Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zorost/AI-Engineering-Lab --skill mcp-server-craftgit clone --depth 1 https://github.com/zorost/AI-Engineering-LabWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zorost/ai-engineering-lab/mcp-server-craft)<a href="https://agentmods.dev/skills/zorost/ai-engineering-lab/mcp-server-craft"><img src="https://agentmods.dev/badge/skills/zorost/ai-engineering-lab/mcp-server-craft/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zorost/ai-engineering-lab/mcp-server-craft"><img src="https://agentmods.dev/badge/skills/zorost/ai-engineering-lab/mcp-server-craft.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01061 |
| Opus 5 | $0.00020 | $0.00531 |
| Sonnet 5 | $0.00008 | $0.00212 |
| Haiku 4.5 | $0.00004 | $0.00106 |
Grade A, and why
mcp-server-craft scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Server Craft
1 · Purpose
Make the tools an agent calls as well-designed as any public API, because to the agent, the tool description is the documentation, and the schema is the contract.
2 · When to use
- Building an MCP server (or any tool layer) for agents.
- When an agent misuses a tool repeatedly, usually a tool-design bug, not a model bug.
3 · Inputs
- The system being exposed and its real operations.
- The agent task list: what the agent must accomplish, in verbs.
- An MCP client to test with (inspector, Claude Desktop, your Week-16 harness).
4 · Procedure
- One tool, one verb. Name tools
verb_noun:track_shipment,search_policy,request_refund. If a tool name needs "and", it is two tools. - Type every argument. Schemas with types, enums, ranges, and examples. The model fills what the schema describes; a vague schema invites a creative argument.
- Write the description as a picker hint. First line: what it does. Then: when to use it, when not to use it, and what it returns. The agent chooses tools by this text alone.
- Make reads idempotent and writes explicit. Reads never mutate. Writes take dry-run or confirmation parameters where the underlying operation is irreversible.
- Return structured results, not prose. JSON the next step can consume: IDs, statuses, counts, plus a one-line human summary field.
- Fail informatively. Errors return a code, a cause, and a next action
("lane not found, call
list_lanesto enumerate valid lanes"). An agent that can read its errors can recover from them. - Paginate and bound. Any list operation takes
limitand returnstruncated: truewhen capped. An unboundedlist_allis a context-window bomb. - Test from a real client, not just unit tests: connect an agent, give it the ten task list, and watch which tools it picks. Mispicks mean the descriptions failed, fix the text, not the model.
- Version the server. Tool signatures are a contract; changing one is a version bump with a changelog entry.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 93 lines · 40 tokens per session scan A 5883aed8b0f7
mcp-server-craft is a skill published in the GitHub repository zorost/AI-Engineering-Lab (309 stars, last pushed 22d ago), licensed MIT. It adds 40 tokens to every session and 1,061 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
input-validation-and-sanitization
Use this skill when implementing any endpoint, form handler, CLI tool, or function that accepts external input. Validate and sanitize all untrusted data before processing — never assume input is safe.
auth-and-authorization-patterns
Use this skill when implementing authentication (login, token issuance) or authorization (access control, permissions). Apply whenever the task involves login flows, JWT, OAuth2, session management, or RBAC.
fine-tuning-os
Use this skill when conducting a professional LLM fine-tuning engagement in Zero-Data mode via the MCP server fine-tuning-os. Triggers on: prestation de fine-tuning LLM, livraison de modèle affiné, pipeline Zero-Data, orchestration des 64 outils fine-tuning-os, cycle de vie entraînement (préparation / données…
stripe-projects
Provision SaaS services + sync creds via Stripe Projects.
ai-engineering-toolkit
6 production-ready AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.
status
Show whether Mem0 memory is working in this repository, covering configuration, capture state, pending flushes, and whether the Mem0 API key is valid. Use when the user asks whether memory is on, why a memory is missing, or anything looks broken.