The Agent Skills Directory

[SAFE]: The skill implements a secure authentication layer via the AuthPlug module, which enforces Bearer token validation for all sensitive MCP methods including GET, POST, and DELETE.
[SAFE]: It provides a custom DNS rebinding protection plug (mcp_dns_rebinding) to ensure the server only responds to authorized Host headers, reducing the risk of unauthorized local network access.
[SAFE]: The included MCPServer template incorporates a with_scope authorization helper that enforces fine-grained permission checks (e.g., examples:read, examples:write) before executing any tool logic.
[SAFE]: The skill follows secure development practices by explicitly advising against wildcard CORS origins and correctly implementing Vary: Origin headers to prevent cache-related security issues.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of MCP tools which process external arguments. The provided templates mitigate potential injection risks by enforcing structured JSON schemas for input validation and leveraging Ecto changesets for data sanitization in the generated application code.
Ingestion points: Tool arguments in MCPServer.run/2 (found in references/server.md).
Boundary markers: The templates rely on the application's domain logic and JSON-RPC structure for boundaries.
Capability inventory: The generated tools interact with application context modules (e.g., MyApp.YourContext).
Sanitization: Uses Ecto.Changeset for validation and Jason for structured encoding of results.

bootstrap-mcp