skills/team/mcp-server-scaffold/SKILL.md
Custom MCP server creation with FastMCP pattern and testing. Use when building MCP servers to expose tools, resources, or prompts to AI assistants. Do NOT use when the integration is synchronous REST-only; Do NOT use when the tool surface is a single function that does not benefit from the MCP protocol.
npx skillsauth add michaelalber/ai-toolkit mcp-server-scaffoldInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"A good interface is like a good joke: if you have to explain it, it isn't that good." -- adapted from the Unix philosophy
This skill guides the creation of Model Context Protocol (MCP) servers using the Python mcp SDK
and the FastMCP pattern. MCP servers expose tools (actions), resources (data), and
prompts (structured messages) to AI assistants through a standardized, transport-agnostic
protocol. The same handlers run unchanged across stdio, SSE, and streamable HTTP — transport is a
deployment concern, not a design concern.
Non-Negotiable Constraints:
verb_noun; the name is the primary documentation for AI consumers.ctx.error()); never let raw exceptions reach the transport.The full principle table, tool-vs-resource-vs-prompt decision tree, discipline rules,
anti-patterns, and error recovery live in references/conventions.md.
DESIGN Identify each capability the server exposes; classify as tool | resource | prompt
(decision tree in references/conventions.md). Default to @mcp.tool() when unsure.
SCAFFOLD Create the FastMCP server instance, choose transport, set up project structure.
(Server/tool/resource/prompt patterns in references/mcp-protocol-patterns.md.)
IMPLEMENT Write handlers with input validation, structured error handling, and ctx logging.
INSPECT Run `mcp dev server.py`; invoke each tool in the MCP Inspector; verify response
format, schemas, and error cases. (Inspector checklist in mcp-testing-patterns.md.)
TEST Write pytest tests exercising tools end-to-end — one per category: happy path, edge,
error, validation. (Patterns in references/mcp-testing-patterns.md.)
DEPLOY Configure transport (stdio for CLI; SSE/HTTP for networked) and deploy.
Exit criteria: every capability classified and implemented with validated inputs and structured errors; each tool validated in the Inspector; tests pass across the four categories; transport configured for the target deployment.
<mcp-server-state>
step: Design | Scaffold | Implement | Inspect | Test | Deploy
server_name: [name of the MCP server]
transport: stdio | sse | streamable-http
tools_defined: [count]
tools_tested: [count with passing tests]
last_action: [what was just completed]
next_action: [what should happen next]
blockers: [any issues preventing progress]
</mcp-server-state>
references/mcp-protocol-patterns.md.references/mcp-testing-patterns.md.references/conventions.md.| Skill | Relationship |
|-------|-------------|
| rag-pipeline-python | MCP servers are natural interfaces for RAG. Expose retrieval/generation as tools and documents as resources; follow that skill for retrieval quality, this one for the transport/interface layer. |
| ollama-model-workflow | MCP servers can front local Ollama models with a standardized interface. The MCP layer handles transport and schema; the Ollama workflow handles model selection, prompt formatting, and tuning. |
| fastapi-scaffolder | When the same capability also needs a REST surface, build the HTTP API there and keep MCP handlers transport-agnostic so logic is shared, not duplicated. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".