Mcp Client

Model Context Protocol (MCP) client - connect to tools, data sources and services

Security Scan

The skill appears to implement an MCP client consistent with its description, but there are minor documentation inconsistencies and an inherent risk: connecting to untrusted MCP servers can cause sensitive data (via file:// URIs) to be read/exfiltrated.

Purpose & Capability

The Python client (mcp_client.py) implements the advertised MCP operations (connect, list tools, call tool, list/read resources, list prompts) and targets the expected /mcp/* endpoints. Requiring Python and the requests library is proportionate to this purpose.

Instruction Scope

SKILL.md shows how to connect, list tools, call tools, and read resources — matching the client's capabilities. However, SKILL.md's examples reference a PowerShell script (./mcp.ps1) that is not included; the provided CLI is a Python program. The documentation correctly warns about file:// URIs (server-side file reads) but the user-facing examples and a mismatch in script names are inconsistent and could confuse users.

Install Mechanism

No install spec is embedded (instruction-only), and the README suggests installing the single dependency via pip (requests). This is straightforward; there are no opaque downloads or archive extractions in the package itself.

Credentials

The client can accept an API key (Authorization: Bearer) but the registry metadata declares no required environment variables. Requiring credentials is reasonable for interacting with an MCP server, but the skill doesn't declare a primary env var or secret storage—API keys are optional per the code. No unrelated credentials or config paths are requested.

Persistence & Privilege

The skill does not request permanent presence (always: false) and does not modify other skills or system-wide settings. It performs network calls at runtime but does not persist tokens or change system config.

Assessment

This skill is internally consistent with being an MCP client, but be cautious before connecting to servers you don't control. An MCP server can expose resources including file:// URIs that cause the server to read local files (server-side) and return them — that can lead to data exposure. Practical steps before installing/using: 1) Prefer only trusted or self-hosted MCP servers; 2) Do not provide sensitive API keys to unknown servers; 3) Run the client in an isolated environment if you need to test against unknown servers; 4) Note the documentation mismatch (examples reference mcp.ps1 while the package contains a Python CLI) — verify how you actually invoke the client (python mcp_client.py ...) and review the included Python source if you need assurance; 5) If you require higher assurance, ask the publisher for an official release URL or repository and verify the server spec and any third-party dependencies.

MCP Client Skill

Implementation of the Model Context Protocol (MCP) client for connecting to tools and data sources.

What it does

• Connect to MCP Servers - Access tools and resources from MCP-enabled services
• Tool Invocation - Call tools exposed by MCP servers
• Resource Access - Read files, databases, APIs
• Prompt Templates - Use structured prompts from MCP servers

Installation

# Install Python dependencies (requests is the only required dependency)
pip install requests

Usage

Connect to MCP Server

.\mcp.ps1 -Action connect -ServerUrl "https://mcp-server.com" -ApiKey "your-key"

List Available Tools

.\mcp.ps1 -Action tools -ServerUrl "https://mcp-server.com"

Call a Tool

.\mcp.ps1 -Action call -ServerUrl "https://mcp-server.com" -ToolName "search" -Arguments '{"query": "AI agents"}'

List Resources

.\mcp.ps1 -Action resources -ServerUrl "https://mcp-server.com"

Read a Resource

.\mcp.ps1 -Action read -ServerUrl "https://mcp-server.com" -ResourceUri "file:///data/config.json"

MCP Concepts

• MCP Server: Service that exposes tools, resources, and prompts
• Tools: Functions the LLM/agent can call
• Resources: Data sources (files, APIs, DBs)
• Prompts: Pre-defined prompt templates

API Reference

POST /mcp/connect     - Connect to server
GET  /mcp/tools       - List available tools
POST /mcp/call       - Invoke a tool
GET  /mcp/resources  - List resources
GET  /mcp/read       - Read resource
GET  /mcp/prompts    - List prompt templates

Examples

Python Usage

from mcp_client import MCPClient

client = MCPClient("https://mcp-server.com", api_key="key")

# List tools
tools = client.list_tools()
print(tools)

# Call tool
result = client.call_tool("search", {"query": "quantum"})
print(result)

# Read resource
data = client.read_resource("file:///config.json")
print(data)

⚠️ Security Warnings

file:// URI Risk

The MCP protocol allows file:///path URIs to read files from the server. Only connect to trusted MCP servers. A malicious server could exfiltrate sensitive files.

Best Practices

• Only use MCP servers you control or trust
• Don't connect to random public MCP servers
• Review what tools/resources are available before using

Requirements

• Review what tools/resources are available before using

• Python 3.8+

• requests library

License

MIT