扫描报告
0 /100
mcp-best-practices
Build production MCP servers with the TypeScript SDK. Covers spec 2025-11-25, SDK v1.28+/v2, transport selection, tool design, error handling, security, performance, known bugs with workarounds, MCP extensions, MCP Apps, authorization extensions, and the MCP Registry.
This is a pure Markdown documentation skill containing only reference guides for MCP best practices — no executable code, scripts, or binary dependencies. All pre-scan flags are educational examples within security documentation sections, not actual malicious behavior.
可以安装
No action needed. This skill is safe to use.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 文件系统 | NONE | NONE | — | No Read/Write tool declarations; skill contains only Markdown files |
| 网络访问 | NONE | NONE | — | No WebFetch or network tool declarations |
| 命令执行 | NONE | NONE | — | No Bash tool declarations; pre-scan 'rm -rf /' is a documented attack example in… |
| 环境变量 | NONE | NONE | — | No environment variable access |
| 技能调用 | NONE | NONE | — | No skill_invoke capability declared |
| 剪贴板 | NONE | NONE | — | No clipboard access |
| 浏览器 | NONE | NONE | — | No browser tool declared |
| 数据库 | NONE | NONE | — | No database access |
1 严重 2 高危 20 项发现
严重 危险命令 危险 Shell 命令
rm -rf / references/security-auth.md:155 高危 IP 地址 硬编码 IP 地址
169.254.169.254 references/security-auth.md:124 高危 IP 地址 硬编码 IP 地址
169.254.0.0 references/security-auth.md:128 中危 外部 URL 外部 URL
https://www.apache.org/licenses/ LICENSE.txt:3 中危 外部 URL 外部 URL
https://spec.modelcontextprotocol.io SKILL.md:16 中危 外部 URL 外部 URL
https://modelcontextprotocol.io/registry/about SKILL.md:22 中危 外部 URL 外部 URL
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13 SKILL.md:309 中危 外部 URL 外部 URL
https://modelcontextprotocol.io/seps/2133-extensions references/extensions-registry.md:70 中危 外部 URL 外部 URL
https://modelcontextprotocol.io/community/sep-guidelines references/extensions-registry.md:72 中危 外部 URL 外部 URL
https://modelcontextprotocol.io/registry/quickstart references/extensions-registry.md:171 中危 外部 URL 外部 URL
https://modelcontextprotocol.io/registry/github-actions references/extensions-registry.md:173 中危 外部 URL 外部 URL
https://modelcontextprotocol.io/registry/versioning references/extensions-registry.md:185 中危 外部 URL 外部 URL
https://mcpui.dev/ references/mcp-apps.md:43 中危 外部 URL 外部 URL
https://apps.extensions.modelcontextprotocol.io/api/documents/Patterns.html#configuring-csp-and-cors references/mcp-apps.md:217 中危 外部 URL 外部 URL
https://apps.extensions.modelcontextprotocol.io/api/modules/app-bridge.html references/mcp-apps.md:292 中危 外部 URL 外部 URL
https://apps.extensions.modelcontextprotocol.io/api/ references/mcp-apps.md:294 中危 外部 URL 外部 URL
https://evil.com/exfil references/security-auth.md:154 中危 外部 URL 外部 URL
https://your-server.com/mcp references/security-auth.md:210 中危 外部 URL 外部 URL
https://auth.your-server.com references/security-auth.md:211 中危 外部 URL 外部 URL
https://mcp.example.com/.well-known/oauth-protected-resource references/security-auth.md:236 目录结构
9 文件 · 95.0 KB · 2433 行 Markdown 8f · 2271L
Text 1f · 162L
├─
▾
references
│ ├─
error-handling.md
Markdown
│ ├─
extensions-registry.md
Markdown
│ ├─
mcp-apps.md
Markdown
│ ├─
security-auth.md
Markdown
│ ├─
tool-schema-guide.md
Markdown
│ ├─
transport-patterns.md
Markdown
│ └─
v2-migration.md
Markdown
├─
LICENSE.txt
Text
└─
SKILL.md
Markdown
安全亮点
✓ No executable code or scripts present — pure documentation skill
✓ No dependencies (no package.json, requirements.txt, etc.)
✓ All pre-scan flags are false positives: 'rm -rf /' and AWS metadata IPs are educational examples in security-auth.md
✓ SKILL.md accurately describes the skill as a decision reference for MCP best practices
✓ No credential harvesting, data exfiltration, obfuscation, or persistence mechanisms
✓ No supply chain risks — no third-party dependencies