Agent skill

MCP Patterns

by yonatangross in yonatangross/orchestkit

MCP server building, advanced patterns, and security hardening.

Install MCP Patterns

skills CLI

$ npx skills add yonatangross/orchestkit --skill mcp-patterns -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install yonatangross/orchestkit mcp-patterns --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/yonatangross/orchestkit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/src/skills/mcp-patterns .claude/skills/mcp-patterns && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "mcp-patterns" agent skill from https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns into .claude/skills/mcp-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "mcp-patterns", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add yonatangross/orchestkit --skill mcp-patterns -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install yonatangross/orchestkit mcp-patterns --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yonatangross/orchestkit.git skills-src && mkdir -p .agents/skills && cp -r skills-src/src/skills/mcp-patterns .agents/skills/mcp-patterns && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "mcp-patterns" agent skill from https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns into .agents/skills/mcp-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "mcp-patterns", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add yonatangross/orchestkit --skill mcp-patterns -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install yonatangross/orchestkit mcp-patterns --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yonatangross/orchestkit.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/src/skills/mcp-patterns .cursor/skills/mcp-patterns && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "mcp-patterns" agent skill from https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns into .cursor/skills/mcp-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "mcp-patterns", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/yonatangross/orchestkit.git --path src/skills/mcp-patterns

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add yonatangross/orchestkit --skill mcp-patterns -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install yonatangross/orchestkit mcp-patterns --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yonatangross/orchestkit.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/src/skills/mcp-patterns .gemini/skills/mcp-patterns && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "mcp-patterns" agent skill from https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns into .gemini/skills/mcp-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "mcp-patterns", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install yonatangross/orchestkit mcp-patterns

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add yonatangross/orchestkit --skill mcp-patterns -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/yonatangross/orchestkit.git skills-src && mkdir -p .github/skills && cp -r skills-src/src/skills/mcp-patterns .github/skills/mcp-patterns && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "mcp-patterns" agent skill from https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns into .github/skills/mcp-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "mcp-patterns", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add yonatangross/orchestkit --skill mcp-patterns -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install yonatangross/orchestkit mcp-patterns --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yonatangross/orchestkit.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/src/skills/mcp-patterns .opencode/skills/mcp-patterns && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "mcp-patterns" agent skill from https://github.com/yonatangross/orchestkit/tree/main/src/skills/mcp-patterns into .opencode/skills/mcp-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "mcp-patterns", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: mcp-patterns
GitHub stars: 289
Token cost: ~3.3k tokens
SKILL.md length: 1,203 words
Files: 21 (incl. references)
Skills in repo: 108
Repo updated: Oct 7, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

MCP server building, advanced patterns, and security hardening.

Works in 10 steps: No lifecycle management… → Missing input validation on tool arguments → Returning secrets in tool output (API… → …
Building MCP servers
SKILL.md covers Decision Tree — Which Rule to…, Quick Reference, Key Decisions and Spec & Governance, plus 5 more sections
Calls claude, pip and npx

What it does

MCP Patterns is an agent skill from yonatangross/orchestkit. MCP server building, advanced patterns, and security hardening. Use when building MCP servers, implementing tool handlers, choosing a transport, adding OAuth authentication, wiring MCP Apps UI with @mcp-ui, hardening MCP security, or debugging MCP integrations.

Its SKILL.md is about 3.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 23 other files, including reference files (for example `checklists/mcp-server-checklist.md`, `references/mcp-audit-runbook.md` and `references/mcp-version-matrix.md`). Compatibility notes: Claude Code 2.1.277+.

It sits in Agent Workflows, covering MCP servers. It works with Model Context Protocol. The repository describes itself as: The Complete AI Development Toolkit for Claude Code. 106 skills, 36 agents, 171 hooks. Install ork for stable (v9.x), or ork-alpha for the v10 line, which ships daily. The licence is MIT.

