octocode-install — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-install (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
DETECT → CHECK INSTALLED → NODE → AUTH → INSTALL MCP → SKILLS → VERIFY
Agent rule: Detect what you can from context. Ask only what you can't determine. One step at a time — wait for the user's answer before proceeding.
Check the conversation and environment context first:
If either is unknown, ask:
"What platform are you on, and which IDE/client are you setting up?" - macOS / Linux - Windows
>
IDE: Cursor · Claude Code · Claude Desktop · Windsurf · Trae · Kiro · Antigravity · VS Code (Cline/Roo/Continue) · Zed · Opencode · Codex · Gemini CLI · Goose
Carry both answers through all remaining steps.
Read the IDE's MCP config file (see config paths table below) and check whether an "octocode" or "octocode-mcp" server entry already exists.
| IDE | Config path (macOS) | Config path (Linux) | Config path (Windows) |
|---|---|---|---|
| Cursor | ~/.cursor/mcp.json | ~/.cursor/mcp.json | %APPDATA%\Cursor\mcp.json |
| Claude Code | ~/.claude.json | ~/.claude.json | %USERPROFILE%\.claude.json |
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json | ~/.config/claude/claude_desktop_config.json | %APPDATA%\Claude\claude_desktop_config.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json | ~/.codeium/windsurf/mcp_config.json | %USERPROFILE%\.codeium\windsurf\mcp_config.json |
| Trae | ~/Library/Application Support/Trae/mcp.json | ~/.config/Trae/mcp.json | %APPDATA%\Trae\mcp.json |
| Kiro | ~/.kiro/mcp.json | ~/.kiro/mcp.json | %APPDATA%\Kiro\mcp.json |
| Antigravity | ~/.gemini/antigravity/mcp_config.json | ~/.gemini/antigravity/mcp_config.json | ~/.gemini/antigravity/mcp_config.json |
| VS Code (Cline) | ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json | ~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json | %APPDATA%\Code\User\globalStorage\saoudrizwan.claude-dev\settings\cline_mcp_settings.json |
| VS Code (Roo) | ~/Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json | ~/.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json | %APPDATA%\Code\User\globalStorage\rooveterinaryinc.roo-cline\settings\mcp_settings.json |
| VS Code (Continue) | ~/.continue/config.json | ~/.continue/config.json | ~/.continue/config.json |
| Zed | ~/.config/zed/settings.json | ~/.config/zed/settings.json | %APPDATA%\Zed\settings.json |
| Opencode | ~/Library/Application Support/opencode/config.json | ~/.config/opencode/config.json | %APPDATA%\opencode\config.json |
| Codex | ~/.codex/config.toml | ~/.codex/config.toml | ~/.codex/config.toml |
| Gemini CLI | ~/.gemini/settings.json | ~/.gemini/settings.json | ~/.gemini/settings.json |
| Goose | ~/Library/Application Support/goose/config.yaml | ~/.config/goose/config.yaml | %APPDATA%\goose\config.yaml |
Also run:
npx octocode statusIf octocode-mcp is already configured in the IDE AND authenticated:
Tell the user: "Octocode is already installed and authenticated in your IDE. You're all set!"
>
Offer: "Would you like to update (npx octocode install --ide <key> --force), install skills, or change config?"STOP here — do not continue with Steps 2–6 unless the user asks to update, reinstall, or add something.
node --versionbrew install node or nodejs.orgwinget install OpenJS.NodeJS or nodejs.orgAsk: "Does node --version show v18 or higher now?"Ask the user:
"How would you like to authenticate with GitHub?" 1. `npx octocode login` — Octocode OAuth (opens browser, stores token automatically) 2. `gh auth login` — GitHub CLI (if gh is already installed) 3. GitHub PAT (token) — paste a token manually; always works, required on Windows if browser auth failsnpx octocode login~/.octocode/credentials.jsonoctocode-mcp — no env var neededWindows: If the browser doesn't open or the command hangs, switch to Option 3 (PAT).
Requires gh already installed (cli.github.com):
gh auth loginoctocode-mcp reads the token via gh auth token automaticallyrepo + read:orgGITHUB_TOKEN in the MCP config (Step 4)After auth, verify:
npx octocode statusExpected: ✓ Authenticated as <username>
If not authenticated — repeat the chosen option or switch to Option 3.
