Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Jignesh-Ponamwar/skills-mcp --skill mcp-server-buildergit clone --depth 1 https://github.com/Jignesh-Ponamwar/skills-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jignesh-ponamwar/skills-mcp/mcp-server-builder)<a href="https://agentmods.dev/skills/jignesh-ponamwar/skills-mcp/mcp-server-builder"><img src="https://agentmods.dev/badge/skills/jignesh-ponamwar/skills-mcp/mcp-server-builder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jignesh-ponamwar/skills-mcp/mcp-server-builder"><img src="https://agentmods.dev/badge/skills/jignesh-ponamwar/skills-mcp/mcp-server-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02239 |
| Opus 5 | $0.00049 | $0.01120 |
| Sonnet 5 | $0.00020 | $0.00448 |
| Haiku 4.5 | $0.00010 | $0.00224 |
Grade A, and why
mcp-server-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 297 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Server Builder Skill
MCP Architecture
An MCP server exposes three primitives to AI clients:
| Primitive | Purpose | When to Use |
|---|---|---|
| Tools | Callable functions the agent invokes (tools/call) |
Actions, API calls, computations |
| Resources | Read-only data the agent fetches (resources/read) |
Files, database records, configuration |
| Prompts | Reusable prompt templates (prompts/get) |
Guided workflows, structured interactions |
Option A: Python with FastMCP (Recommended)
pip install fastmcp
Minimal Server
# server.py
from fastmcp import FastMCP
mcp = FastMCP("My Tools Server", version="1.0.0")
@mcp.tool(description="Add two numbers together")
def add(a: float, b: float) -> float:
"""Add two numbers and return the result."""
return a + b
@mcp.tool(description="Fetch the current weather for a city")
async def get_weather(city: str, unit: str = "celsius") -> dict:
"""Get current weather. unit: 'celsius' or 'fahrenheit'"""
import httpx
async with httpx.AsyncClient() as client:
resp = await client.get(f"https://wttr.in/{city}?format=j1")
resp.raise_for_status()
data = resp.json()
return {
"city": city,
"temperature": data["current_condition"][0]["temp_C" if unit == "celsius" else "temp_F"],
"condition": data["current_condition"][0]["weatherDesc"][0]["value"],
}
if __name__ == "__main__":
mcp.run() # stdio mode (default)
Run Modes
# stdio (for Claude Code, Cursor - recommended for local tools)
python server.py
# SSE (for browser clients and remote access)
MCP_TRANSPORT=sse python server.py # http://localhost:8000/sse
# Streamable HTTP (modern, bidirectional)
MCP_TRANSPORT=streamable-http python server.py
Resources
@mcp.resource("config://app-settings")
def get_app_settings() -> str:
"""Return current application settings."""
import json
return json.dumps({
"version": "1.0.0",
"features": ["auth", "analytics"],
"max_users": 1000,
})
@mcp.resource("file://{path}") # template URI with parameter
def read_file(path: str) -> str:
"""Read a file by path."""
import pathlib
# IMPORTANT: validate path to prevent traversal
base = pathlib.Path("./allowed_dir").resolve()
target = (base / path).resolve()
if base not in target.parents and base != target:
raise ValueError("Path outside allowed directory")
return target.read_text()
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 297 lines · 98 tokens per session scan A 1ba8b6cf1e4c
mcp-server-builder is a skill published in the GitHub repository Jignesh-Ponamwar/skills-mcp (8 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 98 tokens to every session and 2,239 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
aws-serverless-eda
AWS serverless and event-driven architecture expert based on Well-Architected Framework. Use when building serverless APIs, Lambda functions, REST APIs, microservices, or async workflows.
agentmail
Email infrastructure for AI agents. Create accounts, send/receive emails, manage webhooks, and check karma balance via the AgentMail API.
api-rate-limit-handler
Implement bounded, idempotency-aware API throttling, backoff, and retry handling for 429 and transient 5xx responses.
aria
Designs the data model, API contracts, and structural foundation of the system.
api-security
Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase methodology.
api-security-testing
API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.