When your agent uses it

Building MCP servers
Implementing tool handlers
Choosing a transport
Adding OAuth authentication

Example prompts

“/mcp-patterns”

Requirements

Python 3
Node.js
Compatibility (from SKILL.md): Claude Code 2.1.277+.
Pre-approved tools (allowed-tools): Read, Glob, Grep, WebFetch, WebSearch

Workflow steps

10 steps, taken from the first numbered list in SKILL.md.

No lifecycle management (connection/resource leaks on shutdown)
Missing input validation on tool arguments
Returning secrets in tool output (API keys, credentials)
Unbounded response sizes without _meta annotation — use _meta["anthropic/maxResultSizeChars"] to declare intentionally large results (DB…
Trusting tool descriptions without sanitization (injection risk)
No hash verification on tool invocations (rug pull vulnerability)
Storing auth tokens in session IDs (credential leak)
Blocking synchronous code in async server (use asyncio.to_thread())
Using SSE transport instead of Streamable HTTP (deprecated since March 2025)
Passing through client tokens to downstream services (confused deputy)

What it can do on your machine

Read from SKILL.md and the folder at commit 0ef71d2. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
- Read
- Glob
- Grep
- WebFetch
- WebSearch
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- claude
- pip
- npx
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
- agenticaifoundation.org
- py.sdk.modelcontextprotocol.io
- modelcontextprotocol.io
- registry.modelcontextprotocol.io
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Claude Code 2.1.277+.
From compatibility in the SKILL.md frontmatter.

Context cost

MCP Patterns loads about 3.3k tokens when it runs, and up to ~7.1k if it reads all its reference files. Until then it costs about 69 tokens; SKILL.md has 1,203 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~69
When it runs · the whole SKILL.md, loaded when a task matches: ~3.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~7.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from yonatangross/orchestkit at commit 0ef71d2, republished under its MIT licence (© yonatangross). 1,203 words, ~3,286 tokens.

Download SKILL.mdSave it as .claude/skills/mcp-patterns/SKILL.md (or your agent's skills folder). This skill also uses 20 other files; get the full folder from GitHub.

name: mcp-patterns
description: MCP server building, advanced patterns, and security hardening. Use when building MCP servers, implementing tool handlers, choosing a transport, adding OAuth authentication, wiring MCP Apps UI with @mcp-ui, hardening MCP security, or debugging MCP integrations.
allowed-tools: Read, Glob, Grep, WebFetch, WebSearch
compatibility: Claude Code 2.1.277+.
license: MIT
user-invocable: false
disable-model-invocation: true
effort: high
metadata.category: mcp-enhancement
metadata.spec-version: 2025-11-25
metadata.version: 3.1.0
metadata.author: OrchestKit
metadata.complexity: high
metadata.tags: mcp, server, tools, resources, security, prompt-injection, oauth, elicitation, sampling, mcp-apps, fastmcp

MCP Patterns

Patterns for building, composing, and securing Model Context Protocol servers. Based on the 2025-11-25 specification — the latest stable release maintained by the Agentic AI Foundation (Linux Foundation), co-founded by Anthropic, Block, and OpenAI.

Scaffolding a new server? Use Anthropic's mcp-builder skill (from the anthropics/skills marketplace: /plugin marketplace add anthropics/skills) for project setup and evaluation creation. This skill focuses on patterns, security, and advanced features after initial setup.

Deploying to Cloudflare? See the building-mcp-server-on-cloudflare skill for Workers-specific deployment patterns.

Pin mcp<2 until you migrate. Every Python snippet in this skill targets the v1 SDK (from mcp.server.fastmcp import FastMCP). The Python SDK released 2.0.0, pip install mcp now resolves to it, and upstream's own README says to keep a <2 upper bound on your requirement until you have migrated. FastMCP does not appear anywhere in the 2.0 README, so treat these snippets as v1-only rather than assuming they still apply. v1.x continues to receive critical bug and security fixes on its own branch. Verified 2026-07-31. Migration guide: https://py.sdk.modelcontextprotocol.io/migration/

