← All skills
mcp-patterns
57 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By yonatangross/orchestkit (GitHub) · coding · 301 stars · scanned at commit 0d38e66
MCP server building, advanced patterns, and security hardening. Use when building MCP servers, implementing tool handlers, choosing a transport, adding OAuth authentication, wiring MCP Apps UI with @mcp-ui, hardening MCP security, or debugging MCP integrations.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this. It runs automatically when the plugin is installed.
Found in 20 places.
Show 17 more
- plugins/ork/skills/mcp-patterns/references/mcp-audit-runbook.md, line 77
"command": "npx", - plugins/ork/skills/mcp-patterns/references/mcp-version-matrix.md, line 32
Of 6 active remote MCPs, 1 is now version-pinned (`@21st-dev/magic@0.1.0`) and 5 still resolve to `@latest`. The pinning of the HIGH-tier server addresses the o - plugins/ork/skills/mcp-patterns/rules/registry-discovery.md, line 15
config = {"mcpServers": {"sketchy-db": {"command": "npx", "args": ["@unknown/mcp-db"]}}} - plugins/ork/skills/mcp-patterns/rules/server-transport.md, line 138
"command": "npx", - plugins/ork/skills/mcp-patterns/rules/server-transport.md, line 156
- TypeScript servers: use `npx -y` for zero-install execution - plugins/ork/skills/mcp-patterns/rules/testing-debugging.md, line 85
npx @modelcontextprotocol/inspector uv run server.py - plugins/ork/skills/mcp-patterns/rules/testing-debugging.md, line 88
npx @modelcontextprotocol/inspector uvx mcp-server-git --repository ~/repo - plugins/ork/skills/mcp-patterns/rules/testing-debugging.md, line 91
npx @modelcontextprotocol/inspector -e API_KEY=xxx uv run server.py - plugins/ork/skills/mcp-patterns/rules/testing-debugging.md, line 110
- Use MCP Inspector (`npx @modelcontextprotocol/inspector`) for interactive debugging - plugins/ork/skills/mcp-patterns/rules/testing-debugging.md, line 113
- Install test deps: `pip install inline-snapshot pytest anyio` - plugins/ork/hooks/README.md, line 165
- `pretool/bash/network-egress-guard` - Deny commands that execute fetched remote content (`curl url | sh`) - plugins/ork/hooks/README.md, line 1586
(count unchanged, 2026-07-24): pretool/bash network-egress-guard DENY tier is now QUOTE-AWARE (#3122). It scanned `normalizeSingle(raw)`, which strips quote cha - plugins/ork/hooks/README.md, line 1588
(count unchanged, 2026-07-24): pretool/bash compound-command-validator deny for a process substitution feeding an interpreter (`bash <(curl x)`, `python3 <(curl - plugins/ork/hooks/dist/permission.mjs, line 13
`)}catch{}}function ht(t,e,n,r){let o=dt(t,e);if(b(o))try{let s=$t(o,"utf8");if(j(s)===j(n))return l(r,`Rules file ${e} unchanged, skipping write`),!1}catch{}re - plugins/ork/hooks/dist/pretool.mjs, line 20
${s}`)}function Sr(t){let e=t.replace(/\\\s*[\r\n]+/g," ");if(/\n/.test(e))return!0;let n=Ot(t);if(/(?:&&|\|\||[|;])/.test(n))return!0;let r=_r(yr(t)),o=Xe(br(r - plugins/ork/hooks/dist/pretool.mjs, line 117
`);return e.log(kt,`Consolidated ${n.length} hooks into ${r}t`),x(o,t)}var nd="headless-defer",rd=["Bash(git push --force*)","Bash(git push -f*)","Bash(npm publ - plugins/ork/hooks/dist/setup.mjs, line 22
Run 'npm audit' or 'pip-audit' for full details.`;if(vt(r,S),e.log("dependency-version-check",g),u>0||f>0)return m(S,t)}else vt(r,"none"),e.log("dependency-vers
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed. Expected for a coding skill.
Found in 163 places.
