serverless-mcp

serverless-mcp is an MCP server development skill for AI agents, published by serverless in the serverless repository on GitHub. Skillspace rates serverless-mcp D (59/100) and the safety scan flagged it for review; the rating is based on static analysis only.

Host Model Context Protocol (MCP) servers on AWS with the Serverless Framework's built-in MCP support — an official-SDK server module deployed to AWS Lambda behind a streaming API Gateway REST endpoint, with gateway access control, OAuth protected-resource discovery, packaging and elicitation state handled for you. Use whenever the user wants to deploy, host, secure or debug an MCP server on AWS or Lambda, writes or edits an `mcp:` block in serverless.yml, exposes tools, resources or prompts to Claude or another AI client over HTTP, or hits an `MCP_*` configuration error (MCP_UNSUPPORTED_NODE_RUNTIME, MCP_FUNCTION_NAME_COLLISION, MCP_INVALID_STATE_ARN, and the rest). Trigger even when neither "Serverless Framework" nor "MCP" is named but the user describes putting their own tools in front of an AI client over an HTTPS endpoint.

Grade
D
Quality
59 / 100
Safety
Needs review
GitHub stars
46,916

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

Our review

Architecture
84 / 100
Maturity
Basic: a single SKILL.md
Security scan
Medium-risk patterns
License
Not declared. Check the repository before reusing it.

What the scanner flagged

  • reads environment variables

Not checked yet

  • Category is a classifier prediction; no model has read this skill yet
  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.