| name | mcp-patterns |
| license | MIT |
| compatibility | Claude Code 2.1.220+. |
| author | OrchestKit |
| description | MCP server building, advanced patterns, and security hardening. Use when building MCP servers, implementing tool handlers, choosing a transport, adding OAuth authentication, wiring MCP Apps UI with @mcp-ui, hardening MCP security, or debugging MCP integrations. |
| version | 3.1.0 |
| tags | ["mcp","server","tools","resources","security","prompt-injection","oauth","elicitation","sampling","mcp-apps","fastmcp"] |
| user-invocable | false |
| disable-model-invocation | true |
| context | fork |
| complexity | high |
| persuasion-type | reference |
| effort | high |
| targets | [{"library":"@modelcontextprotocol/sdk","version":">=1.29.0"},{"library":"mcp","version":">=1.28.0,<2.0.0"}] |
| metadata | {"category":"mcp-enhancement","spec-version":"2025-11-25"} |
| allowed-tools | ["Read","Glob","Grep","WebFetch","WebSearch"] |
| paths | [".mcp.json","**/*.mcp.json"] |
MCP Patterns
Patterns for building, composing, and securing Model Context Protocol servers. Based on the 2025-11-25 specification — the latest stable release maintained by the Agentic AI Foundation (Linux Foundation), co-founded by Anthropic, Block, and OpenAI.
Scaffolding a new server? Use Anthropic's mcp-builder skill (claude install anthropics/skills) for project setup and evaluation creation. This skill focuses on patterns, security, and advanced features after initial setup.
Deploying to Cloudflare? See the building-mcp-server-on-cloudflare skill for Workers-specific deployment patterns.
Pin mcp<2 until you migrate. Every Python snippet in this skill targets the v1 SDK
(from mcp.server.fastmcp import FastMCP). The Python SDK released 2.0.0, pip install mcp
now resolves to it, and upstream's own README says to keep a <2 upper bound on your requirement
until you have migrated. FastMCP does not appear anywhere in the 2.0 README, so treat these
snippets as v1-only rather than assuming they still apply. v1.x continues to receive critical bug
and security fixes on its own branch. Verified 2026-07-31.
Migration guide: https://py.sdk.modelcontextprotocol.io/migration/
Decision Tree — Which Rule to Read
What are you building?
│
├── New MCP server
│ ├── Setup & primitives ──────► rules/server-setup.md
│ ├── Transport selection ─────► rules/server-transport.md
│ └── Scaffolding ─────────────► mcp-builder skill (anthropics/skills)
│
├── Authentication & authorization
│ └── OAuth 2.1 + OIDC ───────► rules/auth-oauth21.md
│
├── Advanced server features
│ ├── Tool composition ────────► rules/advanced-composition.md
│ ├── Resource caching ────────► rules/advanced-resources.md
│ ├── Elicitation (user input) ► rules/elicitation.md
│ ├── Sampling (agent loops) ──► rules/sampling-tools.md
│ └── Interactive UI ──────────► rules/apps-ui.md
│
├── Client-side consumption
│ └── Connecting to servers ───► rules/client-patterns.md
│
├── Security hardening
│ ├── Prompt injection defense ► rules/security-injection.md
│ └── Zero-trust & verification ► rules/security-hardening.md
│
├── Testing & debugging
│ └── Inspector + unit tests ──► rules/testing-debugging.md
│
├── Discovery & ecosystem
│ └── Registries & catalogs ──► rules/registry-discovery.md
│
└── Browser-native tools
└── WebMCP (W3C) ───────────► rules/webmcp-browser.md
Quick Reference