If IDE is unknown, ask:
"Which IDE/client do you want to install octocode-mcp into?"
Run:
npx octocode install --ide <key>| IDE | <key> | Aliases |
|---|---|---|
| Cursor | cursor | |
| Claude Code | claude-code | claudecode |
| Claude Desktop | claude-desktop | claude, claudedesktop |
| Windsurf | windsurf | |
| Trae | trae | |
| Kiro | kiro | |
| Antigravity | antigravity | |
| VS Code (Cline) | vscode-cline | cline |
| VS Code (Roo) | vscode-roo | roo, roo-cline |
| VS Code (Continue) | vscode-continue | continue |
| Zed | zed | |
| Opencode | opencode | |
| Codex | codex | |
| Gemini CLI | gemini-cli | gemini, geminicli |
| Goose | goose |
The CLI writes the config file automatically. Then confirm the result:
{
"mcpServers": {
"octocode": {
"command": "npx",
"args": ["octocode-mcp@latest"]
}
}
}"Do you want to enable local codebase tools (search files, LSP, browse dirs)? Recommended — Yes." → Yes: add"ENABLE_LOCAL": "true"to"env"
"Did you use a PAT (Option 3) for auth, or isnpx octocode statusnot showing authenticated?" → Yes: add"GITHUB_TOKEN": "ghp_xxx"to"env"
{
"mcpServers": {
"octocode": {
"command": "npx",
"args": ["octocode-mcp@latest"],
"env": {
"GITHUB_TOKEN": "ghp_xxxx",
"ENABLE_LOCAL": "true"
}
}
}
}Token resolution order (octocode-mcp picks the first found):OCTOCODE_TOKEN→GH_TOKEN→GITHUB_TOKEN→~/.octocode/credentials.json→gh auth tokenIf you used OAuth orgh auth login, you can omitGITHUB_TOKEN.
Restart the IDE after saving the config.
Ask the user:
"Would you like to install all Octocode skills? These add research, planning, code review, documentation, and more to your AI assistant."
"Which AI clients should skills be installed into?" - Current IDE only (detected in Step 0) - All supported platforms (cursor, claude-code, claude-desktop, codex, opencode)
| Target | Skills directory |
|---|---|
claude-code | ~/.claude/skills/ |
claude-desktop | ~/.claude-desktop/skills/ |
cursor | ~/.cursor/skills/ |
codex | ~/.codex/skills/ |
opencode | ~/.opencode/skills/ |
Then run:
npx octocode skills install --targets <selected-targets> --forceThis installs 10 bundled skills:
| Skill | What it does |
|---|---|
octocode-engineer | Deep code exploration & discovery |
octocode-research | Multi-source research orchestration |
octocode-engineer | System-aware implementation & refactoring |
octocode-rfc-generator | Technical design documents, RFCs, and research-backed plans |
octocode-documentation-writer | Codebase documentation generation |
octocode-engineer | PR review & analysis |
octocode-roast | Brutally honest code review |
octocode-prompt-optimizer | Agent prompt & SKILL.md optimization |
octocode-install | This installer |
After install, verify:
npx octocode skills listExpected: all skills show installed for each target.
npx octocode status # auth check
npx octocode skills list # skills install checkThen open the IDE and test:
"Use octocode-engineer to find the main entry point of this project"
Tools responding = setup complete.
| Goal | Say... |
|---|---|
| Find/explore code | "Find where X is defined", "Who calls Y?" |
| Understand/implement | "How does X work?", "Implement this" |
| Plan | "Plan how to add feature X" |
| Review PR | "Review PR #123" |
| Document | "Document this project" |
| Roast | "Roast my code" |
ENABLE_LOCAL=true in MCP confignpx octocode → Manage Skills → Browse Marketplace| Problem | Fix |
|---|---|
npx: command not found | Install Node.js v18+ |
| OAuth browser doesn't open (Windows) | Use PAT — set "GITHUB_TOKEN" in MCP config "env" |
npx octocode status shows not authenticated | Add "GITHUB_TOKEN": "ghp_xxx" to MCP "env" |
| Local tools return nothing | Add "ENABLE_LOCAL": "true" to MCP "env", restart IDE |
| Skills not loading | Verify ~/<client>/skills/<skill>/SKILL.md has name + description |
| Already installed, want to update | Add --force: npx octocode install --ide cursor --force |
Docs: Auth · CLI Reference · Skills
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.