What does this skill do, and when should you use it?
This skill guides developers in packaging an MCP server as an MCPB bundle, including its Node, Python, or binary runtime. It targets servers that must run on the user’s machine, such as those reading local files, controlling desktop applications, accessing localhost services, or using OS APIs. It covers manifest.json, stdio launch configuration, dependency bundling, validation, testing, and signing. MCPB provides no sandbox, so the server runs with full user privileges and must enforce its own security controls.
Explains how to create a .mcpb ZIP archive containing manifest.json, server code, dependencies, and an icon; configure Node, Python, or binary servers with stdio launch commands; use ${__dirname} and ${user_config.<key>} for bundle paths and install-time settings; package, validate, and sign bundles with npm, pip, esbuild, and @anthropic-ai/mcpb; test servers with MCP Inspector; and implement path validation, spawn allowlists, and least-privilege controls for local resources.
- A developer distributing a local-file MCP server to users who may not have Node or Python installed.
- An MCP developer building tools that read files, search directories, or watch the local filesystem.
- An engineer integrating an MCP server with a desktop application or operating-system API.
- A team shipping a localhost-connected MCP server as one drag-and-drop .mcpb file.
- A developer vendoring Python dependencies and preparing a local MCP server for multiple platforms.
How do you install this skill?
- An MCPB process normally has the user's full filesystem, process, and network privileges; manifest examples and readOnlyHint are not sandboxing or enforced permission controls.
- Implement and test path containment including symlinks, command arguments, resource limits, and secret handling yourself; the examples are not a substitute for a security audit.
- Before distribution, lock and review npm/pip dependencies and verify installation, startup, failure messages, upgrades, and rollback on target platforms without the development toolchain.
- The documentation depends on npm, GitHub, and Anthropic-related services and provides no evidence of Chinese-language support or mainland-China network reachability.
- Shell / CLI
- Network access
- Local filesystem
- MCP Server
Node.jsPythonnpmpip@anthropic-ai/mcpb
The skill is located at plugins/mcp-server-dev/skills/build-mcpb/SKILL.md in Anthropic’s official Claude Code Plugins Directory. In Claude Code, run /plugin install {plugin-name}@claude-plugins-official or browse /plugin > Discover; the supplied material does not specify the plugin name.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/anthropics/claude-plugins-official.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/plugins/mcp-server-dev/skills/build-mcpb" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- package an MCP server,
- bundle an MCP,
- make an MCPB,
- ship a local MCP server.
In Claude Code, ask to “package an MCP server,” “bundle an MCP,” “make an MCPB,” or “ship a local MCP server.” Follow the supplied workflow to create manifest.json and the server directory. For Node, run npm install, npx esbuild src/index.ts --bundle --platform=node --outfile=server/index.js, then npx @anthropic-ai/mcpb validate and npx @anthropic-ai/mcpb pack. You can initialize with npx @anthropic-ai/mcpb init and test with npx @modelcontextprotocol/inspector node server/index.js.
What are this skill's strengths and limitations?
- Bundles the runtime and dependencies so users do not need Node, Python, or a toolchain installed.
- Covers the delivery workflow from manifest configuration through dependency handling, validation, testing, and signing.
- Clearly distinguishes local MCPB distribution from remote HTTP server distribution.
- Highlights concrete local-security requirements such as path validation, spawn allowlists, and least privilege.
- MCPB has no manifest-level sandbox or permissions block; the server runs with full user privileges.
- Native Python extensions must be built for each target platform, increasing cross-platform packaging work.
- The supplied material does not include an automated test suite or evidence that every target platform was tested.
- MCPB is a poor fit for servers that only call cloud APIs; a remote server is generally more appropriate.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| MCPB Local Server Packager this page ✓ Anthropic · Official | 56 · Use with care | ★ 38k | 11d ago | Apache-2.0 |
| Manus Credit Optimizer v5 | 43 · Not recommended | ★ 51 | 5mo ago | MIT |
| Context7 Project Bootstrapper ✓ Microsoft · Official | 36 · Not recommended | ★ 194k | 11d ago | MIT |
| NeMo Relay Installation Guide ✓ NVIDIA · Official | 62 · Recommended | ★ 3.6k | 11d ago | Apache-2.0 |
| NeMo Relay Quick Start ✓ NVIDIA · Official | 61 · Recommended | ★ 3.6k | 11d ago | Apache-2.0 |
Compared with the build-mcp-server remote HTTP path named in the source, MCPB is for servers that must access the user’s machine. For cloud-only APIs, the source recommends a remote server to avoid local packaging and security overhead.
How did FollowSkills review this skill?
The skill explicitly discloses that MCPB has no sandbox and that the process runs with full user privileges. It recommends path containment, no shell injection, read/write separation, secret protection, resource limits, and confirmation for destructive calls, making major risks and data flows visible. However, these controls are guidance rather than enforced by the manifest or runtime; rollback, dependency supply-chain verification, and a complete confirmation path are absent. The path example also does not address actual symlink resolution, so points are deducted.
The Node/Python build commands, manifest examples, validation, packing, signing, and clean-machine testing advice make the happy path reasonably reproducible. Static files contain no committed test suite, execution results, or reproducible abnormal-input coverage; dependencies are not locked, and some security examples have implementation limitations. The score therefore remains within the static-review cap and below the happy-path maximum.
The front matter gives precise triggers covering MCP packaging, MCPB files, bundled runtimes, local files, desktop applications, and OS APIs. It also states that cloud-only servers generally belong on remote HTTP and identifies non-fit scenarios. Chinese-language interaction, non-Claude Desktop hosts, and broader environment support are not documented; npm, GitHub, and Anthropic ecosystem reachability from mainland China is unverified, so points are deducted.
The skill has a version, layered sections, manifest field tables, a minimal example, security references, build instructions, and installation notes. Repository context supplies Apache-2.0 licensing and identifies Anthropic as the internal maintainer, providing governance and attribution evidence. The skill lacks a changelog, explicit maintenance/update policy, compatibility-change process, FAQ, and dependency-locking guidance, so it is not full marks.
The material directly addresses MCPB manifests, Node/Python packaging, security boundaries, and release checks. The examples and commands are potentially directly useful with light review. Static review cannot verify that the commands produce an installable bundle on the target host, and the essential security controls remain implementer-owned; the score is capped at the static maximum of 7.
The evidence consists primarily of revisioned repository documentation, reference files, repository license metadata, and related CI definitions, giving limited auditability. The CI does not show a committed test suite or execution evidence covering this skill's key build paths, and there is no independent corroboration or reproduction record. The score is therefore below the static ceiling of 5.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →