mcp-integration

mcp-integration is a skill for Claude Code from SummerSec/SumSec-Skills. It costs 98 tokens per session (3,034 once invoked), scanned B, a copy of mcp-integration, Apache-2.0.

A guide to MCP integration. MCP, or Model Context Protocol, is a way for a plugin to connect Claude Code to outside services such as databases, APIs, or file systems through structured tools.

In plain words
What is it for?
Use it to add external-service tools to a plugin through stdio, SSE, HTTP, or WebSocket MCP servers.
Why use it?
It explains how to configure those connections, including server setup, authentication, and bundling servers with a plugin.

Skill for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable. Also seen: mentions Claude Code.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the plugin-dev plugin — 7 skills, 1 command, 3 agents shipped together

Good fit Use it to add external-service tools to a plugin through stdio, SSE, HTTP, or WebSocket MCP servers.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add SummerSec/SumSec-Skills
Claude Code
/plugin install plugin-dev

Made for: Claude Code.

Or install plugin-dev, the plugin that ships this one along with the rest of its 7 skills, 1 command, 3 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for mcp-integration

README.md
[![agentmods](https://agentmods.dev/badge/skills/summersec/sumsec-skills/mcp-integration.svg)](https://agentmods.dev/skills/summersec/sumsec-skills/mcp-integration)
Your own site
<a href="https://agentmods.dev/skills/summersec/sumsec-skills/mcp-integration"><img src="https://agentmods.dev/badge/skills/summersec/sumsec-skills/mcp-integration.svg" alt="Measured on agentmods" height="20"></a>
Per session 98 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,034 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00098 $0.03034
Opus 5 $0.00049 $0.01517
Sonnet 5 $0.00020 $0.00607
Haiku 4.5 $0.00010 $0.00303

Measured 8d ago against content hash 2bcc3b5e9392, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade B, and why

mcp-integration scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

- ❌ Pre-allow all tools with wildcards
Origin

This is a copy

100% identical to mcp-integration — 4 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

plugin-dev/skills/mcp-integration/SKILL.md · 555 lines

How it starts

The opening of the file, as written. The whole thing — 555 lines — stays where its author put it; the contents beside it link to each section on GitHub.

MCP Integration for Claude Code Plugins

Overview

Model Context Protocol (MCP) enables Claude Code plugins to integrate with external services and APIs by providing structured tool access. Use MCP integration to expose external service capabilities as tools within Claude Code.

Key capabilities:

  • Connect to external services (databases, APIs, file systems)
  • Provide 10+ related tools from a single service
  • Handle OAuth and complex authentication flows
  • Bundle MCP servers with plugins for automatic setup

MCP Server Configuration Methods

Plugins can bundle MCP servers in two ways:

Method 1: Dedicated .mcp.json (Recommended)

Create .mcp.json at plugin root:

{
  "database-tools": {
    "command": "${CLAUDE_PLUGIN_ROOT}/servers/db-server",
    "args": ["--config", "${CLAUDE_PLUGIN_ROOT}/config.json"],
    "env": {
      "DB_URL": "${DB_URL}"
    }
  }
}

Benefits:

  • Clear separation of concerns
  • Easier to maintain
  • Better for multiple servers

Method 2: Inline in plugin.json

Add mcpServers field to plugin.json:

{
  "name": "my-plugin",
  "version": "1.0.0",
  "mcpServers": {
    "plugin-api": {
      "command": "${CLAUDE_PLUGIN_ROOT}/servers/api-server",
      "args": ["--port", "8080"]
    }
  }
}

Benefits:

  • Single configuration file
  • Good for simple single-server plugins

MCP Server Types

stdio (Local Process)

Execute local MCP servers as child processes. Best for local tools and custom servers.

Configuration:

{
  "filesystem": {
    "command": "npx",
    "args": ["-y", "@modelcontextprotocol/server-filesystem", "/allowed/path"],
    "env": {
      "LOG_LEVEL": "debug"
    }
  }
}

Use cases:

  • File system access
  • Local database connections
  • Custom MCP servers
  • NPM-packaged MCP servers

Process management:

  • Claude Code spawns and manages the process
  • Communicates via stdin/stdout
  • Terminates when Claude Code exits

SSE (Server-Sent Events)

Connect to hosted MCP servers with OAuth support. Best for cloud services.

Read the full file on GitHub · 555 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 555 lines · 98 tokens per session scan B 2bcc3b5e9392

Subscribe to this mod's changes

mcp-integration is a skill published in the GitHub repository SummerSec/SumSec-Skills (8 stars, last pushed 24d ago), licensed Apache-2.0. It adds 98 tokens to every session and 3,034 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). It is 100% identical to mcp-integration, differing in 4 lines, and is treated as a copy.

Related

Other skills, from other repositories

dsh-web-sdk-compatibility

Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…

zhu1090093659/dsh-web · 107 tokens

yao-process

Yao process execution expert. ALWAYS invoke this skill when the user needs to call a Yao process, query data models, run scripts, or check process permissions. Do not call processes without checking this skill first.

YaoApp/yao · 47 tokens

upstash-box-js

Work with the @upstash/box TypeScript/JavaScript SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding…

upstash/skills · 112 tokens

upstash-box-py

Work with the upstash-box Python SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box in Python, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding agents in…

upstash/skills · 109 tokens

daytona-cloud-server

Daytona cloud server, Den sandbox, desktop plus cloud e2e, marketplace server, worker proxy, cloud auth, org policies, connect Electron to Den. Use for server-side setup in validated flows.

Devin-AXIS/iPolloWork · 46 tokens

upstash-blob-js

Work with the @upstash/blob TypeScript/JavaScript SDK for S3-compatible object storage with direct browser uploads, presigned URLs, multipart, and signed reads. Use when storing files or blobs, uploading avatars, images, videos, attachments or user documents, letting a browser upload straight to storage without…

upstash/skills · 114 tokens