Decision Tree — Which Rule to Read

What are you building?
│
├── New MCP server
│   ├── Setup & primitives ──────► rules/server-setup.md
│   ├── Transport selection ─────► rules/server-transport.md
│   └── Scaffolding ─────────────► mcp-builder skill (anthropics/skills)
│
├── Authentication & authorization
│   └── OAuth 2.1 + OIDC ───────► rules/auth-oauth21.md
│
├── Advanced server features
│   ├── Tool composition ────────► rules/advanced-composition.md
│   ├── Resource caching ────────► rules/advanced-resources.md
│   ├── Elicitation (user input) ► rules/elicitation.md
│   ├── Sampling (agent loops) ──► rules/sampling-tools.md
│   └── Interactive UI ──────────► rules/apps-ui.md
│
├── Client-side consumption
│   └── Connecting to servers ───► rules/client-patterns.md
│
├── Security hardening
│   ├── Prompt injection defense ► rules/security-injection.md
│   └── Zero-trust & verification ► rules/security-hardening.md
│
├── Testing & debugging
│   └── Inspector + unit tests ──► rules/testing-debugging.md
│
├── Discovery & ecosystem
│   └── Registries & catalogs ──► rules/registry-discovery.md
│
└── Browser-native tools
    └── WebMCP (W3C) ───────────► rules/webmcp-browser.md

Quick Reference

Category	Rule	Impact	Key Pattern
Server	`server-setup.md`	HIGH	FastMCP lifespan, Tool/Resource/Prompt primitives
Server	`server-transport.md`	HIGH	stdio for CLI, Streamable HTTP for production
Auth	`auth-oauth21.md`	HIGH	PKCE, RFC 8707 resource indicators, token validation
Advanced	`advanced-composition.md`	MEDIUM	Pipeline, parallel, and branching tool composition
Advanced	`advanced-resources.md`	MEDIUM	Resource caching with TTL, LRU eviction, lifecycle
Advanced	`elicitation.md`	MEDIUM	Server-initiated structured input from users
Advanced	`sampling-tools.md`	MEDIUM	Server-side agent loops with tool calling
Advanced	`apps-ui.md`	MEDIUM	Interactive UI via MCP Apps + @mcp-ui/* SDK
Client	`client-patterns.md`	MEDIUM	TypeScript/Python MCP client connection patterns
Security	`security-injection.md`	HIGH	Description sanitization, encoding normalization
Security	`security-hardening.md`	HIGH	Zero-trust allowlist, hash verification, rug pull detection
Quality	`testing-debugging.md`	MEDIUM	MCP Inspector, unit tests, transport debugging
Ecosystem	`registry-discovery.md`	LOW	Official registry API, server metadata
Ecosystem	`webmcp-browser.md`	LOW	W3C browser-native agent tools (complementary)

Total: 14 rules across 6 categories

Key Decisions

Decision	Recommendation
Transport	stdio for CLI/Desktop, Streamable HTTP for production (SSE deprecated)
Language	TypeScript for production (better SDK support, type safety)
Auth	OAuth 2.1 with PKCE (S256) + RFC 8707 resource indicators
Server lifecycle	Always use FastMCP lifespan for resource management
Error handling	Return errors as text content (Claude can interpret and retry)
Tool composition	Pipeline for sequential, `asyncio.gather` for parallel
Resource caching	TTL + LRU eviction with memory cap
Tool trust model	Zero-trust: explicit allowlist + hash verification
User input	Elicitation for runtime input; never request PII via elicitation
Interactive UI	MCP Apps with @mcp-ui/* SDK; sandbox all iframes
Token handling	Never pass through client tokens to downstream services
Large results	Use `_meta["anthropic/maxResultSizeChars"]` annotation (up to 500K) for results that lose meaning when truncated (CC 2.1.91)

Spec & Governance

Protocol: Model Context Protocol, spec version 2025-11-25 (latest stable)
Governance: Agentic AI Foundation (Linux Foundation, Dec 2025)
Platinum members: AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI
Adoption: 10,000+ servers; Claude, Cursor, Copilot, Gemini, ChatGPT, VS Code
Spec URL: https://modelcontextprotocol.io/specification/2025-11-25
2026 model: Working Groups and Interest Groups are now the primary vehicle for protocol evolution (no more milestone-based releases). Enterprise readiness lands as extensions, not core spec changes.

