← All skills
Skill
mcp-developer
skill:jeffallan/claude-skills#mcp-developer
Use when building, debugging, or extending MCP servers or clients that connect AI systems with external tools and data sources. Invoke to implement tool handlers, configure resource providers, set up stdio/HTTP/SSE transport layers, validate schemas with Zod or Pydantic, debug protocol compliance issues, or scaffold complete MCP server/client projects using TypeScript or Python SDKs.
Verdict
Inconclusive
The analysis could not cover enough of the artifact to decide.
0
findings
—
highest severity
0
threat classes
590
files scanned
276/276
checks satisfied
21
package advisories
Why this verdict
- inconclusive: gap external_plugin_source at .claude-plugin/marketplace.json
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below.
Package advisories 21
Known vulnerabilities and malicious-package reports (OSV) for the packages it installs or runs.
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
No version pinned · fixed in 0.14.1 · skills/mcp-developer/SKILL.md:27
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
No version pinned · fixed in 0.16.6 · skills/mcp-developer/SKILL.md:27
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
No version pinned · fixed in 1.32.0 · skills/mcp-developer/references/typescript-sdk.md:6
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
No version pinned · fixed in 1.26.0 · skills/mcp-developer/references/typescript-sdk.md:6
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
No version pinned · fixed in 1.32.0 · skills/mcp-developer/references/typescript-sdk.md:6
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
No version pinned · fixed in 1.31.0 · skills/mcp-developer/references/typescript-sdk.md:6
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
No version pinned · fixed in 1.25.2 · skills/mcp-developer/references/typescript-sdk.md:6
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
No version pinned · fixed in 1.24.0 · skills/mcp-developer/references/typescript-sdk.md:6
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
No version pinned · fixed in 1.9.4 · skills/mcp-developer/SKILL.md:24
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
No version pinned · fixed in 1.23.0 · skills/mcp-developer/SKILL.md:24
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
No version pinned · fixed in 1.27.2 · skills/mcp-developer/SKILL.md:24
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
No version pinned · fixed in 1.10.0 · skills/mcp-developer/SKILL.md:24
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
No version pinned · fixed in 1.27.2 · skills/mcp-developer/SKILL.md:24
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
No version pinned · fixed in 1.28.1 · skills/mcp-developer/SKILL.md:24
Zod can exhaust memory while validating oversized constrained collections
No version pinned · fixed in 4.6.6 · skills/mcp-developer/references/typescript-sdk.md:6
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
No version pinned · fixed in 1.32.0 · skills/mcp-developer/references/typescript-sdk.md:6
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
No version pinned · fixed in 1.32.0 · skills/mcp-developer/references/typescript-sdk.md:6
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
No version pinned · fixed in 1.30.0, 2.2.0 · skills/mcp-developer/SKILL.md:24
Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic
No version pinned · fixed in 1.6.2, 1.8.2, 1.7.4 · skills/mcp-developer/references/python-sdk.md:6
Pydantic regular expression denial of service
No version pinned · fixed in 2.4.0, 1.10.13 · skills/mcp-developer/references/python-sdk.md:6
Zod denial of service vulnerability
No version pinned · fixed in 3.22.3 · skills/mcp-developer/references/typescript-sdk.md:6
Execution chain 20
What it calls, runs, installs, reads and writes, with the line that does it.
Files read 5
/path/to/allowed/directory
skills/mcp-developer/references/resources.md:207 · instructed
/path/to/large.txt
skills/mcp-developer/references/resources.md:525 · instructed
<dynamic>
skills/mcp-developer/references/resources.md:231 · instructed
<dynamic>
skills/mcp-developer/references/resources.md:479 · instructed
<dynamic>
skills/mcp-developer/references/tools.md:267 · instructed
Files written 2
pydantic
skills/mcp-developer/references/python-sdk.md:6 · instructed
zod
skills/mcp-developer/references/typescript-sdk.md:6 · instructed
Network calls 1
<dynamic>
skills/mcp-developer/references/tools.md:284 · instructed
Packages 7
npm:@modelcontextprotocol/create-server
skills/mcp-developer/SKILL.md:24 · instructed
npm:@modelcontextprotocol/inspector
skills/mcp-developer/SKILL.md:27 · instructed
npm:@modelcontextprotocol/sdk
skills/mcp-developer/references/typescript-sdk.md:6 · instructed
npm:zod
skills/mcp-developer/references/typescript-sdk.md:6 · instructed
pypi:mcp
skills/mcp-developer/references/python-sdk.md:6 · instructed
pypi:mcp
skills/mcp-developer/SKILL.md:24 · instructed
pypi:pydantic
skills/mcp-developer/references/python-sdk.md:6 · instructed
URLs 5
https://github.com/jeffallan
https://github.com/Jeffallan
https://jeffallan.github.io/claude-skills/skills/api-architecture/mcp-developer/
https://synergetic.solutions
https://synergetic.solutions
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
external_plugin_source plugin 'fullstack-dev-skills' source is not local.claude-plugin/marketplace.json