Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/CODE-SAURABH/OpenSkillsnpx agentmods add skills/code-saurabh/openskills/mcp-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/code-saurabh/openskills/mcp-builder)<a href="https://agentmods.dev/skills/code-saurabh/openskills/mcp-builder"><img src="https://agentmods.dev/badge/skills/code-saurabh/openskills/mcp-builder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/code-saurabh/openskills/mcp-builder"><img src="https://agentmods.dev/badge/skills/code-saurabh/openskills/mcp-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.03507 |
| Opus 5.5 | $0.00032 | $0.01403 |
| Sonnet 5.5 | $0.00016 | $0.00701 |
| Haiku 4.5 | $0.00008 | $0.00351 |
Grade A, and why
mcp-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 424 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Server Development
MCP (Model Context Protocol) is the standard for connecting AI agents to external tools and services. An MCP server exposes tools, resources, and prompts that any compatible AI agent can call — Claude, GPT-4, Gemini, or any other model that speaks the protocol.
Build MCP servers like you build APIs: with clear contracts, proper error handling, and the caller (the AI agent) as your user. A badly designed MCP tool confuses the model. A well-designed one makes the model dramatically more capable.
MCP Builder Principles
- The AI agent is the caller — design for it. Tool names, descriptions, and schemas must be clear enough that an LLM picks the right tool without being told. If a tool name is ambiguous, the agent will misuse it.
- Tool descriptions are prompt engineering. The
descriptionfield in your tool schema is what the model reads to decide when and how to call it. Write it like a senior engineer explaining an API to a junior — concrete, precise, with examples. - Comprehensive beats clever. Cover the API's core operations completely before adding workflow shortcuts. Agents can compose basic tools; they cannot invent missing operations.
- Actionable errors are non-negotiable. When a tool fails, the error message must tell the agent exactly what went wrong and exactly what to try next. "An error occurred" is useless. "Authentication failed: API key missing. Set the X-API-KEY header with your key from https://example.com/settings/api" is useful.
- Stateless by default. Design tools to be stateless and idempotent where possible. Stateful MCP servers are harder to debug, scale, and reason about.
- Security is not optional. MCP servers run with the credentials of the human user. Never log secrets. Validate every input. Scope permissions to the minimum required.
Step 0: Plan Before You Build
Answer these before writing a line of code:
- What service are you wrapping? Name it. What does it do?
- What are the 5 most common operations a user needs? Start here — not with full API coverage.
- What is the authentication mechanism? API key, OAuth, bearer token, mTLS?
- What transport?
stdiofor local tools (runs on user's machine),streamable HTTPfor remote servers (deployed, shareable). - What language? TypeScript recommended (best SDK support, type safety, broad compatibility). Python (FastMCP) for data/ML workflows.
- What are the failure modes? API rate limits, network timeouts, auth expiry — plan the error messages now.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 424 lines · 79 tokens per session scan A 203a548fe63f
mcp-builder is a skill published in the GitHub repository CODE-SAURABH/OpenSkills (3 stars, last pushed 2mo ago), licensed MIT. It adds 79 tokens to every session and 3,507 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
better-auth
Skill for integrating Better Auth - comprehensive TypeScript authentication framework for Cloudflare D1, Next.js, Nuxt, and 15+ frameworks. Use when adding auth, encountering D1 adapter errors, or implementing OAuth/2FA/RBAC features.
cloudflare-durable-objects
Cloudflare Durable Objects for stateful coordination and real-time apps. Use for chat, multiplayer games, WebSocket hibernation, or encountering class export, migration, alarm errors.
cloudflare-images
This skill should be used when the user asks to "upload images to Cloudflare", "implement direct creator upload", "configure image transformations", "optimize WebP/AVIF", "create image variants", "generate signed URLs", "add image watermarks", "integrate with Next.js/Remix", "configure webhooks", "debug CORS errors"…
cloudflare-queues
This skill should be used when the user asks to "set up Cloudflare Queues", "create a message queue", "implement queue consumer", "process background jobs", "configure queue retry logic", "publish messages to queue", "implement dead letter queue", or encountering "queue timeout", "message retry", "throughput…
cloudflare-r2
Cloudflare R2 S3-compatible object storage. Use for buckets, uploads, CORS, presigned URLs, or encountering R2ERROR, CORS failures, multipart issues.
cloudflare-email-routing
Cloudflare Email Routing for receiving/sending emails via Workers. Use for email workers, forwarding, allowlists, or encountering Email Trigger errors, worker call failures, SPF issues.