Expert FastMCP review skill for auditing Python MCP server structure, tools, resources, prompts, transports, and deployment readiness before release.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
86
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (5/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
5/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
5 prerequisites to line up before setup. Includes a review or approval gate.
Safety & privacy surface
4 safety and 2 privacy notes across 4 risk areas. Review closely: network access.
| Platform | Support | Install path |
|---|---|---|
| claude-code | Native | .claude/skills/<skill-name>/SKILL.md |
| codex | Native | .agents/skills/<skill-name>/SKILL.md |
| windsurf | Native | .windsurf/skills/<skill-name>/SKILL.md |
| gemini | Native | .gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md |
| cursor | Adapter | .cursor/rules/<skill-name>.mdc |
| cli | Manual | AGENTS.md or tool-specific context file |
# Trigger
"Apply the FastMCP server review capability pack to this MCP server."
# Required output
1) FastMCP package/source version and Python runtime check
2) Server, tool, resource, prompt, and CLI inventory
3) Review findings with release-blocking and non-blocking issues
4) Validation plan and final release recommendationThis capability pack is pinned to FastMCP 3.4.0 documentation, PyPI metadata, and source files verified on 2026-06-03. The reviewed package metadata requires Python 3.10 or newer.
Prefer the current FastMCP docs, PyPI metadata, and pinned source files over model memory for CLI behavior, package version, server APIs, and deployment notes.
This is not a generic MCP security checklist. Use it when the server under review is implemented with FastMCP and the review needs framework-aware coverage of server construction, tools, resources, prompts, runtime invocation, and release evidence.
FastMCP server object and inventory server name, instructions, mounts or imports, transport choices, and run path.SKILL.md-style instructions for FastMCP code review and release planning.Issue: The server starts locally but clients cannot discover tools
Fix: Check the FastMCP server entrypoint, selected transport, CLI command, tool registration path, and whether the reviewed process is the same process the client launches.
Issue: Tool schemas look correct but runtime behavior is unstable
Fix: Review the Python function body, type hints, default values, error handling, and sample inputs instead of relying only on generated schema output.
Issue: Resources return inconsistent shapes
Fix: Add explicit response contracts for each resource URI or template, then test empty, missing, large, and malformed input cases.
Issue: Prompt templates drift across releases
Fix: Pin prompt argument names and expected output roles in review notes, then add regression examples for the prompts that clients depend on.
Issue: Deployment differs from local development
Fix: Compare the local command, deployed command, package version, Python version, transport, and runtime settings before approving release.
Show that FastMCP Server Review Capability Pack Skill is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/skills/fastmcp-server-review-capability-pack)FastMCP Server Review Capability Pack Skill side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | Expert FastMCP review skill for auditing Python MCP server structure, tools, resources, prompts, transports, and deployment readiness before release. Open dossier | Expert Spectral review skill for auditing OpenAPI contracts, OAS rulesets, lint results, schema drift, CI gates, and API release readiness. Open dossier | Expert validation skill for reviewing /llms.txt, search discovery artifacts, canonical signals, structured data, and LLM-ready documentation links. Open dossier | Expert reg-suit review skill for evaluating rendered UI image baselines, thresholds, snapshot storage, report artifacts, and visual QA release readiness. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Submission linkedSource submission | Submission linkedSource submission | Submission linkedSource submission | Submission linkedSource submission |
| Submitter | oktofeesh1 | oktofeesh1 | oktofeesh1 | oktofeesh1 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | skills | skills | skills | skills |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | oktofeesh1 | oktofeesh1 | oktofeesh1 | oktofeesh1 |
| Added | 2026-06-03 | 2026-06-03 | 2026-06-03 | 2026-06-03 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓Installing FastMCP adds Python packages to the selected environment; use an isolated project environment and pin the reviewed version. Reviewing a server can exercise tool, resource, and prompt paths; use controlled fixtures and avoid live side effects unless the release plan explicitly permits them. The source ZIP is external and version-pinned for reference; package trust should remain a maintainer decision. Treat destructive tools, write-capable resources, network calls, and long-running jobs as release-blocking until their behavior is documented and tested. | ✓Installing Spectral adds npm packages to the selected project environment; pin the reviewed version and avoid global installs for review work. Spectral can lint local files, globs, and remote contract URLs; review source locations before running checks in shared CI. Ruleset changes can silently weaken future API gates; review disabled rules, severity changes, and overrides as release-impacting changes. JavaScript rulesets and custom functions such as `.spectral.js` execute Node.js code; do not run attacker-supplied rulesets from untrusted PRs unless they have been inspected and executed in a sandboxed environment. The source ZIP is external and version-pinned for reference; package trust should remain a maintainer decision. | ✓Installing `llms-txt` adds Python dependencies in the selected environment; pin the reviewed version and prefer project-scoped tooling. The `llms_txt2ctx` helper can retrieve linked HTTPS resources while expanding context; review target URLs before running it against private staging content. Search artifacts influence crawler and model-facing discovery signals; treat canonical, robots, sitemap, and structured data changes as publish-impacting. The source archive is external and version-pinned for reference; package trust should remain a maintainer decision. | ✓Installing reg-suit adds npm packages to the selected project environment; pin the reviewed package version and avoid global installs for review work. reg-suit can publish image snapshots and HTML reports through storage plugins such as S3 or Google Cloud Storage; review destination configuration before running in shared CI. Visual baselines can normalize accidental UI changes if accepted too casually; require owner approval for broad layout, color, text, or viewport changes. The source ZIP is external and version-pinned for reference; package trust should remain a maintainer decision. |
| Privacy notes | ✓FastMCP tools and resources can expose files, API responses, database records, prompts, and application state. Keep review notes focused on public source links, object names, version data, and summarized findings; omit operational details that do not need to be public. | ✓OpenAPI files can reveal internal route names, hostnames, example payloads, business object names, and planned endpoints. Lint reports can include source paths, schema paths, rule names, snippets, and examples from the reviewed contract. Keep public review notes focused on rule IDs, contract paths, compatibility impact, and summarized examples; omit details that do not need to be public. | ✓`/llms.txt`, expanded context, sitemap, and structured data artifacts can expose URL paths, page titles, product terms, doc structure, and internal naming. Context expansion can collect linked markdown content into a single artifact, which may reveal more detail than the compact index. Keep public review notes focused on artifact shape, URL classes, stale links, and source evidence; avoid exposing private staging paths or unreleased content. | ✓Rendered UI images and reports can expose environment URLs, branch names, visible UI text, test account data, and product screenshots. Storage and notification plugins can publish report links to CI systems, pull request comments, chat tools, or cloud buckets. Keep public review notes focused on changed components, thresholds, artifact links, and summarized findings; omit sensitive rendered content that does not need to be public. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.