Borrowing it
Nothing to install: this file belongs to Contrast-Security-OSS/mcp-contrast. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Contrast-Security-OSS/mcp-contrast/main/.claude/skills/test-mcp-server/SKILL.mdgit clone --depth 1 https://github.com/Contrast-Security-OSS/mcp-contrastWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/contrast-security-oss/mcp-contrast/test-mcp-server)<a href="https://agentmods.dev/skills/contrast-security-oss/mcp-contrast/test-mcp-server"><img src="https://agentmods.dev/badge/skills/contrast-security-oss/mcp-contrast/test-mcp-server/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/contrast-security-oss/mcp-contrast/test-mcp-server"><img src="https://agentmods.dev/badge/skills/contrast-security-oss/mcp-contrast/test-mcp-server.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.00724 |
| Opus 5 | $0.00041 | $0.00362 |
| Sonnet 5 | $0.00016 | $0.00145 |
| Haiku 4.5 | $0.00008 | $0.00072 |
Grade A, and why
test-mcp-server scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pre-release MCP server test
Exercises a fresh build of the Contrast stdio MCP server before release. A helper script builds the jar, wires that exact artifact into a separate headless Claude instance, and has that instance test every tool it discovers. You show the human the report so they can decide whether to release. This does not gate the release.
When to run: before a release, or when a human explicitly asks. This is not part of routine feature development, so never invoke it automatically while building features. It builds a jar and drives a live org, so it is deliberate and on demand only.
Usage
/test-mcp-serverruns the in-depth (regular) pass using the same model as the launching session./test-mcp-server smokeruns a fast pass that just checks each tool's main use case./test-mcp-server regular <focus>runs in-depth with a nudge, e.g./test-mcp-server regular focus on the server tools.--model <id>overrides the model for orchestrator and testers, e.g./test-mcp-server smoke --model sonnet.
What to do
-
Work out the mode and focus from the arguments. If the first word is
smokeorregular, use it as the mode and treat the rest as focus text. If no mode was provided, useAskUserQuestionto ask which mode to run before launching. Never default to a mode on your own. Always pass an explicit mode to the script. -
Launch the helper in the background so the user can keep chatting. A regular run spawns one tester per tool and can take 15-20 minutes. Set
CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0in the command so the background output capture waits indefinitely instead of cutting off at the default 600-second ceiling:CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 bash .claude/skills/test-mcp-server/run.sh <mode> <focus> -
When it finishes, read its output and show the human the report as the script produced it. A one-line lead of your own is fine if it helps. Do not re-run any tools yourself.
-
If the script stops early (build failed, or credentials missing), relay the message plainly and stop.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 57 lines · 82 tokens per session scan A 0c1a8f1ec776
test-mcp-server is a skill published in the GitHub repository Contrast-Security-OSS/mcp-contrast (23 stars, last pushed 4d ago), licensed Apache-2.0. It adds 82 tokens to every session and 724 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
research-engineer
An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.
tika-eval-compare
Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".
neuron-evaluation-engineer
Create and run AI evaluations with datasets, assertions, and output drivers in Neuron AI. Use this skill whenever the user mentions evaluation, testing AI systems, creating evaluators, dataset-driven testing, assertion-based validation, or wants to measure AI system performance. Also trigger for tasks involving…
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.
atmos-validation
Validate Atmos projects, components, arbitrary JSON Schema inputs, EditorConfig, and GitHub Actions; use affected-file selection and native CI annotations.
skill-benchmark
Benchmark AI skill effectiveness by measuring implementation quality against legacy constraints.