Show 17 more
- plugins/ork/hooks/README.md, line 1466
(count unchanged at 171, 2026-09-22, sc47 F23/F24): `lifecycle/session-cleanup` gains a 14-day age cap on per-session event dirs. `bin/run-hook.mjs` appends one - plugins/ork/hooks/README.md, line 1478
(count unchanged at 172, 2026-09-04, #3917 FH-ready handler policy): no hook changed; a gate did. Claude Code is designing Function Hooks (anthropics/claude-cod - plugins/ork/hooks/README.md, line 1526
(count unchanged at 171, 2026-08-24, second entry): `instructions-loaded/debt-surfacer` became a reader instead of a scanner (#3708, sibling of #3705). It ran ` - plugins/ork/hooks/README.md, line 1556
(count unchanged, 2026-08-10): `posttool/bash/session-heartbeat-publisher` now tracks the persistent Bash shell's cwd, and `pretool/bash/git-validator`'s third - plugins/ork/hooks/README.md, line 1586
(count unchanged, 2026-07-24): pretool/bash network-egress-guard DENY tier is now QUOTE-AWARE (#3122). It scanned `normalizeSingle(raw)`, which strips quote cha - plugins/ork/hooks/bin/stop-uncommitted-check.mjs, line 23
import { execFileSync } from 'node:child_process'; - plugins/ork/hooks/bin/stop-uncommitted-check.mjs, line 83
const raw = execFileSync( - plugins/ork/hooks/dist/lifecycle.mjs, line 14
`)}catch{}}function Q(t,e,n,r){let o=pn(t,e);if(ft(o))try{let s=zr(o,"utf8");if(ut(s)===ut(n))return g(r,`Rules file ${e} unchanged, skipping write`),!1}catch{} - plugins/ork/hooks/dist/lifecycle.mjs, line 22
`)}catch{}Oo(t,e)}}import{existsSync as ip,readFileSync as cp}from"node:fs";function xn(){let t=U();if(!ip(t))return 0;try{let n=JSON.parse(cp(t,"utf-8")).tools - plugins/ork/hooks/dist/lifecycle.mjs, line 31
Run 'npm audit' or 'pip-audit' for full details.`;if(Tn(r,k),e.log("dependency-version-check",m),u>0||p>0)return O(k,t)}else Tn(r,"none"),e.log("dependency-vers - plugins/ork/hooks/dist/lifecycle.mjs, line 36
`).filter(Boolean).slice(-20),n=[];for(let r of e)try{n.push(JSON.parse(r))}catch{}return n}catch{return[]}}function Tf(t){let e=new Map,n=[];for(let r of t){if - plugins/ork/hooks/dist/lifecycle.mjs, line 50
`}function Od(){let t=process.env.CLAUDE_CONFIG_DIR||_e(_(),".claude");return _e(t,"rules")}function xd(t,e){let n=Kn(t);for(;Kn(n)!==n;){if(te(_e(n,".claude"," - plugins/ork/hooks/dist/lifecycle.mjs, line 67
`);return e.log(ot,`Merged ${n.length} messages from SessionEnd hooks`),{continue:!0,systemMessage:o}}var si=!1;function um(){si||(Pe(),si=!0)}async function ii - plugins/ork/hooks/dist/lifecycle.mjs, line 103
`)}`)}var ze=["ork","debt"].join("-"),Gh=String.raw`(?:\/\/|#|--|;|\/\*|\*)`,Jh=new RegExp(`${Gh}\\s*${ze}:\\s*(.+)`,"i"),dr=["bash","c","cc","cjs","cpp","cs"," - plugins/ork/hooks/dist/lifecycle.mjs, line 111
`);return e.log("post-compact-recovery",`Recovered context after compaction #${o.compactionCount} (${s.activeFiles?.length||0} files, ${s.activeTasks?.length||0 - plugins/ork/hooks/dist/lifecycle.mjs, line 121
Keep options to 2\u20134 to match picker affordances. Unset ORK_ASK_FALLBACK to restore picker mode once CC ships an upstream fix.`;function Kc(t,e=d){return pr - plugins/ork/hooks/dist/lifecycle.mjs, line 122
`))r.startsWith("worktree ")&&n.add(br(r.slice(9).trim()));return n}catch{return null}}function Yc(t,e=0){if(e>Hk)return!1;let n;try{n=Sr(t)}catch{return!1}for(
and 143 more places
Sends data to these websites: api.example.com, example.com
The author does not mention this. It runs automatically when the plugin is installed.
Found in 32 places.
