create-mcp-servers
Create Model Context Protocol (MCP) servers that expose tools, resources, and prompts to Claude. Use when building custom integrations, APIs, data s…
它会碰到什么
逐条看命中(28 条严重或高危)
- 严重
references/auto-installation.md:232cred-paths- [ ] `.env` files are in `.gitignore`
- 严重
references/auto-installation.md:321cred-paths- Check `~/.claude/.env` exists
- 严重
references/creation-workflow.md:142cred-pathscat > .gitignore << 'EOF'
- 严重
references/creation-workflow.md:198cred-pathscat > .gitignore << 'EOF'
- 严重
references/creation-workflow.md:508persistencecat >> ~/.zshrc << 'EOF'
- 严重
references/creation-workflow.md:763exec-pipe-to-shellcurl -LsSf https://astral.sh/uv/install.sh | sh
- 严重
references/creation-workflow.md:775persistenceecho 'export ENV_VAR_NAME="value"' >> ~/.zshrc
- 严重
references/python-implementation.md:510cred-paths**Load .env in development**:
- 严重
scripts/setup-python-project.sh:31cred-paths.venv/
- 严重
scripts/setup-typescript-project.sh:59cred-pathsbuild/
- 严重
SKILL.md:147persistenceecho 'export MY_API_KEY="value"' >> ~/.zshrc && source ~/.zshrc
- 严重
workflows/troubleshoot-server.md:104persistenceecho 'export VAR_NAME="value"' >> ~/.zshrc
- 高
references/auto-installation.md:83identity-config-writeEdit `~/Library/Application Support/Claude/claude_desktop_config.json`:
- 高
references/auto-installation.md:255identity-config-writecat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers'
- 高
references/auto-installation.md:258identity-config-writecat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers["meta-ads"]'
- 高
references/auto-installation.md:261identity-config-writecat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers["meta-ads"].cwd'
- 高
references/auto-installation.md:264identity-config-writecat ~/Library/Application\ Support/Claude/claude_desktop_config.json | jq '.mcpServers["meta-ads"].env'
- 高
references/auto-installation.md:316identity-config-write- Verify JSON syntax: `jq '.' ~/Library/Application\ Support/Claude/claude_desktop_config.json`
- 高
references/best-practices.md:691identity-config-write2. **Update claude_desktop_config.json**:
- 高
references/best-practices.md:1775identity-config-writeAdd to `claude_desktop_config.json`:
- 高
references/creation-workflow.md:601identity-config-writeDESKTOP_CONFIG="$HOME/Library/Application Support/Claude/claude_desktop_config.json"
- 高
references/creation-workflow.md:743identity-config-writejq '.mcpServers | has("{server-name}")' "$HOME/Library/Application Support/Claude/claude_desktop_config.json" - 高
references/creation-workflow.md:832identity-config-write- Can restore with: `cp claude_desktop_config.json.backup.<timestamp> claude_desktop_config.json`
- 高
references/creation-workflow.md:832identity-config-write- Can restore with: `cp claude_desktop_config.json.backup.<timestamp> claude_desktop_config.json`
- 高
references/validation-checkpoints.md:94identity-config-writejq '.mcpServers | has("{server-name}")' "$HOME/Library/Application Support/Claude/claude_desktop_config.json" - 高
templates/python-server.py:41cred-envreadapi_key = os.environ.get("{API_KEY_VAR}") - 高
templates/typescript-server.ts:29cred-envreadprocess.env.HOME || "",
- 高
workflows/create-new-server.md:243identity-config-writeUpdate `~/Library/Application Support/Claude/claude_desktop_config.json`
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
<objective>
MCP servers extend Claude's capabilities by exposing tools, resources, and prompts. This skill guides creation of production-ready MCP servers with API integrations, OAuth authentication, response optimization, and proper installation in Claude Code and Claude Desktop.
