mcp-creator

license	Apache-2.0
name	mcp-creator
description	Expert MCP (Model Context Protocol) server developer creating safe, performant, production-ready servers with proper security, error handling, and developer experience. Activate on 'create MCP', 'MCP server', 'build MCP', 'custom tool server', 'MCP development', 'Model Context Protocol'. NOT for using existing MCPs (just invoke them), general API development (use backend-architect), or skills/agents without external state (use skill-coach/agent-creator).
allowed-tools	Read,Write,Edit,Bash,Grep,Glob,WebSearch,WebFetch
category	Agent & Orchestration
tags	["mcp","model-context-protocol","tools","integration","creation"]
pairs-with	[{"skill":"agent-creator","reason":"Skills that use the MCP tools"},{"skill":"security-auditor","reason":"Secure MCP server development"}]

MCP Creator

Expert in building production-ready Model Context Protocol servers with security boundaries, robust error handling, and excellent developer experience.

Decision Points

Tool Granularity Decision Tree

Tool complexity assessment:
├── Multiple API endpoints needed?
    ├── Yes → Design separate tools for each endpoint
    │   └── Example: get_user, create_user, update_user
    └── No → Single tool with action parameter
        └── Example: manage_user(action: "get"|"create"|"update")

Tool execution pattern:
├── Operation takes >5 seconds?
    ├── Yes → Design as async with polling tool
    │   └── start_analysis() → check_status() → get_results()
    └── No → Direct synchronous tool
        └── analyze_data() returns results immediately

External service interaction:
├── Requires authentication?
    ├── Yes → Bundle related operations in one MCP
    │   └── Share auth config across tools
    └── No → Consider standalone tools or scripts

Resource vs Tools Decision Matrix

Data access pattern:
├── Read-only structured data? → Use Resources
│   └── Templates, configs, documentation
├── Actions that modify state? → Use Tools
│   └── API calls, database writes, file creation
└── Interactive operations? → Use Tools with prompts
    └── Guided workflows, form filling

Transport Layer Decision

Deployment context:
├── Local CLI integration?
    └── Use StdioTransport (simplest, most secure)
├── Multiple client support needed?
    └── Use SSE Transport (HTTP-based)
├── Custom protocol requirements?
    └── Implement custom Transport class
└── Production server deployment?
    └── SSE with proper auth middleware

Failure Modes

Schema Bloat

Symptom: Tools accept any type or overly permissive schemas Detection: If schema validation catches <90% of invalid inputs Fix: Implement strict Zod schemas with constraints

// ❌ Detection rule: Schema too permissive
{ type: "object" }

// ✅ Fix: Strict validation
const schema = z.object({
  id: z.string().uuid(),
  count: z.number().min(1).max()
})