api-mcp-server
Integrates a cloud-hosted MCP server into Bun/Elysia APIs, enabling secure, multi-tenant access for AI agents with authentication.
Install this skill
Security score
The api-mcp-server skill was audited on Mar 8, 2026 and we found 21 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 301 | `Permission denied: tool "${toolName}" requires "${permission}" permission. ` + |
Template literal with variable interpolation in command context
| 302 | `Your permissions are: ${perms.join(", ")}` |
Template literal with variable interpolation in command context
| 745 | const RESOURCE_METADATA_URL = `${env.BETTER_AUTH_URL}/.well-known/oauth-protected-resource`; |
Template literal with variable interpolation in command context
| 757 | "www-authenticate": `Bearer resource_metadata="${RESOURCE_METADATA_URL}"`, |
Template literal with variable interpolation in command context
| 907 | instructions += `Your permissions: ${result.permissions.join(", ")}. `; |
Template literal with variable interpolation in command context
| 909 | instructions += `NOT available: ${deniedTools.join(", ")}.`; |
Template literal with variable interpolation in command context
| 1007 | if (!group) throw new Error(`Folder ${targetGroupId} not found`); |
Template literal with variable interpolation in command context
| 1017 | throw new Error(`Folder ${targetGroupId} is not accessible`); |
Template literal with variable interpolation in command context
| 1024 | `ai:agent:${session.agentId}` // Track who created it |
Template literal with variable interpolation in command context
| 1067 | resource: `${env.BETTER_AUTH_URL}/api/mcp`, |
Curl to non-GitHub URL
| 1173 | curl -X POST https://your-api.com/api/mcp \ |
Curl to non-GitHub URL
| 1179 | curl -X POST https://your-api.com/api/mcp \ |
External URL reference
| 1173 | curl -X POST https://your-api.com/api/mcp \ |
External URL reference
| 1179 | curl -X POST https://your-api.com/api/mcp \ |
External URL reference
| 1192 | "url": "https://your-api.com/api/mcp" |
External URL reference
| 1301 | `Bearer resource_metadata="https://..."` with the URL in double quotes. If |
External URL reference
| 1310 | - **MCP Specification:** https://modelcontextprotocol.io/ |
External URL reference
| 1313 | https://www.rfc-editor.org/rfc/rfc9728 |
External URL reference
| 1314 | - **RFC 8414 (OAuth Server Metadata):** https://www.rfc-editor.org/rfc/rfc8414 |
External URL reference
| 1316 | - **Drizzle ORM:** https://orm.drizzle.team |
External URL reference
| 1317 | - **Elysia:** https://elysiajs.com |
Install this skill with one command
/learn @ichabodcole/api-mcp-server