Borrowing it
Nothing to install: this file belongs to guillermoscript/lms-front. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/guillermoscript/lms-front/master/.agents/skills/mcp-apps-builder/SKILL.mdgit clone --depth 1 https://github.com/guillermoscript/lms-frontWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/guillermoscript/lms-front/mcp-apps-builder)<a href="https://agentmods.dev/skills/guillermoscript/lms-front/mcp-apps-builder"><img src="https://agentmods.dev/badge/skills/guillermoscript/lms-front/mcp-apps-builder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/guillermoscript/lms-front/mcp-apps-builder"><img src="https://agentmods.dev/badge/skills/guillermoscript/lms-front/mcp-apps-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00774 |
| Opus 5.5 | $0.00022 | $0.00310 |
| Sonnet 5.5 | $0.00011 | $0.00155 |
| Haiku 4.5 | $0.00006 | $0.00077 |
Grade A, and why
mcp-apps-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 44 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Build with mcp-use
Treat the installed mcp-use package, its exported types, generated declarations, and the project's existing code as the source of truth. Inspect the installed version before choosing APIs or changing code.
Workflow
- Inspect
package.json, the server entry, exported tool refs,mcp-env.d.ts,views/,skills/, and the installedmcp-useversion. - Scaffold a new stable project with
create-mcp-use-app@latestand the appropriate template. Match the package version or dist-tag when working on beta, canary, or an existing versioned project. - Read only the references needed for the task:
- Server for tools, resources, prompts, MCP middleware, request context, and result envelopes.
- Views for interactive MCP Apps, React hooks, model context, host capabilities, assets, and CSP.
- Authentication for OAuth providers, verified identity, scopes, permissions, and authorization.
- Skills over MCP when a server should ship reusable workflows alongside its tools.
- Advanced features for OpenAPI, proxying, notifications, subscriptions, and elicitation.
- Migration only when retired or compatibility-only imports, helpers, registration shapes, UI patterns, or session assumptions are present.
- Verification before reporting implementation work complete.
- Implement against installed types. Prefer the framework's current conventions over copied examples or historical changelogs.
- Validate the smallest real lifecycle that proves the changed behavior, then expand checks in proportion to risk.
Core invariants
- Import server APIs from
mcp-use, React APIs frommcp-use/react, and OAuth provider adapters from theirmcp-use/oauth/*subpaths. - Define tool arguments with
inputSchema. AddoutputSchemafor structured results and every View-bound tool. - Return raw MCP result envelopes. A successful schema-backed tool must include matching
structuredContent; an expected failure may returnisError: truewith model-readablecontent. - Put each View at
views/<name>/view.tsxand bind it withview: { name: "<name>" }. - Export every statically declared tool ref consumed by a View. Default-export the server entry used by
mcp-use dev,build, andstart. - Keep identity and mutable workflow state request-scoped or in an external store. Treat client-reported metadata as unverified.
- Consider Skills over MCP when a server exposes a repeatable, multi-step workflow that would otherwise inflate tool descriptions.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -47 lines · -13 tokens per session b65c2719ae16
- 1mo ago First seen · 91 lines · 68 tokens per session scan A 3035e65e2134
mcp-apps-builder is a skill published in the GitHub repository guillermoscript/lms-front (40 stars, last pushed today), licensed MIT. It adds 55 tokens to every session and 774 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
inbox-zero-api
Use the Inbox Zero API CLI to inspect the live API schema, list and manage automation rules, and read inbox analytics through the public API. Use this when a task involves Inbox Zero rules, stats, or API-driven automation and can be solved through the CLI instead of browser interaction.
public-api-review
Design and review ClassroomIO public APIs for security, authorization, API contract quality, MCP/API-key behavior, and dashboard feature parity. Use when adding or reviewing API routes, public APIs, automation endpoints, or MCP tools.
moodle-performance
Use when optimizing Moodle plugin performance — MUC caching definitions, query optimization, recordsets vs records, ad-hoc and scheduled tasks, lazy loading, OPcache, query log analysis, $PERF, and performance debug toolbar.
moodle-privacy-gdpr
Use when implementing or reviewing the Moodle privacy provider (GDPR) — nullprovider vs request\plugin\provider, getmetadata, exportuserdata, deletedataforuserincontext, deletedataforusers, getcontextsforuserid, getusersincontext, subsystem links, and coreuserlistprovider.
moodle-web-services
Use when adding/calling Moodle web services or external functions — db/services.php, classes/external/, REST/SOAP/AJAX protocols, tokens, capabilities, parameters/returns schemas, file uploads, and rate limiting.
moodle-hooks-api
Use when implementing or migrating to the Moodle 4.4+ Hooks API. Covers hook class authoring (db/hooks.php), callback registration, dispatching, replacing legacy magic callbacks (extendnavigation, beforehttpheaders, etc.), and testing hook listeners.