Expert MCP capability skill for secure server authoring, tool schema discipline, authorization boundaries, and prompt-injection risk review.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are comparatively strong, but you should still validate source, privacy posture, and package provenance for your environment.
0
96
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as first-party.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
Package marked verified.
Checksum metadata
SHA-256 hash is present.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 0/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
Package verification/checksum metadata is available.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (6/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is present.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
6/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is available.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
3 prerequisites to line up before setup.
Safety & privacy surface
3 safety and 2 privacy notes across 3 risk areas. Review closely: credentials & tokens, permissions & scopes.
| Platform | Support | Install path |
|---|---|---|
| claude-code | Native | .claude/skills/<skill-name>/SKILL.md |
| codex | Native | .agents/skills/<skill-name>/SKILL.md |
| windsurf | Native | .windsurf/skills/<skill-name>/SKILL.md |
| gemini | Native | .gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md |
| cursor | Adapter | .cursor/rules/<skill-name>.mdc |
| cli | Manual | AGENTS.md or tool-specific context file |
# Trigger
"Apply the MCP server authoring security capability pack to this server."
# Required output
1) Threat model and trust boundaries
2) Tool schema and validation contracts
3) Auth and permission architecture
4) Abuse and incident response controlsThis capability pack is pinned to documentation re-verified on 2026-06-19. When upstream docs change, refresh endpoint contracts, examples, and constraints before using this skill for production changes.
Always prefer direct retrieval from official docs/API references over model memory for limits, endpoint signatures, and behavior guarantees.
Verified on 2026-06-19:
This capability pack teaches agents how to design MCP servers that remain safe under real adversarial conditions. It emphasizes least privilege, explicit contracts, and secure default behavior.
SKILL.md.SKILL.md content as reusable workflow instructions..gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md where supported..cursor/rules/*.mdc adapter for project rules.Issue: Tool abuse through crafted prompts
Fix: Add policy layer between prompt interpretation and tool invocation.
Issue: Schema drift breaks clients
Fix: Enforce contract tests and backward compatibility checks.
Issue: Difficult to investigate incidents
Fix: Add structured event logs with actor/tool/input/result correlation.
Show that MCP Server Authoring Security Capability Pack Skill is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/skills/mcp-server-authoring-security-capability-pack)MCP Server Authoring Security Capability Pack Skill side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
3 trust signals differ across this comparison (Package trust, Source provenance, Submitter).
Next steps differ across entries — use the actions in the table below to copy install commands and source links per resource.
| Field | Expert MCP capability skill for secure server authoring, tool schema discipline, authorization boundaries, and prompt-injection risk review. Open dossier | Expert MCP OAuth server hardening capability pack applying documented Dynamic Client Registration, oauth.scopes pins, callback ports, keychain token storage, and least-privilege scope review from official MCP documentation. Open dossier | Validate MCP server tools with contract-style tests to catch schema drift, unsafe behavior, and integration regressions early. Open dossier | Secure MCP servers with strict tool boundaries, auth controls, dependency hygiene, and abuse-resistant runtime policies. Open dossier |
|---|---|---|---|---|
| Next stepsDiffers | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trustDiffers | Package verified2026-04-10 | Package not verified | Package verified2026-04-10 | Package verified2026-04-10 |
| Source provenanceDiffers | Source-backed | Submission linkedSource submission | No submission link | No submission link |
| SubmitterDiffers | — | kiannidev | — | — |
| Install risk | Review first | Review first | Low risk | Low risk |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | skills | skills | skills | skills |
| Source | First-party | Source-backed | First-party | First-party |
| Author | JSONbored | kiannidev | JSONbored | JSONbored |
| Added | 2026-04-10 | 2026-06-16 | 2026-04-10 | 2026-04-10 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓Use the skill as a review and implementation checklist; do not deploy MCP auth, credential flow, or permission changes without human review. Validate tool schemas, authorization decisions, and logging behavior with tests before exposing an MCP server to real users or external clients. Treat generated threat models as incomplete until checked against current MCP security and authorization docs. | ✓Autonomous runs can execute tools without mid-run user input—scope paths and connectors first. Do not enable destructive automation without explicit approval gates. Review outputs as draft until a human validates evidence. | ✓Use this skill as planning or review guidance; verify generated commands, code, configuration, and infrastructure changes before running them. Apply least-privilege credentials and test in staging or a disposable branch before using it on production systems, CI, deployment, or account-write workflows. | ✓Treat findings and generated mitigations as review inputs; validate suspected vulnerabilities and patches before changing production controls. Coordinate disclosure-sensitive security work privately and avoid running destructive probes outside authorized systems. |
| Privacy notes | ✓Tool inventories, auth flows, logs, incident examples, prompts, and server code shared with this skill may enter model context. Redact access credentials, client secrets, user records, tenant identifiers, and production request bodies before using them as examples. | ✓Run output may contain proprietary code and credentials. Summaries for external channels require redaction. | ✓Inputs can include source files, prompts, logs, account metadata, repository details, and operational context that may be sent to the configured AI model. Redact secrets, customer data, private URLs, credentials, and proprietary implementation details before sharing prompts, reports, or generated artifacts. | ✓Security prompts and reports can include source snippets, vulnerability details, internal URLs, dependency metadata, and operational context. Redact secrets, customer data, exploit details, private infrastructure names, and unreleased findings before sharing outputs publicly. |
| Prerequisites |
|
|
|
|
| Install | | — | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Design MCP servers with auth boundaries and narrow tools.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.