builder in softspark/ai-toolkit) into .agents/skills/mcp-builder in your project. Codex loads it when a task matches its description.

Can I use MCP Builder in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add softspark/ai-toolkit --skill mcp-builder -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/mcp-builder, .gemini/skills/mcp-builder, .github/skills/mcp-builder and .opencode/skills/mcp-builder in your project.

What does MCP Builder need to run?

Going by SKILL.md and its folder, MCP Builder needs the command-line tools its instructions call (npm, npx, claude, ruff, mypy and pytest) and credentials named GITHUB_TOKEN and API_KEY. Our summary lists: Python 3; Node.js; A credential in GITHUB_TOKEN; A credential in API_KEY. Its frontmatter pre-approves these tools: Read, Write, Edit, Bash, Grep, Glob.

Does MCP Builder access the network?

SKILL.md names 2 domains. As links in the text: modelcontextprotocol.io and github.com. This is read from the text; nothing was executed.

Is MCP Builder safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does MCP Builder use?

MCP Builder is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does MCP Builder use?

About 2.1k tokens (SKILL.md is roughly 8.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to MCP Builder?

Skills that share tags, products or a category with MCP Builder: MCP Server Builder (shareAI-lab/learn-claude-code, 78k stars), Context7 MCP Skill (holon-run/uxc, 116 stars), MCP Authoring (OtoDock/oto-dock, 190 stars) and Fmodel Unpack (pa001024/dna-builder, 136 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains MCP Builder?

softspark (a GitHub user) maintains it in softspark/ai-toolkit, which has 179 GitHub stars. The repository holds 112 skills in this directory. The repository was last updated on October 7, 2026.

Source: softspark/ai-toolkit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.