mcp-research
Expert research tool for Model Context Protocol implementations. PROACTIVELY use when reviewing MCP server code, planning new MCP tools/resources/prompts, investigating protocol compliance issues, or validating architecture. Specializes in protocol compliance (JSON-RPC 2.0), security patterns, transport layers, and production best practices. Current spec: 2025-06-18.
Security Assessment
About mcp-research
mcp-research is a specialized research and validation skill designed for analyzing and planning Model Context Protocol (MCP) implementations. It supports engineers who need to review MCP server code, design new MCP tools, resources, or prompts, investigate protocol compliance issues, or validate production architectures. The skill focuses strictly on the current MCP specification (2025-06-18) and enforces critical requirements such as JSON-RPC 2.0 compliance, capability advertisement, transport correctness, and security controls. It helps teams identify protocol violations, security gaps, and architectural risks before deployment.
Core capabilities include structured compliance validation against JSON-RPC 2.0 rules (e.g., required "jsonrpc: \"2.0\"" fields, correct result/error usage, initialization flow), verification of declared capabilities in the initialize response, and transport-layer checks for both stdio and HTTP/SSE implementations. The skill emphasizes mandatory user consent, explicit tool execution approval, credential safety, and input/output sanitization. It provides a guided research workflow that incorporates official specification review, community research, reference file consultation, and structured reporting. Output is intentionally concise and formatted for senior engineers, focusing on critical protocol violations, security issues, and a maximum of three actionable fixes.
Typical use cases include pre-release server audits, debugging protocol errors, validating new MCP feature designs, and ensuring production readiness. It is intended for backend engineers, platform architects, security reviewers, and teams building or maintaining MCP-compliant servers. The skill is particularly valuable in environments where strict protocol adherence, secure tool execution, and scalable transport design are required.
FAQ
When should I use mcp-research?
Use it when reviewing an MCP server, planning a new MCP capability (tools, resources, prompts), investigating protocol compliance issues, or validating overall architecture against the 2025-06-18 specification.
Does it verify JSON-RPC 2.0 compliance?
Yes. It checks mandatory JSON-RPC 2.0 requirements, including message structure, error handling rules, and correct initialization sequencing.
Which transport layers are supported?
It validates both stdio (newline-delimited JSON-RPC with stderr logging) and HTTP/SSE transports, including endpoint structure and configuration requirements.
Does it generate code or full documentation?
No. It provides concise findings, highlights critical violations or risks, and suggests up to three actionable fixes. It does not produce full documentation or extended code samples.
What are the security requirements it enforces?
It verifies mandatory user consent before data access, explicit approval for tool execution, absence of hardcoded credentials, and proper input/output sanitization.
Install mcp-research
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
nspady/google-calendar-mcp