Borrowing it
Nothing to install: this file belongs to Hack23/European-Parliament-MCP-Server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Hack23/European-Parliament-MCP-Server/main/.github/agents/mcp-developer.mdgit clone --depth 1 https://github.com/Hack23/European-Parliament-MCP-ServerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hack23/european-parliament-mcp-server/mcp-developer)<a href="https://agentmods.dev/agents/hack23/european-parliament-mcp-server/mcp-developer"><img src="https://agentmods.dev/badge/agents/hack23/european-parliament-mcp-server/mcp-developer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01726 |
| Opus 5 | $0.00016 | $0.00863 |
| Sonnet 5 | $0.00007 | $0.00345 |
| Haiku 4.5 | $0.00003 | $0.00173 |
Grade B, and why
mcp-developer scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
tools: ["*"] Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const data = await epClient.fetch(parsed.data); How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the MCP Developer for the European Parliament MCP Server — responsible for protocol-conformant, secure, observable, policy-aligned MCP tool/resource/prompt design.
📋 Required Context Files
Project context:
README.md— tool inventory (62 tools, 9 resources, 7 prompts)ARCHITECTURE.md,DATA_MODEL.md— MCP server architecture, data modelSECURITY_ARCHITECTURE.md— MCP tool security controlssrc/server/toolRegistry.ts— tool registration (6 categories)src/server/,src/tools/,src/resources/,src/prompts/.github/skills/mcp-server-development/SKILL.md.github/skills/testing-mcp-tools/SKILL.md.github/skills/mcp-gateway-security/SKILL.md
ISMS context:
- Secure Development Policy — SDLC, validation, error handling
- Information Security Policy — Security-by-design principle
- OWASP LLM Security Policy — Prompt-injection, output filtering, tool-abuse guardrails
- AI Policy — Responsible AI integration, human oversight
- Privacy Policy — GDPR for MEP personal data
- Access Control Policy — Tool-level least privilege
- Open Source Policy — Approved licences, attribution
🔒 ISMS Policy Alignment (MCP-specific)
| MCP concern | Policy | Enforcement |
|---|---|---|
| Tool input validation | Secure Development Policy | Zod schema on every tool input |
| Description hardening | OWASP LLM Security Policy | Neutral, factual .describe() — no instructions / side-channel prompts |
| Output filtering | OWASP LLM Security Policy | Never return secrets / raw upstream errors; redact personal data beyond need |
| Personal-data tools | Privacy Policy | Audit log, short cache, documented lawful basis |
| Least privilege | Access Control Policy | Tools do only what their name promises |
| AI-generated content | AI Policy | Human-reviewed, provenance-attributable |
| Attribution | Open Source Policy | Source attribution in tool output where required |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 132 lines · 33 tokens per session scan B 3029befde19d
mcp-developer is an agent published in the GitHub repository Hack23/European-Parliament-MCP-Server (28 stars, last pushed today), licensed Apache-2.0. It adds 33 tokens to every session and 1,726 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
FAI Event-Driven Expert
Event-driven architecture specialist — Azure Event Grid, Service Bus, Event Hubs selection, event sourcing, CQRS, saga orchestration, and exactly-once processing patterns for AI pipelines.
FAI Go Expert
Go development specialist — idiomatic Go 1.22+, goroutines/channels concurrency, Azure SDK for Go, high-performance HTTP servers, error handling patterns, and table-driven testing.
FAI Dapr Expert
Dapr distributed application runtime specialist — service invocation, state management, pub/sub messaging, bindings, secrets management, and sidecar-based AI microservice patterns.
FAI gRPC Expert
Agent "FAI gRPC Expert" from frootai/frootai, covering fai grpc expert, core expertise, what the model gets wrong, key patterns and ai service proto definition.
api-mapper
Wave 2 agent: documents API endpoints in a module or router group. Stores decision memories for each endpoint with route, auth, and shape details. Links endpoints with DEPENDSON, LEADSTO, and PARTOF relationships.
timps_ai_workflow_orchestrator
Turn a plain-English multi-step workflow into executable code for LangGraph, Temporal, or Claude-Flow — plus a Mermaid diagram and tests. Use the timpsaiworkfloworchestrator MCP tool to perform this task. Do not answer directly — delegate to this sub-agent.