</objective>
<essential_principles>
<the_5_rules>
Every MCP server must follow these:
- Never Hardcode Secrets - Use
${VAR}expansion in configs, environment variables in code - Use
cwdProperty - Isolates dependencies (not--cwdin args) - Always Absolute Paths -
which uvto find paths, never relative - One Server Per Directory -
~/Developer/mcp/{server-name}/ - Use
uvfor Python - Better than pip, handles venvs automatically
</the_5_rules>
<security_checklist>
- Never ask user to paste secrets into chat
- Always use environment variables for credentials
- Use ${VAR} expansion in configs
- Provide exact commands for user to run in terminal
- Verify environment variable existence without showing values
- Never hardcode API keys in code or configs
</security_checklist>
<architecture_decision>
Operation count determines architecture:
- 1-2 operations → Traditional pattern (flat tools)
- 3+ operations → On-demand discovery pattern (meta-tools)
Traditional: Each operation is a separate tool
On-demand: 4 meta-tools (discover, get_schema, execute, continue) + operations.json
</architecture_decision>
<context>
MCP servers expose:
- Tools: Functions Claude can call (API requests, file operations, calculations)
- Resources: Data Claude can read (files, database records, API responses)
- Prompts: Reusable prompt templates with arguments
Standard location: ~/Developer/mcp/{server-name}/
</context>
</essential_principles>
<routing>
Based on user intent, route to appropriate workflow:
No context provided (skill invoked without description):
Use AskUserQuestion:
- header: "Mode"
- question: "What would you like to do?"
- options:
- "Create a new MCP server" → workflows/create-new-server.md
- "Update an existing MCP server" → workflows/update-existing-server.md
- "Troubleshoot a server" → workflows/troubleshoot-server.md
Context provided (user described what they want):
Route directly to workflows/create-new-server.md
</routing>
<workflows_index>
| Workflow | Purpose |
|----------|---------|
| create-new-server.md | Full 8-step workflow from intake to verification |
| update-existing-server.md | Modify or extend an existing server |
| troubleshoot-server.md | Diagnose and fix connection/runtime issues |
</workflows_index>
<templates_index>
| Template | Purpose |
|----------|---------|
| python-server.py | Traditional pattern starter for Python |
| typescript-server.ts | Traditional pattern starter for TypeScript |
| operations.json | On-demand discovery operations definition |
</templates_index>
<scripts_index>
| Script | Purpose |
|--------|---------|
| setup-python-project.sh | Initialize Python MCP project with uv |
| setup-typescript-project.sh | Initialize TypeScript MCP project with npm |
</scripts_index>
<references_index>
Core workflow:
- creation-workflow.md - Complete step-by-step with exact commands
Architecture patterns:
- traditional-pattern.md - For 1-2 operations (flat tools)
- large-api-pattern.md - For 3+ operations (on-demand discovery)
Language-specific:
- python-implementation.md - Async patterns, type hints
- typescript-implementation.md - Type safety, SDK features
Advanced topics:
- oauth-implementation.md - OAuth with stdio isolation
- response-optimization.md - Field truncation, pagination
- tools-and-resources.md - Resources API, prompts, streaming
- testing-and-deployment.md - Unit tests, packaging, publishing
- validation-checkpoints.md - All validation checks
- adaptive-questioning-guide.md - Question templates for intake
- api-research-template.md - API research document format
</references_index>
<quick_reference>
# List servers
claude mcp list
# Add server (Python)
claude mcp add --transport stdio <name> \
--env API_KEY='${API_KEY}' \
-- uv --directory ~/Developer/mcp/<name> run python -m src.server
# Add server (TypeScript)
claude mcp add --transport stdio <name> \
--env API_KEY='${API_KEY}' \
-- node ~/Developer/mcp/<name>/build/index.js
# Remove server
claude mcp remove <name>
# Check logs
tail -f ~/Library/Logs/Claude/mcp-server-<name>.log
# Find paths
which uv && which node && which python
</quick_reference>
<troubleshooting_quick>
Server not appearing: Check claude mcp list, verify config in ~/.claude/settings.json
"command not found": Use absolute paths from which uv / which node
Environment variable not found:
echo $MY_API_KEY # Check if set
echo 'export MY_API_KEY="value"' >> ~/.zshrc && source ~/.zshrc
Secrets visible in conversation: STOP. Delete conversation. Rotate credentials. Never paste secrets in chat.
Full troubleshooting: workflows/troubleshoot-server.md
</troubleshooting_quick>
<success_criteria>
A production-ready MCP server has:
- Valid configuration in Claude Code (
claude mcp listshows ✓ Connected) - Valid configuration in Claude Desktop config
- Environment variables set securely in ~/.zshrc
- Architecture matches operation count
- OAuth stdio isolation if applicable
- Response optimization for list/search operations
- All validation checkpoints passed
- No errors in logs
</success_criteria>
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。