Show 17 more
- plugins/ork/skills/mcp-patterns/rules/auth-oauth21.md, line 107
const meta = await fetch(`${origin}/.well-known/oauth-protected-resource`).then((r) => r.json()); - plugins/ork/skills/mcp-patterns/rules/auth-oauth21.md, line 111
const res = await fetch(`${asUrl}${p}`); - plugins/ork/skills/mcp-patterns/rules/auth-oauth21.md, line 119
return fetch(registrationEndpoint, { - plugins/ork/skills/mcp-patterns/rules/registry-discovery.md, line 27
async with httpx.AsyncClient() as client: - plugins/ork/skills/mcp-patterns/rules/registry-discovery.md, line 36
async with httpx.AsyncClient() as client: - plugins/ork/skills/mcp-patterns/rules/webmcp-browser.md, line 20
await fetch("/api/orders", { method: "POST", body: JSON.stringify(input) }); - plugins/ork/skills/mcp-patterns/rules/webmcp-browser.md, line 46
const res = await fetch("/api/orders", { - plugins/ork/hooks/README.md, line 1510
(count unchanged at 175, 2026-08-30, #3322 sandbox posture): `pretool/bash/network-egress-guard` stands its ASK tier down when CC's own Bash sandbox is on with - plugins/ork/hooks/README.md, line 1530
(count unchanged at 171, 2026-08-22): `pretool/bash/network-egress-guard` false-positive fix (#3632). A quoted heredoc (`<<'SH' … SH`) writing a local script wa - plugins/ork/hooks/README.md, line 1548
(count unchanged, 2026-08-12): the compaction layer stopped reading fields nobody writes, and stopped writing a field CC reads as something else (#3321 claims 2 - plugins/ork/hooks/bin/telemetry-sync.mjs, line 88
const response = await fetch(url, { - plugins/ork/hooks/dist/lifecycle.mjs, line 21
`))}function So(t,e){if(!t)return!1;let n=le(e);return n?t.toLowerCase()===n.toLowerCase():!1}function Pl(){let t=null,e=process.env.ORK_HQ_TELEMETRY_URL;return - plugins/ork/hooks/dist/lifecycle.mjs, line 22
`)}catch{}Oo(t,e)}}import{existsSync as ip,readFileSync as cp}from"node:fs";function xn(){let t=U();if(!ip(t))return 0;try{let n=JSON.parse(cp(t,"utf-8")).tools - plugins/ork/hooks/dist/lifecycle.mjs, line 62
`,r=Ms();Og(r,n,"utf8").catch(()=>{g(Yn,"Failed to write telemetry event (non-blocking)")})}async function xe(){let t=Ms();try{let e=await Ls(t);if(e.size<=Ag)r - plugins/ork/hooks/dist/posttool.mjs, line 46
`))}function xo(e,t){if(!e)return!1;let n=ot(t);return n?e.toLowerCase()===n.toLowerCase():!1}function Ml(){let e=null,t=process.env.ORK_HQ_TELEMETRY_URL;return - plugins/ork/hooks/dist/posttool.mjs, line 101
`)}catch{}}function ms(e,t){let n=process.env[e];if(!n)return t;let r=parseFloat(n);return!Number.isFinite(r)||r<=0||r>=1?t:r}function Dm(){let e=Bn(),t=process - plugins/ork/hooks/dist/posttool.mjs, line 104
`,r=ws();rh(r,n,"utf8").catch(()=>{S(qn,"Failed to write telemetry event (non-blocking)")})}async function Yn(){let e=ws();try{let t=await Ts(e);if(t.size<=uh)r
and 12 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.
Found in 8 places.
Show 5 more
- plugins/ork/settings.json, line 13
"Read(~/.gnupg/**)", - plugins/ork/settings.json, line 14
"Read(~/.netrc)", - plugins/ork/settings.json, line 15
"Read(~/.npmrc)", - plugins/ork/hooks/README.md, line 1562
(218 -> 219, global 152 -> 153, 2026-08-09): added `pretool/read/credential-read-guard`, the first PreToolUse hook on the Read tool that can deny. `src/settings - plugins/ork/hooks/dist/lifecycle.mjs, line 22
`)}catch{}Oo(t,e)}}import{existsSync as ip,readFileSync as cp}from"node:fs";function xn(){let t=U();if(!ip(t))return 0;try{let n=JSON.parse(cp(t,"utf-8")).tools
Changes files outside its own folder
The author does not mention this. It runs automatically when the plugin is installed.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Other copies in this repository
yonatangross/orchestkit has 1 more folder with a skill named mcp-patterns. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'mcp-patterns' ] || [ -L ~/.agents/skills/'mcp-patterns' ]; then echo 'A skill folder named mcp-patterns already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/yonatangross/orchestkit' "$d" && git -C "$d" checkout --quiet '0d38e66123f2a4a70737bfae758df796070f07df' -- 'plugins/ork/skills/mcp-patterns' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/ork/skills/mcp-patterns' ~/.agents/skills/'mcp-patterns' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'mcp-patterns' ~/.claude/skills/'mcp-patterns' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for yonatangross/orchestkit shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/yonatangross/orchestkit/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | 0d38e66 | 57 |
| 2026-11-07 | caa5346 | 90 |