跳到主要内容
知仓学习社ZHICANG

create-mcp-servers

Create Model Context Protocol (MCP) servers that expose tools, resources, and prompts to Claude. Use when building custom integrations, APIs, data s…

读凭据执行命令联网写文件严重 12 · 高危 16glittercowboy/taches-cc-resources

它会碰到什么

扫了多少23 个文本文件,249 KB
它会碰到什么读凭据执行命令联网写文件
命中总数56 处
命中统计严重 12 · 高 16 · 中 2 · 低 0
逐条看命中(28 条严重或高危)
  • 严重 references/auto-installation.md:232cred-paths
    - [ ] `.env` files are in `.gitignore`
  • 严重 references/auto-installation.md:321cred-paths
    - Check `~/.claude/.env` exists
  • 严重 references/creation-workflow.md:142cred-paths
    cat > .gitignore << 'EOF'
  • 严重 references/creation-workflow.md:198cred-paths
    cat > .gitignore << 'EOF'
  • 严重 references/creation-workflow.md:508persistence
    cat >> ~/.zshrc << 'EOF'
  • 严重 references/creation-workflow.md:763exec-pipe-to-shell
    curl -LsSf https://astral.sh/uv/install.sh | sh
  • 严重 references/creation-workflow.md:775persistence
    echo 'export ENV_VAR_NAME="value"' >> ~/.zshrc
  • 严重 references/python-implementation.md:510cred-paths
    **Load .env in development**:
  • 严重 scripts/setup-python-project.sh:31cred-paths
    .venv/
  • 严重 scripts/setup-typescript-project.sh:59cred-paths
    build/
  • 严重 SKILL.md:147persistence
    echo 'export MY_API_KEY="value"' >> ~/.zshrc && source ~/.zshrc
  • 严重 workflows/troubleshoot-server.md:104persistence
    echo 'export VAR_NAME="value"' >> ~/.zshrc
  • references/auto-installation.md:83identity-config-write
    Edit `~/Library/Application Support/Claude/claude_desktop_config.json`:
  • references/auto-installation.md:255identity-config-write
    cat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers'
  • references/auto-installation.md:258identity-config-write
    cat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers["meta-ads"]'
  • references/auto-installation.md:261identity-config-write
    cat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers["meta-ads"].cwd'
  • references/auto-installation.md:264identity-config-write
    cat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers["meta-ads"].env'
  • references/auto-installation.md:316identity-config-write
    - Verify JSON syntax: `jq '.' ~/Library/Application\ Support/Claude/claude_desktop_config.json`
  • references/best-practices.md:691identity-config-write
    2. **Update claude_desktop_config.json**:
  • references/best-practices.md:1775identity-config-write
    Add to `claude_desktop_config.json`:
  • references/creation-workflow.md:601identity-config-write
    DESKTOP_CONFIG="$HOME/Library/Application Support/Claude/claude_desktop_config.json"
  • references/creation-workflow.md:743identity-config-write
    jq '.mcpServers | has("{server-name}")' "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
  • references/creation-workflow.md:832identity-config-write
    - Can restore with: `cp claude_desktop_config.json.backup.<timestamp> claude_desktop_config.json`
  • references/creation-workflow.md:832identity-config-write
    - Can restore with: `cp claude_desktop_config.json.backup.<timestamp> claude_desktop_config.json`
  • references/validation-checkpoints.md:94identity-config-write
    jq '.mcpServers | has("{server-name}")' "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
  • templates/python-server.py:41cred-envread
    api_key = os.environ.get("{API_KEY_VAR}")
  • templates/typescript-server.ts:29cred-envread
    process.env.HOME || "",
  • workflows/create-new-server.md:243identity-config-write
    Update `~/Library/Application Support/Claude/claude_desktop_config.json`

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

<objective>

MCP servers extend Claude's capabilities by exposing tools, resources, and prompts. This skill guides creation of production-ready MCP servers with API integrations, OAuth authentication, response optimization, and proper installation in Claude Code and Claude Desktop.

