Skip to content
Back to skills

Right Mcp

ASecurity

Finds and adds MCP servers for this Right Agent agent. Searches for OAuth-capable endpoints first (Claude Code / Codex integration docs), falls back to API-key endpoints. All management goes through the user's Telegram dashboard MCP view — the agent never handles credentials directly. Use when the user asks to add, connect, or set up an MCP server or integration.

  • 35 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 19, 2026
ai-agentsgogitapi

Works with

  • claude code
  • claude desktop
  • api
  • mcp

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 19, 2026

npx -y skills add onsails/right-agent --skill right-mcp --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Right Mcp?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Right Mcp
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/onsails-right-mcp/badge)](https://www.skillsdirectory.com/skills/onsails-right-mcp)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: right-mcp
description: >-
  Finds and adds MCP servers for this Right Agent agent. Searches for OAuth-capable
  endpoints first (Claude Code / Codex integration docs), falls back to API-key
  endpoints. All management goes through the user's Telegram dashboard MCP view —
  the agent never handles credentials directly. Use when the user asks to add,
  connect, or set up an MCP server or integration.
version: 0.1.0
---

@known-endpoints.yaml

# /right-mcp -- Add MCP Server

## When to Activate

Activate this skill when:
- The user asks to add, connect, or set up an MCP server or integration
- The user asks about connecting a third-party service via MCP
- The user names a specific service and wants it added (e.g. "add Composio", "connect Linear")

## Architecture

You have NO direct MCP management access. All management goes through the user's
Telegram dashboard MCP view. Telegram `/mcp` opens that dashboard view. Here's
what happens behind the scenes:

- The **Right Agent MCP Aggregator** proxies all MCP traffic, stores tokens, and
  refreshes OAuth automatically. You never see or handle credentials.
- The dashboard add flow auto-detects authentication:
  1. Tries OAuth AS discovery on the URL and offers OAuth when discovered
  2. Detects query-string auth (key embedded in URL) and can register as-is
  3. For other URLs, detects header auth and asks the user for credentials in the dashboard
- The dashboard starts browser-based OAuth, removes servers, and lists all
  servers with status. The built-in `right` server is protected.

## Procedure

### Step 1: Check current servers

Call `mcp__right__rightmeta__mcp_list()` DIRECTLY by name — do NOT use ToolSearch
(it does not index MCP tools) and do NOT delegate to a subagent (subagents have no MCP access).
If the requested service is already connected, tell the user and stop.
If the tool call fails, skip this step and continue.

### Step 2: Check known endpoints

Check `known-endpoints.yaml` for the requested service. If a match exists,
go straight to Step 4 with the URL from the file — skip web search entirely.

### Step 3: Search for OAuth endpoint FIRST

Only if the service is NOT in known endpoints, search the web.
Your first search query MUST target Claude Code or Codex integration docs.
These describe OAuth-capable MCP endpoints that work with the dashboard OAuth
flow.

Use these search queries (in order, stop when you find a URL):
1. `"<service> MCP server Claude Code"`
2. `"<service> MCP Claude Desktop config"`
3. `"<service> MCP endpoint OAuth"`

Look for streamable HTTP or SSE URLs like:
- `https://mcp.service.dev/sse`
- `https://mcp.service.dev/mcp`
- `https://service.com/v1/mcp`

**DO NOT** use URLs from your training data. Only use URLs found in search results.

### Step 4: If OAuth URL found

Tell the user to open `/mcp`, add the server with the name and URL you found,
and choose OAuth in the dashboard if it is offered. Include the exact name and
URL; do not invent credentials.

### Step 5: If no OAuth endpoint found

Search more broadly for any MCP endpoint:
1. `"<service> MCP server URL"`
2. Check the service's official docs for MCP/API integration pages

If you find an API-key URL (token in query string or requires header), give:
Tell the user to open `/mcp`, add the server with the name and URL you found,
and follow the dashboard credential prompt if one appears.

### Step 6: If no MCP endpoint found

Tell the user the service may not have MCP support yet. Suggest:
- Checking the service's docs or integrations page directly
- Looking for community MCP servers on GitHub

## Constraints

- **NEVER** ask the user for API keys or tokens — the bot handles credential collection
- **NEVER** guess or fabricate URLs from training data — only use URLs from known-endpoints.yaml or search results
- **NEVER** attempt to call internal MCP management APIs — they don't exist as agent tools
- **ALWAYS** check known-endpoints.yaml first, then search the web if no match — do not rely on prior knowledge of MCP endpoints
- **ALWAYS** call `mcp__right__rightmeta__mcp_list()` first to check existing servers

Files in this skill

  • SKILL.md4 KB
  • known-endpoints.yaml582 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.