This skill should be used when the user wants to "package an MCP server", "bundle an MCP", "make an MCPB", "ship a local MCP server", "distribute a local MCP", discusses ".mcpb files", mentions bundling a Node or Python runtime with their MCP server, or needs an MCP server that interacts with the lo

Build an MCPB (Bundled Local MCP Server) MCPB is a local MCP server packaged with its runtime . The user installs one file; it runs without needing Node, Python, or any toolchain on their machine. It's the sanctioned way to distribute local MCP servers. MCPB is the secondary distribution path. Anthropic recommends remote MCP servers for directory listing — see https://claude.com/docs/connectors/building/what to build. Use MCPB when the server must run on the user's machine — reading local files, driving a desktop app, talking to localhost services, OS level APIs. If your server only hits cloud APIs, you almost certainly want a remote HTTP server instead (see build mcp server ). Don't pay the MCPB packaging tax for something that could be a URL. What an MCPB bundle contains The host reads manifest.json , launches server.mcp config.command as a stdio MCP server, and pipes messages. From your code's perspective it's identical to a local stdio server — the only difference is packaging. Manifest server.type — node , python , or binary . Informational; the actual launch comes from mcp config . server.mcp config — the literal command/args/env to spawn. Use ${ dirname} for bundle relative paths and ${user config.<key } to substitute install time config. There's no auto prefix — the env var names your server reads are exactly what you put in env . user config — install time settings surfaced in the host's UI. type: "directory" renders a native folder picker. sensitive: true stores in OS keychain. See references/manifest schema.md for all fields. Server code: same as local stdio The server itself is a standard stdio MCP server. Nothing MCPB specific in the tool logic. Sandboxing is entirely your job. There is no manifest level sandbox — the process runs with full user privileges. Validate paths, refuse to escape ROOT , allowlist spawns. See references/local security.md . Before hardcoding ROOT from a config env var, check if the host supports roots/list — the spec native way to get user approved directories. See references/local security.md for the pattern. Build pipeline Node mcpb pack zips the directory and validates manifest.json against the schema. Python Vendor dependencies into a subdirectory and prepend it to sys.path in your entry script. Native extensions (numpy, etc.) must be built for each target platform — avoid native deps if you can. MCPB has no sandbox — security is on you Unlike mobile app stores, MCPB does NOT enforce permissions. The manifest has no permissions block — the server runs with full user privileges. references/local security.md is mandatory reading, not optional. Every path must be validated, every spawn must be allowlisted, because nothing stops you at the platform level. If you came here expecting filesystem/network scoping from the manifest: it doesn't exist. Build it yourself in tool handlers. If your server's only job is hitting a cloud API, stop — that's a remote server wearing an MCPB costume. The user gains nothing from running it locally, and you're taking on local security burden for no reason. MCPB + UI widgets MCPB servers can serve UI resources exactly like remote MCP apps — the widget mechanism is transport agnostic. A local file picker that browses the actual disk, a dialog that controls a native app, etc. Widget authoring is covered in the build mcp app skill; it works the same here. The only difference is where the server runs. Testing Test on a machine without your dev toolchain before shipping. "Works on my machine" failures in MCPB almost always trace to a dependency that wasn't actually bundled. Reference files references/manifest schema.md — full manifest.json field reference references/local security.md — path traversal, sandboxing, least privilege

build-mcpb