Feature Maturity

Feature	Spec Version	Status
Tools, Resources, Prompts	2024-11-05	Stable
Streamable HTTP transport	2025-03-26	Stable (replaces SSE)
OAuth 2.1 + Elicitation (form)	2025-06-18	Stable
Sampling with tool calling	2025-11-25	Stable
Elicitation URL mode	2025-11-25	Stable
MCP Apps (UI extension)	2026-01-26	Extension (ext-apps)
WebMCP (browser-native)	2026-02-14	W3C Community Draft

SDK landscape (2026-Q2)

Package	What it is	When to use
`mcp` (PyPI) >=1.27	Official Python SDK — includes the `FastMCP` helper, transport adapters, Inspector	New Python servers. This is the canonical package.
`@modelcontextprotocol/sdk` (npm) >=1.29	Official TypeScript SDK	New TS servers
`fastmcp` (PyPI)	Standalone fork by jlowin — predates `mcp`; API-compatible but diverges on lifespan and middleware	Existing projects pinned to it. New projects should prefer `mcp`.

The fastmcp fork and the mcp.server.fastmcp module are not the same package. Imports and pyproject.toml entries must agree or stacktraces become cryptic.

Show full SKILL.md (562 more words)Show less

Debugging with Claude Code

Pass --mcp-debug to Claude Code when troubleshooting server wiring — it surfaces the raw JSON-RPC frames, handshake failures, and tool-registration events that the default logger swallows:

bash

claude --mcp-debug "query the local test server"
# or per-session:
export CLAUDE_MCP_DEBUG=1

Use alongside the MCP Inspector (npx @modelcontextprotocol/inspector <cmd>) — Inspector gives you the client-side frame view, --mcp-debug gives you what Claude actually saw.

CC 2.1.128 — reconnect tool summarization: when a server reconnects mid-session, re-announced tools are summarized as mcp__<server>__* (N tools re-registered) instead of being enumerated line-by-line. Use the initial connect event as the source of truth for tool inventory; treat reconnect summaries as deltas only. See references/mcp-audit-runbook.md for grep recipes that work across both formats.

CC 2.1.133 — MCP OAuth honors HTTP(S)_PROXY / NO_PROXY / mTLS: the full MCP OAuth flow (discovery, dynamic client registration, token exchange, token refresh) now respects standard proxy and client-certificate env vars end-to-end. Enterprise deployments behind corporate proxies no longer need OAuth-specific workarounds — the same HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS config that already routes MCP transport now also routes auth. See configure/references/cc-version-settings.md (CC 2.1.133 section) for the env-var example. The companion deployment skill building-mcp-server-on-cloudflare can drop any prior "proxy-aware OAuth requires manual handling" caveat at this floor.

CC 2.1.169 — managed MCP policies enforced everywhere: enterprise allowedMcpServers/deniedMcpServers now apply on reconnect, IDE-typed configs, --mcp-config servers in the first session after install, and before remote settings load (previously all four paths skipped enforcement). Orgs without remote settings also get faster cold starts. If a previously-working server stops connecting after 2.1.169, check the managed policy before debugging the server.

CC 2.1.163 — stdio servers get CLAUDE_CODE_SESSION_ID: on --resume, stdio MCP servers now receive the same CLAUDE_CODE_SESSION_ID env var that hooks and Bash already get. Read it inside the server to correlate logs/telemetry across resumed sessions instead of minting your own session key — but never store auth tokens keyed off it (see Common Mistake #7).

