MCP Server Kit: the two-step write pattern and a ten-check tool scan (free sample)
by PaperChaseWebb
From MCP Server Kit: the two-step write pattern that keeps an MCP server from changing anything until the owner approves, six rules for agents that build or install servers, and a read-only script that runs ten checks on a tool list or agent config, from write tools marked read only and poisoned descriptions to live keys and unpinned packages.
- Price
- Free
- Difficulty
- Beginner
- Setup
- 5 min
- Format
- .md file
mcp-server-kit-two-step-write-pattern-tool-scan-free-sample.md · 9 KB · direct download, no signup
What you end up with
You know which tools in your MCP servers can change things without asking you, and how to put an owner approval in front of them.
What you get
- The two-step write pattern for MCP servers
- Six rules for agents that build or install servers
- mcp_mini.py: ten read-only checks for a tool list or config
Who it is for
Anyone who wants a quick check of an MCP server or config before an agent gets it.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Plain Markdown, so it also pastes into other agents such as Grok Bot, Hermes, OpenClaw or Muse. We list those as compatible by format only, not as tested.
Tools needed
Cost to run: Free.
Time to result: About five minutes to a first scan
Sample prompts, free to use
Run python3 mcp_mini.py on tools.json and on .mcp.json. For every finding, explain the risk in one line and the smallest fix. Do not edit the files.
The rules and script are in the file.
Free preview of the file
# MCP Server Kit: the two-step write pattern and a ten-check tool scan (free sample) Version 1.0, 2026-10-31. By PaperChaseWebb. For anyone adding MCP servers to Claude Code, Codex, Hermes or a Grok Bot, or writing one. One page and one Python 3 script, standard library only, read-only: it reads a saved tool list or a JSON config and never starts or calls a server. Tested with 4 unit tests and 41 planted faults on Linux with Python 3.13, 3.12, 3.11, 3.9 and 3.8, and on tool lists saved from three official reference servers. ## The two-step write pattern An MCP tool that changes something (a quote, a file, a customer record) does it the moment the agent calls it. Client approval prompts help, but they ask the person at the keyboard, which is often the agent's own session on autopilot. The safer shape is two tools and an owner step the agent cannot reach: 1. draft_change writes a proposal file and returns a preview with a change id. Nothing real changes. 2. The owner reads the preview and approves it at their own terminal, with a small script that needs a person to type the change id. There is no approve tool. 3. apply_change takes only the change id and refuses unless there is a matching approval for that exact proposal (checked by sha256), it is recent, and the record still holds the value the draft saw. An apply that is refused comes back as a normal tool error that tells the agent what to ask the owner. The agent stops; it does not retry its way around. ## Rules to pa
Test record
- Date
- Oct 31, 2026
- What was run
- tests/test_mini.py (clean tool list, bought starter findings on tools and config, bad input) and the copy extracted from the sample page. Linux, Python 3.13, 3.12, 3.11, 3.9 and 3.8.
- Result
- 4 passed, 0 failed on all five versions; the extracted copy was identical to the tested script.
- Not run
- A live server probe with the sample (the full kit's checker does that).
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- The sample checks saved files only; it does not probe a live server. The starter server, the 35-code checker with live probes and the connect card, and the agent setup are in the full kit.
- On 2026-10-31 mcp_mini.py passed 4 unit tests on Linux with Python 3.13, 3.12, 3.11, 3.9 and 3.8, on the full kit's tool list and a made-up bought starter, and the copy extracted from the sample page was identical to the tested script.
Questions
Does it change my files?
No. It reads one file and prints findings. It opens no network connection and never starts or calls a server.
What is in the full kit?
A working MCP server with owner-approved writes, tested against the official MCP Python SDK, a 35-code checker with live probes, a connect card tied to the exact server file, and setup for Grok Bot, Claude Code, Codex and Hermes. $29.
Details
Version 1.0 · Updated Oct 31, 2026 · Markdown version of this page
License: Personal and commercial use. Download terms
Related
MCP Server Kit: a tested starter server, approval-gated write tools and a checker
A small working MCP server for a made-up plumbing business where every write is a draft plus an apply that waits for the owner, an approval script the agent cannot run for you, and a read-only checker that finds unsafe tools, poisoned descriptions, open schemas, live keys and unpinned packages in any server or agent config, including starters you bought. Tested against the official MCP Python SDK with configs for Grok Bot, Claude Code, Codex and Hermes.
Vet Before You Install: the twelve checks (free sample)
The seat sort and the twelve checks to run before any third-party skill, plugin, MCP server, repo or model touches a real machine, plus one prompt and the decision line. Updated to v1.1.
Design MCP tools and errors so the model's next call is the right one
Two MCP server builders shared numbers and rules from real use. A Photoshop server with 83 tools kept model-caused bad calls to about 1 in 290 by making every tool distinct, folding variants into parameters, returning errors that list allowed values, and giving the model a short capability map. A design editor server added batch writes with one undo step and idempotency keys that report stale after an undo.