vibehacker
Discuss
Tara Nguyen
1 month ago

mcp-builder skill shipped a FastMCP server that imports httpx_oauth (not installed)

#mcp#agents#vibe-coding
Anthropic MCP Builder
Design high-quality MCP servers in Python FastMCP or TypeScript SDK

tried the anthropic mcp-builder skill last night to spin up a github issues MCP for claude code.

it wrote a clean FastMCP skeleton, three tools, even a README. then the first uv run died on import httpx_oauth — package isn't in the generated pyproject, isn't on pypi under that name, and the skill kept "fixing" by swapping import paths.

i ended up deleting the auth helper and wiring a plain PAT from env. works. but curious if anyone got the skill to emit a lockfile + install step that actually matches what it imports, or do you always hand-edit the deps after?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Mira

    same energy with the typescript path — it scaffolded @modelcontextprotocol/sdk fine then invented a @mcp/oauth-helpers that 404s on npm.

    i started pasting the generated import list into a empty uv init / npm init first and only keeping what resolves. slower than "let the skill finish" but i stopped chasing ghost packages.

    do you keep the skill's auth stub around as a TODO or rip it before the first commit?

  • Remy

    i treat mcp-builder as a shape generator, not a deps owner.

    flow that stuck for me: skill writes tools → i rg "^import|^from" the new files → pin only real packages in pyproject → delete anything that smells like invented oauth.

    PAT-from-env is the correct exit. the skill is still worth it for the tool schemas; just don't trust the install story until you've run it once.

    • Ash Beacon

      same. i go one step further and fail CI if rg -n "httpx_oauth|oauth.helpers|@mcp/" matches anything in the generated tree.

      had a PR merge green once where the skill swapped the import to a relative from .auth_stub import get_token that just raise NotImplementedError. pytest never imported that module. silent skip energy.

      shape generator yes. install owner never.

      • Chris Klein

        same. billed three hours last month chasing from mcp.oauth import GitHubOAuth that never existed on pypi.

        green MCP badge with tools:[] is worse than disconnected — at least disconnected fails loud. i uv run an import audit before the first commit now. PAT from env. delete the oauth theater.

  • Kai

    hit this exact failure on a linear MCP last week. ModuleNotFoundError: No module named 'httpx_oauth' then the skill "fixed" it by inventing httpx_oauth.clients.github which also doesn't exist.

    what worked: after the skill dumps the server, i run

    uv run python -c "import ast, pathlib; ..."

    over every generated file and diff imports against uv tree. anything not in the lockfile gets deleted before the first commit.

    the skill is fine at tool schemas. the auth stubs are fiction. i keep a one-line PAT helper and ignore whatever oauth theater it writes.

More like this

View all