Example

python

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-server")

@mcp.tool()
async def search(query: str) -> str:
    """Search documents. Returns matching results."""
    results = await db.search(query)
    return "\n".join(r.title for r in results[:10])

Common Mistakes

No lifecycle management (connection/resource leaks on shutdown)
Missing input validation on tool arguments
Returning secrets in tool output (API keys, credentials)
- CC 2.1.161 mitigates this at the CLI layer: claude mcp list/get/add no longer expands ${VAR} references and redacts credential headers and URL secrets in terminal output — but server code must still never return secrets in tool results. /mcp also collapses never-signed-in connectors behind a "Show unused connectors" row.
- CC 2.1.186 adds claude mcp login <name> / claude mcp logout <name> for OAuth-backed servers (HTTP/SSE/connector). Pass --no-browser to print the authorization URL instead of opening a browser — the supported path for SSH/headless/remote sessions (paste the redirect URL back when prompted), so interactive-only auth never blocks automated setup.
Unbounded response sizes without _meta annotation — use _meta["anthropic/maxResultSizeChars"] to declare intentionally large results (DB schemas, API specs) so clients/hooks don't truncate them
Trusting tool descriptions without sanitization (injection risk)
No hash verification on tool invocations (rug pull vulnerability)
Storing auth tokens in session IDs (credential leak)
Blocking synchronous code in async server (use asyncio.to_thread())
Using SSE transport instead of Streamable HTTP (deprecated since March 2025)
Passing through client tokens to downstream services (confused deputy)

Ecosystem

Resource	What For
`mcp-builder` skill (anthropics/skills)	Scaffold new MCP servers + create evals
`building-mcp-server-on-cloudflare` skill	Deploy MCP servers on Cloudflare Workers
`@mcp-ui/*` packages (npm)	Implement MCP Apps UI standard
MCP Registry	Discover servers: https://registry.modelcontextprotocol.io/
MCP Inspector	Debug and test servers interactively

ork:llm-integration — LLM function calling patterns
ork:security-patterns — General input sanitization and layered security
ork:api-design — REST/GraphQL API design patterns

Files

SKILL.md and 20 other files (references) in src/skills/mcp-patterns of yonatangross/orchestkit.

SKILL.md
checklists/mcp-server-checklist.md
references/mcp-audit-runbook.md
references/mcp-version-matrix.md
rules/_sections.md
rules/_template.md
rules/advanced-composition.md
rules/advanced-resources.md
rules/apps-ui.md
rules/auth-oauth21.md
rules/client-patterns.md
rules/elicitation.md
rules/registry-discovery.md
rules/sampling-tools.md
rules/security-hardening.md
rules/security-injection.md
rules/server-setup.md
rules/server-transport.md
… and 3 more

Open the folder on GitHubat commit 0ef71d2

Compare with similar skills

MCP Patterns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

MCP Patterns compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
MCP Patterns this skillyonatangross/orchestkit	289	—	~3.3k	Automated safety check: Pass	MIT	yesterday
MCP Server Builderanthropics/skills	180k	64 repos	~2.3k	Automated safety check: Pass	Apache-2.0	3 days ago
MCP Server BuildershareAI-lab/learn-claude-code	78k	5 repos	~1.2k	Automated safety check: Pass	MIT	10 days ago
MCP Integration for Pluginsanthropics/claude-plugins-official	38k	11 repos	~3.1k	Automated safety check: Pass	Apache-2.0	today
Fastmcp Client CLIPrefectHQ/fastmcp	28k	1 repos	~823	Automated safety check: Pass	Apache-2.0	today
Crush Configurationcharmbracelet/crush	29k	—	~3.7k	Automated safety check: Pass	Custom licence	yesterday

