ModernMustardSeed

Small Business MCP Starter — Development skill for Claude Code

Development community

Ship a remote MCP connector that passes Claude directory review on the first try.

How to install Small Business MCP Starter

This entry records only its repository, not the path inside it, so there is no exact command to give. Open ModernMustardSeed/small-business-mcp-starter and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Small Business MCP Starter does

Ship a remote MCP connector that passes Claude directory review on the first try. Next.js + mcp-handler template, SSRF-safe fetch, rate limits for Claude's egress range, evals, policy pages, submission checklist. By Modern Mustard Seed.

Alternatives in Development

Oob — Out-of-band orchestrator — confirm BLIND SSRF/XXE/SQLi/RCE/Log4Shell by correlating interactsh callbacks to th 4.5k ★
Defensive Code Cleanup — Clean Defensive Try-Catch Blocks 1.2k ★
What's New In Copilot MCP! — Sponsored by Cloud MCP - Try out Cloud MCP's Router Mode 481 ★

README

Small Business MCP Starter Kit by Modern Mustard Seed

Ship a remote MCP connector for Claude that is built to pass Anthropic's directory review on the first try.

This kit is the set of patterns Modern Mustard Seed uses for the connectors it runs in production, pulled out into a clean Next.js project you can fork:

A route template on Next.js App Router and `mcp-handler`, serving Streamable HTTP at one URL per connector, with no redirect.
Tool conventions enforced at load time: a title, readOnlyHint or destructiveHint on every tool, snake_case names of 64 characters or fewer, and descriptions that describe instead of steer. Break a rule and pnpm test fails, long before a reviewer sees it.
Specific error messages instead of "Bad Request", and output size caps under Claude's limits.
Rate limiting built for Claude's shared egress range. Every claude.ai user arrives from 160.79.104.0/21, so nothing is keyed by IP and nothing returns HTTP 429.
An SSRF-safe fetch for any tool that reads a URL a user supplied, with tests that prove a listening loopback server receives zero requests.
An eval harness that runs real prompts against your live URL, with no model and no API key.
Docs, privacy, terms and support page templates plus /.well-known/security.txt, all driven by one config file.
A submission checklist mapped to the directory form's 10 steps and its seven policy acknowledgments, with every rule linked to Anthropic's documentation.
A worked example: a U.S. federal holiday and business-day calendar with five read-only tools that passes all 35 of its own evals.