worker-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited worker-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
NOTE: Startup and cleanup are handled by worker-base. This skill defines the WORK PROCEDURE.
Features that modify the Rust CLI at ./cli/. This includes:
./ and ./docs/tuistory — REQUIRED when implementing or verifying any interactive CLI prompt (stdin TTY). Invoke before driving prompts like spikes init's hosted/self-host selection or spikes deploy cloudflare's hosted-warning confirmation. Each tuistory session counts as one interactiveChecks entry in the handoff. Evidence requirement: for any feature that adds or modifies an interactive prompt, your handoff's verification.interactiveChecks MUST contain at least one entry per prompt branch (e.g., both the default and non-default answers) with the full action transcript. A handoff that lacks tuistory evidence for a prompt feature will be flagged as incomplete by scrutiny.agent-browser — REQUIRED when the feature includes an end-to-end widget-in-page flow (e.g., golden-path spikes init → spikes inject → widget POST to https://spikes.sh/spikes served via widget-test-server). Use it to click the widget button, submit a test spike, and capture network logs for the live POST response. Do not substitute with curl when an assertion calls for a real browser interaction../cli/src/. Key files:main.rs — Command routing (clap derive). MCP already wired.commands/mcp.rs — MCP server (SpikesService, DataSource, TransportMode, all 9 tools)commands/export.rs — Export formats (EXTEND with new variants)spike.rs — Data models (Spike, Rating, SpikeType, is_resolved())storage.rs — load_spikes() reads .spikes/feedback.jsonlerror.rs — Error typesCargo.toml — Dependencies#[cfg(test)] mod tests { ... } in the same file as the code being tested../cli/tests/ using assert_cmd and predicates.cd cli && cargo test — new tests MUST fail (red phase).cd cli && cargo test — ALL tests must pass (existing + new).cd cli && cargo build — must succeed with zero errors.printf '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}\n{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}\n' | cargo run -- mcp serve 2>/dev/nullSPIKES_TOKEN=test cargo run -- mcp serve --remote 2>/dev/null (verify starts)cargo run -- mcp serve --transport http --port 3848 & then curlcargo run -- auth create-key --help (verify subcommand exists){
"salientSummary": "Rewrote MCP server using rmcp 0.17 SDK with #[tool_router] macro. Exposes get_spikes (page/rating/unresolved filters), get_element_feedback (selector), get_hotspots (limit). Added 10 unit tests for tool logic and 2 integration tests piping JSON-RPC to binary. All 172 tests pass.",
"whatWasImplemented": "Complete MCP server rewrite in cli/src/commands/mcp.rs using rmcp SDK. SpikesService struct with 3 tools via #[tool_router]. Async stdio transport. Added rmcp 0.17 and schemars 1.0 to Cargo.toml. