MCP Scaffolder

Scaffolds a complete TypeScript MCP server with folder structure, typed tools, transport config, Claude MCP snippet, and README from a simple description.

Security Scan

The skill's instructions, requirements, and outputs are consistent with its stated purpose of scaffolding a TypeScript MCP server and do not request unrelated secrets, installs, or elevated persistence.

Purpose & Capability

Name and description (scaffolding a TypeScript MCP server) align with the SKILL.md: it only describes generating project files, package.json with @modelcontextprotocol/sdk, transport config snippets, and README. No unrelated binaries, services, or credentials are requested.

Instruction Scope

Instructions stay within scaffolding scope (generate files, tool definitions, config snippets). Two items to note: (1) the stdio config example uses an absolute path for the build artifact — agents producing scaffolds should avoid embedding real absolute paths without user confirmation; (2) the skill tells the agent how to choose transport (stdio vs HTTP) and mentions local file-system/CLI usage for stdio, which is appropriate for scaffolding but could lead to generated code that expects filesystem access when run. The SKILL.md does not instruct the agent to read user's files, env vars, or other system state.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing will be downloaded or written by an installer. This is the lowest-risk install model.

Credentials

The skill declares no required environment variables or credentials. It does instruct generating a .env.example documenting env vars for the scaffolded project, which is expected and proportionate; it does not request or access any secrets itself.

Persistence & Privilege

always is false and the skill is user-invocable with normal autonomous invocation behavior. It does not request permanent presence, nor does it instruct modifying other skills or agent-wide settings.

Assessment

This skill appears coherent for scaffolding an MCP TypeScript project. Before using the generated project, review the output: remove or replace placeholder absolute paths, do not paste real secrets into the generated config snippets, confirm the dependency (@modelcontextprotocol/sdk) is intended, and audit any generated code before running or publishing. If you want the scaffold to use relative paths or a specific build location, state that explicitly when invoking the skill.

MCP Scaffolder Skill

When the user describes an MCP server they want to build, scaffold it completely.

What to Generate

1. Folder structure

   • /src/index.ts — server entry point
   • /src/tools/ — one file per tool
   • /package.json — with @modelcontextprotocol/sdk dependency
   • /tsconfig.json — standard TS config
   • /.env.example — all required env vars documented
   • /README.md — setup instructions

2. Server entry point (src/index.ts)

   • Import and register all tools
   • Set transport based on user intent:
     • stdio → local tools, file system access, CLI utilities
     • HTTP → remote servers, cloud APIs, services
   • Include server instructions field — used by Claude Code tool search

3. Tool definitions

   • Each tool gets its own file in /src/tools/
   • Include: name, description, inputSchema (zod or JSON Schema)
   • Add JSDoc comments explaining what the tool does and when Claude should call it

4. Claude Code config snippet Always output a ready-to-paste config block:

   For stdio: { "mcpServers": { "<server-name>": { "type": "stdio", "command": "node", "args": ["<absolute-path>/build/index.js"], "env": { "<ENV_VAR>": "your-value-here" } } } }

   For HTTP: { "mcpServers": { "<server-name>": { "type": "http", "url": "http://localhost:3000/mcp" } } }

5. README

   • What the server does
   • Prerequisites
   • All env vars with descriptions
   • Build and run instructions
   • How to add to Claude Code

Rules

• Never use SSE transport — it is deprecated, use HTTP instead
• Always include the server instructions field in the entry point
• Keep tool descriptions specific — Claude Code uses these for tool search
• Flag any required env vars in .env.example with a comment explaining what they are for
• Use TypeScript by default unless user specifies otherwise