Content is educational guidance for building MCP servers — it documents architecture, patterns, and best practices without instructing the AI to perform malicious actions.
References to security concerns (e.g., 'MUST NOT request passwords via elicitation', 'token audience validation', 'DNS rebinding prevention') are defensive guardrails, not attack instructions.
No prompt injection, system prompt leakage, guidance poisoning, or credential exfiltration instructions present — the profile teaches secure patterns, not how to bypass them.
elicitation.md: 'MUST NOT request passwords, API keys, or tokens via elicitation — spec requirement.'
auth.md: 'Token passthrough is explicitly forbidden. Don't accept a token, then forward it upstream.'
remote-http-scaffold.md: 'Secrets from env vars, never hardcoded' (deployment checklist)
Permissions
Low
Profile declares no tools, no MCP servers, and no file/shell/network permissions — it is pure markdown documentation and code scaffolds.
Skills are instructional guides (build-mcp-server, build-mcp-app, build-mcpb) that teach the user how to design systems; they do not request authority to execute actions on the user's behalf.
Code examples show how to *implement* auth, elicitation, and tool registration — they do not instruct the AI to install, run, or modify code without user consent.
Details
Evidence
Profile metadata: 'description: Skills for designing and building MCP servers' — design guidance, not execution.
No 'alwaysApply', no globs, no tool definitions with high-risk categories (shell, file_write, file_delete).
MCP Risk
Low
No MCP servers are defined or embedded in this profile — it is documentation about how to build MCP servers, not a server itself.
References to MCP server patterns (remote HTTP, MCPB, local stdio) are architectural guidance, not executable configurations.
Code scaffolds (TypeScript SDK, FastMCP examples) are templates for the user to adapt; they do not auto-execute or fetch remote payloads.
ForgeCat