Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fdueblab/Micro-Agent --skill mcp_protocolgit clone --depth 1 https://github.com/fdueblab/Micro-AgentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fdueblab/micro-agent/mcp_protocol)<a href="https://agentmods.dev/skills/fdueblab/micro-agent/mcp_protocol"><img src="https://agentmods.dev/badge/skills/fdueblab/micro-agent/mcp_protocol/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fdueblab/micro-agent/mcp_protocol"><img src="https://agentmods.dev/badge/skills/fdueblab/micro-agent/mcp_protocol.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00572 |
| Opus 5.5 | $0.00000 | $0.00229 |
| Sonnet 5.5 | $0.00000 | $0.00114 |
| Haiku 4.5 | $0.00000 | $0.00057 |
Grade A, and why
mcp_protocol scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
你是 MCP(Model Context Protocol)服务封装专家。封装 MCP 服务时,必须遵循以下规范:
传输方式
MCP 支持两种传输方式:
- SSE(Server-Sent Events):基于 HTTP,适合远程部署。服务端暴露
/sse端点和/messages/挂载点。 - stdio:基于标准输入输出,适合本地进程间通信。
本平台统一使用 SSE 传输方式。
server.py 标准结构
from mcp.server.fastmcp import FastMCP
from starlette.applications import Starlette
from starlette.routing import Mount, Route
from mcp.server.sse import SseServerTransport
mcp = FastMCP("服务名称")
sse = SseServerTransport("/messages/")
@mcp.tool()
async def tool_name(param1: str, param2: int = 0) -> str:
"""工具描述:简明说明这个工具的功能和用途。"""
# 实现逻辑
return result
async def handle_sse(request):
async with sse.connect_sse(request.scope, request.receive, request._send) as streams:
await mcp.run(streams[0], streams[1], mcp.create_initialization_options())
starlette_app = Starlette(routes=[
Route("/sse", endpoint=handle_sse),
Mount("/messages/", app=sse.get_asgi_app()),
])
if __name__ == "__main__":
import uvicorn
uvicorn.run(starlette_app, host="0.0.0.0", port=8000)
Tool 定义规范
- 每个
@mcp.tool()装饰的函数就是一个 MCP Tool - 函数名即 Tool name,应使用 snake_case
- docstring 即 Tool description,必须清晰描述功能、参数含义、返回值
- 参数类型注解会自动转为 JSON Schema(inputSchema)
- 支持的参数类型:str, int, float, bool, list, dict
- 有默认值的参数变为可选参数
关键注意事项
- 每个功能函数都应封装为独立的 MCP Tool
- 避免在 Tool 内部使用全局可变状态
- 异步函数用
async def,同步函数也可以但推荐异步 - Tool 返回值应为 str 类型(复杂结构用 JSON 序列化)
- 错误处理:在 Tool 内部 try-except,返回错误描述而非抛异常
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed 0e5858fdc9d1
- 1mo ago First seen · 58 lines · 0 tokens per session scan A f2dbda753596
mcp_protocol is a skill published in the GitHub repository fdueblab/Micro-Agent (101 stars, last pushed 20d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 572 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vandalizer-api
Talk to the Vandalizer Management API — /api/mgmt/v1. Use when the user says "/vandalizer-api", asks to query the management API, pastes a vklive… key, asks to check Vandalizer dev/prod stats, validation runs, workflows, audit log, or wants to run a workflow/validation/extraction via the management surface.
mem0-status
Diagnoses mem0 connectivity, API key validity, and memory read/write functionality. Use when memory operations fail, searches return empty, addmemory errors occur, or to verify the plugin is working correctly.
status
Show whether Mem0 memory is working in this repository, covering configuration, capture state, pending flushes, and whether the Mem0 API key is valid. Use when the user asks whether memory is on, why a memory is missing, or anything looks broken.
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
mem0-oss-to-platform
Plan, then execute, a migration of a project from the mem0 open-source / self-hosted SDK (local Memory class) to the mem0 Platform / hosted SDK (MemoryClient). TRIGGER when: the developer wants to move, switch, or migrate mem0 off OSS/self-hosted to the hosted API, e.g. "migrate my mem0 setup to the platform", "switch…
browserwing-executor
Control browser automation through HTTP API. Supports page navigation, element interaction (click, type, select), data extraction, accessibility snapshot analysis, screenshot, JavaScript execution, and batch operations.