Dynamic MCP server discovery and code-mode execution via central registry. Use for multiple MCP integrations, tool discovery, progressive disclosure, or encountering MCP context bloat, changing server sets, large tool sets.
Installs just this skill. Get the whole plugin for auto-invocation.
⚡ How it fires
How this skill gets triggered: by you, by Claude, or both.
Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/mcp-dynamic-orchestrator
👁️ Context preview
The summary Claude sees to decide when to auto-load this skill.
Dynamic MCP server discovery and code-mode execution via central registry. Use for multiple MCP integrations, tool discovery, progressive disclosure, or encountering MCP context bloat, changing server sets, large tool sets.
📊 Stats
Stars194
Forks29
LanguageTypeScript
LicenseMIT
📦 Ships with claude-skills
</> SKILL.md
mcp-dynamic-orchestrator.SKILL.md
---name: mcp-dynamic-orchestrator
description: "Dynamic MCP server discovery and code-mode execution via central registry. Use for multiple MCP integrations, tool discovery, progressive disclosure, or encountering MCP context bloat, changing server sets, large tool sets."
metadata:
keywords:
- MCP
- code-mode
- registry
- dynamic tools
- tool discovery
- progressive disclosure
license: MIT
allowed-tools:
- list_mcp_capabilities
- describe_mcp
- execute_mcp_code
---## Overview
Use this skill to:
- Discover which MCP servers are available and what they are for.
- Inspect a specific MCP's capabilities without loading all tool schemas.
- Execute TypeScript/JavaScript that calls MCP tools via generated `mcp-clients/*` modules.
If no MCP servers are configured, `list_mcp_capabilities` will respond with an empty list
and a message pointing to `skills/mcp-dynamic-orchestrator/mcp.registry.json` so the user
can add MCP entries.
This skill reads from `mcp.registry.json`, so adding an MCP entry there (for example the
Cloudflare MCP) automatically makes it discoverable without changing tool wiring.
The Cloudflare MCP server can be configured in `mcp.registry.json` like this:
```json
{
"id": "cloudflare",
"title": "Cloudflare platform MCP",
"summary": "Interact with Cloudflare's MCP endpoint for documentation, examples, and platform operations exposed via the official Cloudflare MCP server.",
- Request `detail: "schema"` in `describe_mcp` only when exact parameter shapes are required.
## Known Limitations
### Sandbox Security (CRITICAL)
⚠️ **The current sandbox implementation is NOT secure for untrusted code.**
> ⚠️ **The `vm`-based sandbox is NOT a security boundary.** Node's `vm` module can be escaped (see Node docs). This setting reduces accidental damage only. For untrusted MCP entries, run them in a **separate process/container with proper OS-level isolation.**
- Uses `vm.createContext()` which is NOT a security boundary
- Can be escaped via prototype pollution, require() manipulation, etc.
- **Only enable for Claude-generated code** (trusted source)
- See `references/security-model.md` for complete security details
### Spawn Hardening (Command & Env Allowlisting)
When adding entries to `mcp.registry.json`, the orchestrator enforces:
1. **Command allowlist** — only `npx, npm, pnpm, yarn, bunx, bun, node, deno, uvx, uv, python, python3, cargo, go` (bare names resolved via PATH). Absolute/relative paths and shells are rejected. Set `MCP_ORCH_ALLOW_RAW_COMMANDS=1` to opt out (loud stderr warning; only for fully-trusted registries).
2. **Env var denylist** — `PATH`, `NODE_OPTIONS`, `LD_PRELOAD`, `DYLD_INSERT_LIBRARIES`, `PYTHONPATH`, etc. are stripped from `mcp.env` before spawn (stderr warning per dropped key).
### Other Limitations
- **No TypeScript compilation**: User code in `.ts` format will fail
- **No module resolution**: Imports from `mcp-clients/*` don't resolve; use `$call()` API
