skills.rest
YoLaub
YoLaubCOMMUNITY
Explore all skills by this author →
GitHub

create-mcp

Build, harden, or audit MCP server security across seven ordered layers.

1|Updated Aug 6, 2026
Search Tags:#security#authentication#multi-tenant#rate limiting#oauth#audit#mcp
One-click install
npx skills add https://github.com/YoLaub/JohnAI --skill create-mcp-yolaub
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: create-mcp
Source: https://github.com/YoLaub/JohnAI/tree/main/.claude/skills/create-mcp
Command: npx skills add https://github.com/YoLaub/JohnAI --skill create-mcp-yolaub

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? MCP servers often ship without proper security: shared tokens, missing tenant isolation, no rate limiting, and publicly exposed tool manifests. This Skill provides a structured methodology to build, harden, or audit the security layer around MCP tools using seven dependency-ordered layers, without prescribing a specific tech stack. ## Core Features & Use Cases - Seven-layer security model: personal token identity, OAuth 2.1 delegation, per-tool tenant isolation, identity-based rate limiting, tool call logging, sandbox mode, and authenticated manifest discovery. - Two entry modes: a construction phase for building or hardening a server layer by layer with TDD, and an audit phase for verifying an existing server against all seven layers with CONFIRMED/PLAUSIBLE findings. - Pitfall knowledge base: an append-only references file capturing generic and stack-specific traps (e.g., Next.js + mcp-handler OAuth discovery issues). - Use Case: You built an MCP server exposing CRM tools and suspect tenant data leaks. Ask for an audit, and the Skill systematically greps every function touching each entity, verifies identity guards, and reports exploitable gaps before any fix. ## Quick Start Ask the assistant to audit the security of your existing MCP server tools or to harden your MCP server layer by layer starting with token identity.

Frequently Asked Questions about create-mcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure an MCP server with authentication?▼

Start with personal tokens: one opaque, revocable secret per user, hashed in storage and shown once. Resolve identity from the token hash, never from a caller-declared userId. Add OAuth 2.1 with PKCE only if third-party connectors cannot carry a static token.

How do I audit an existing MCP server for security holes?▼

Check each of the seven layers in dependency order, skipping audit of a layer if a prior one is missing. For tenant isolation, grep every function touching each entity and verify the identity guard. Classify findings as CONFIRMED or PLAUSIBLE and report before fixing.

When should I add OAuth 2.1 to my MCP server?▼

Add OAuth 2.1 only when third-party connectors (web or mobile clients) cannot carry a static personal token. For internal or agent-only usage, personal tokens suffice and adding OAuth is over-engineering. Both mechanisms must resolve the same internal identity.

Why does MCP rate limiting fail to block abuse?▼

Rate limiting fails when the limiter is recreated per request instead of being a singleton created at server startup, giving every call a fresh bucket. Key the bucket by resolved identity, not raw token or IP, and ensure rejections appear in tool call logs.

What are the limits of this MCP security methodology?▼

It covers only the security layer around MCP tools, not the design of the tools themselves or full application bootstrapping. It is stack-agnostic, so you must adapt generic patterns to your framework, and it does not rewrite working layers during an audit.

Related Skills

Explore More Software Engineering Skills→
pcsensorpcsensor

mcp-builder

Define standardized MCP server design and implementation methods.

Community
Advanced
AradotsoAradotso
11

edgesecurityaccess-wireguard-vpn

Deploy an ESA WireGuard VPN server and provision user configurations via HTTP API.

Official
Intermediate
dieu-donneedieu-donnee

security-reviewer

Identify security vulnerabilities in code and infrastructure with severity-rated audit reports.

Community
Advanced
majiayu000majiayu000
104

auth-architecture

Authenticate and authorize API requests with JWTs, API keys, and RBAC.

Community
Advanced