dangerous-skills-mcp

A TypeScript MCP server that serves a "dangerous skills" corpus over MCP, implementing the Skills delivery model from SEP-2640 (the current sep/skills-extension revision: skills/list + skills/get with a complete per-file resources digest set). Under an opt-in --adversarial profile it also serves crafted, spec-violating fixtures for testing how MCP hosts handle skill delivery — per-file digest/frontmatter integrity, reads scoped to a skill's resources set, cross-origin and name-collision impersonation, enumeration exhaustion, and nested-skill consent, plus a retained set of deferred archive-unpacking fixtures (archives are not in the v1 SEP).

The corpus is forked from gricha/dangerous-skills (MIT © 2026 Greg Pstrucha). Every payload is benign — it writes a marker file or prints a canary string; nothing performs real harm.

Live endpoint

Deployed as a public Hugging Face Docker Space:

https://olaservo-dangerous-skills-mcp.hf.space/mcp

It's a free CPU Space, so the first request after idle is a slow cold start — retry once. The live Space runs the --adversarial profile. See hf-space/README.md to run or redeploy it.

Any SEP-2640 host can consume it. With fast-agent:

fast-agent go --shell
/mcp connect --name dsk https://olaservo-dangerous-skills-mcp.hf.space/mcp
/skills registry dsk
/skills add check-licenses

Related MCP server: MCP Server TypeScript

Run locally

Requires Node 22+ and pnpm (the Docker image pins node:22-alpine). Runs via tsx (no build step).

pnpm install

# stdio (the default transport)
pnpm serve:stdio                   # faithful corpus only
pnpm serve:stdio -- --adversarial  # + adversarial fixtures

# HTTP (127.0.0.1:3940/mcp by default)
pnpm serve:http

# smoke client — spawns the server and runs conformance checks
pnpm smoke                   # PASS/FAIL per check
pnpm smoke -- --adversarial  # also prints what a conformant host MUST do per fixture

What it serves

Skills are addressed under a skill:// URI scheme and enumerated by method:

• skills/list — the catalog: one { uri, frontmatter, resources } entry per skill, where resources is the complete {uri, digest} set for every file (not just SKILL.md). Paginated. There is no skill://index.json.

• skills/get — one skill's entry by its SKILL.md URI, listed or not (the verification-refresh path).

• skill://<name>/SKILL.md and supporting files — individually addressable via resources/read and digest-verifiable against the entry's resources.

• resources/directory/read — the SEP-2640 method for a directory's direct children.

It advertises the io.modelcontextprotocol/skills capability (directoryRead: true). The --adversarial profile adds the spec-violating fixtures (namespaced adv-); the smoke client documents each one and the action a conformant host should take. See src/adversarial/catalog.ts for the full list.

Archives are a deferred feature (not in the v1 SEP; see the SEP's "Appendix: Deferred Features"). The archive-unpacking fixtures are retained as a research corpus: their blobs are served as ordinary resources but are never referenced by a skills/list entry, so a v1 host never fetches them.

Configuration

• SERVE_PROFILE — --adversarial to serve fixtures (the HF image's default), empty for the faithful corpus only.

• SKILLS_ROOT — corpus root (defaults to the vendored third_party/dangerous-skills/skills).

• HOST / PORT — HTTP bind address (default 127.0.0.1:3940).

• ALLOWED_HOSTS, MCP_DISABLE_DNS_REBINDING_PROTECTION — relax the localhost host check for remote hosting behind a proxy.

License

MIT (see LICENSE). The vendored corpus is MIT © 2026 Greg Pstrucha (gricha/dangerous-skills); its notice is kept at third_party/dangerous-skills/LICENSE.