mcp-server-spec SKILL.md skillA
mcp-server-spec from mohitagw15856/pm-claude-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add mohitagw15856/pm-claude-skills/mcp-server-spec@git:20261006.b9ea321Pins git:20261006.b9ea321 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- mohitagw15856/pm-claude-skills
- Path
plugins/pm-agentnative/skills/mcp-server-spec/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261006.b9ea321, committed Oct 6, 2026
- First version recorded
- Jul 2, 2026
- Size
- 5,618 bytes
- Repository stars
- 1,475
- License
- MIT
Design an MCP server for a product — the tool surface, auth model, and safety boundaries that make it genuinely usable by AI agents. Use when asked to spec an MCP server, expose a product to agents, design tools for Claude or other MCP clients, or review why an existing MCP server performs badly. Produces a complete server spec: a small task-shaped toolset with agent-tested descriptions, auth and scoping decisions, error design, and an explicit not-exposed list.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# MCP Server Spec Skill Every SaaS is shipping an MCP server; most dump their REST API as forty tools and wonder why agents flail. This skill designs the server as what it actually is: a *user interface for a non-human user* — few tools, task-shaped, with descriptions written for a model deciding under uncertainty. ## What This Skill Produces - A **toolset design**: 3-10 tools mapped to agent *tasks*, not API endpoints - **Per-tool specs**: name, description (the routing surface), parameters, returns, error behaviour - **Auth & scoping decisions**: how credentials flow, what a token can never do - An explicit **not-exposed list** with reasons — the most load-bearing section - A **test plan**: the agent-eval loop that proves the toolset works ## Required Inputs Ask for (if not already provided): - **The product** and what users hire it for (the top 5 jobs, not the feature list) - **The existing API surface** (endpoints or capability list) if one exists - **Who the agent acts for** — the end user's own account? a service account? multi-tenant? - **The riskiest actions** the product supports (deletes, sends, payments, permission changes) ## Design Method …
Read the whole file at its exact version.
How to install
mdr add mohitagw15856/pm-claude-skills/mcp-server-spec@sha256:016fc1b2a3d35492The line at the top of this page pins the label git:20261006.b9ea321, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_5q2quey4gcyy6vi3)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Jul 2, 2026 and Oct 6, 2026, about one every 96 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261006.b9ea321 latest | 2026-10-06 | b9ea321 | 5,618 B | A | view · diff |
| git:20260702.fbaacbd | 2026-07-02 | fbaacbd | 5,450 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5618 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
mohitagw15856/pm-claude-skills · 1,475 stars · license MIT · pushed 2026-10-21 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_5q2quey4gcyy6vi3 GET https://markdownregistry.com/api/v1/resolve?ref=mohitagw15856/pm-claude-skills/mcp-server-spec GET https://markdownregistry.com/api/v1/blob/016fc1b2a3d3549234b63a86a4cfaa044a5897e58a81af97304c74aa578b5fe4
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.