Similar skills

MCP Server Builder
anthropics/skills
Official
Guides the design and implementation of Model Context Protocol servers in TypeScript or Python, from tool naming and error messages to evaluation.
180k GitHub starsUsed in 64 repos~2.3k tokens
Agent WorkflowsAuto-check passed
MCP Server Builder
shareAI-lab/learn-claude-code
Walks through building MCP servers in Python or TypeScript that expose tools, resources and prompts to Claude, with templates, registration and testing.
78k GitHub starsUsed in 5 repos~1.2k tokens
Agent WorkflowsAuto-check passed
MCP Integration for Plugins
anthropics/claude-plugins-official
Official
Explains how to bundle Model Context Protocol servers in a Claude Code plugin, covering config files, stdio, SSE, HTTP and WebSocket server types, and authentication.
38k GitHub starsUsed in 11 repos~3.1k tokens
Agent WorkflowsAuto-check passed
Fastmcp Client CLI
PrefectHQ/fastmcp
Query and invoke tools on MCP servers using fastmcp list and fastmcp call.
28k GitHub starsUsed in 1 repo~823 tokens
Agent WorkflowsAuto-check passed
Crush Configuration
charmbracelet/crush
Explains how to configure the Crush coding agent with crushrc or crush.json, covering providers, models, LSPs, MCP servers, hooks, permissions and config precedence.
29k GitHub stars~3.7k tokensUpdated yesterday
Agent WorkflowsAuto-check passed
Context Mode Output Sandbox
mksglu/context-mode
Routes large command, file, API and browser output through context-mode tools so only the needed result enters the agent's context, instead of dumping it via Bash.
26k GitHub stars~4.1k tokensUpdated yesterday
Agent WorkflowsAuto-check passed

Questions about MCP Patterns

What does MCP Patterns do?

MCP server building, advanced patterns, and security hardening. MCP Patterns is an agent skill from yonatangross/orchestkit. MCP server building, advanced patterns, and security hardening.

When should I use MCP Patterns?

MCP Patterns fits situations like: building MCP servers; implementing tool handlers; choosing a transport; adding OAuth authentication.

How do I install MCP Patterns in Claude Code?

Run `npx skills add yonatangross/orchestkit --skill mcp-patterns -a claude-code`. Or copy the skill folder (src/skills/mcp-patterns in yonatangross/orchestkit) into .claude/skills/mcp-patterns in your project. Claude Code loads it when a task matches its description.

How do I install MCP Patterns in Codex?

Run `npx skills add yonatangross/orchestkit --skill mcp-patterns -a codex`. Or copy the skill folder (src/skills/mcp-patterns in yonatangross/orchestkit) into .agents/skills/mcp-patterns in your project. Codex loads it when a task matches its description.

Can I use MCP Patterns in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yonatangross/orchestkit --skill mcp-patterns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/mcp-patterns, .gemini/skills/mcp-patterns, .github/skills/mcp-patterns and .opencode/skills/mcp-patterns in your project.

What does MCP Patterns need to run?

Going by SKILL.md and its folder, MCP Patterns needs the command-line tools its instructions call (claude, pip and npx). Our summary lists: Python 3; Node.js. Its frontmatter pre-approves these tools: Read, Glob, Grep, WebFetch, WebSearch. Compatibility (from SKILL.md): Claude Code 2.1.277+..

Does MCP Patterns access the network?

SKILL.md names 4 domains. As links in the text: agenticaifoundation.org, py.sdk.modelcontextprotocol.io, modelcontextprotocol.io and registry.modelcontextprotocol.io. This is read from the text; nothing was executed.

Is MCP Patterns safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does MCP Patterns use?

MCP Patterns is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does MCP Patterns use?

About 3.3k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.8k tokens, read only when the agent opens those files.

What are the alternatives to MCP Patterns?

Skills that share tags, products or a category with MCP Patterns: MCP Server Builder (anthropics/skills, 180k stars), MCP Server Builder (shareAI-lab/learn-claude-code, 78k stars), MCP Integration for Plugins (anthropics/claude-plugins-official, 38k stars) and Fastmcp Client CLI (PrefectHQ/fastmcp, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains MCP Patterns?

yonatangross (a GitHub user) maintains it in yonatangross/orchestkit, which has 289 GitHub stars. The repository holds 108 skills in this directory. The repository was last updated on October 7, 2026.

Source: yonatangross/orchestkit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install MCP Patterns

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Compatibility

Context cost

Safety

SKILL.md

MCP Patterns

Decision Tree — Which Rule to Read

Quick Reference

Key Decisions

Spec & Governance

Feature Maturity

SDK landscape (2026-Q2)

Debugging with Claude Code

Example

Common Mistakes

Ecosystem

Related Skills

Files

Compare with similar skills

Similar skills

More from yonatangross/orchestkit

Related

Questions about MCP Patterns