</objective>

<essential_principles>

<the_5_rules>

Every MCP server must follow these:

  1. Never Hardcode Secrets - Use ${VAR} expansion in configs, environment variables in code
  2. Use cwd Property - Isolates dependencies (not --cwd in args)
  3. Always Absolute Paths - which uv to find paths, never relative
  4. One Server Per Directory - ~/Developer/mcp/{server-name}/
  5. Use uv for Python - Better than pip, handles venvs automatically

</the_5_rules>

<security_checklist>

  • Never ask user to paste secrets into chat
  • Always use environment variables for credentials
  • Use ${VAR} expansion in configs
  • Provide exact commands for user to run in terminal
  • Verify environment variable existence without showing values
  • Never hardcode API keys in code or configs

</security_checklist>

<architecture_decision>

Operation count determines architecture:

  • 1-2 operations → Traditional pattern (flat tools)
  • 3+ operations → On-demand discovery pattern (meta-tools)

Traditional: Each operation is a separate tool

On-demand: 4 meta-tools (discover, get_schema, execute, continue) + operations.json

</architecture_decision>

<context>

MCP servers expose:

  • Tools: Functions Claude can call (API requests, file operations, calculations)
  • Resources: Data Claude can read (files, database records, API responses)
  • Prompts: Reusable prompt templates with arguments

Standard location: ~/Developer/mcp/{server-name}/

</context>

</essential_principles>

<routing>

Based on user intent, route to appropriate workflow:

No context provided (skill invoked without description):

Use AskUserQuestion:

  • header: "Mode"
  • question: "What would you like to do?"
  • options:
  • "Create a new MCP server" → workflows/create-new-server.md
  • "Update an existing MCP server" → workflows/update-existing-server.md
  • "Troubleshoot a server" → workflows/troubleshoot-server.md

Context provided (user described what they want):

Route directly to workflows/create-new-server.md

</routing>

<workflows_index>

| Workflow | Purpose |

|----------|---------|

| create-new-server.md | Full 8-step workflow from intake to verification |

| update-existing-server.md | Modify or extend an existing server |

| troubleshoot-server.md | Diagnose and fix connection/runtime issues |

</workflows_index>

<templates_index>

| Template | Purpose |

|----------|---------|

| python-server.py | Traditional pattern starter for Python |

| typescript-server.ts | Traditional pattern starter for TypeScript |

| operations.json | On-demand discovery operations definition |

</templates_index>

<scripts_index>

| Script | Purpose |

|--------|---------|

| setup-python-project.sh | Initialize Python MCP project with uv |

| setup-typescript-project.sh | Initialize TypeScript MCP project with npm |

</scripts_index>

<references_index>

Core workflow:

  • creation-workflow.md - Complete step-by-step with exact commands

Architecture patterns:

  • traditional-pattern.md - For 1-2 operations (flat tools)
  • large-api-pattern.md - For 3+ operations (on-demand discovery)

Language-specific:

  • python-implementation.md - Async patterns, type hints
  • typescript-implementation.md - Type safety, SDK features

Advanced topics:

  • oauth-implementation.md - OAuth with stdio isolation
  • response-optimization.md - Field truncation, pagination
  • tools-and-resources.md - Resources API, prompts, streaming
  • testing-and-deployment.md - Unit tests, packaging, publishing
  • validation-checkpoints.md - All validation checks
  • adaptive-questioning-guide.md - Question templates for intake
  • api-research-template.md - API research document format

</references_index>

<quick_reference>

# List servers
claude mcp list

# Add server (Python)
claude mcp add --transport stdio <name> \
  --env API_KEY='${API_KEY}' \
  -- uv --directory ~/Developer/mcp/<name> run python -m src.server

# Add server (TypeScript)
claude mcp add --transport stdio <name> \
  --env API_KEY='${API_KEY}' \
  -- node ~/Developer/mcp/<name>/build/index.js

# Remove server
claude mcp remove <name>

# Check logs
tail -f ~/Library/Logs/Claude/mcp-server-<name>.log

# Find paths
which uv && which node && which python

</quick_reference>

<troubleshooting_quick>

Server not appearing: Check claude mcp list, verify config in ~/.claude/settings.json

"command not found": Use absolute paths from which uv / which node

Environment variable not found:

echo $MY_API_KEY  # Check if set
echo 'export MY_API_KEY="value"' >> ~/.zshrc && source ~/.zshrc

Secrets visible in conversation: STOP. Delete conversation. Rotate credentials. Never paste secrets in chat.

Full troubleshooting: workflows/troubleshoot-server.md

</troubleshooting_quick>

<success_criteria>

A production-ready MCP server has:

  • Valid configuration in Claude Code (claude mcp list shows ✓ Connected)
  • Valid configuration in Claude Desktop config
  • Environment variables set securely in ~/.zshrc
  • Architecture matches operation count
  • OAuth stdio isolation if applicable
  • Response optimization for list/search operations
  • All validation checkpoints passed
  • No errors in logs

</success_criteria>

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。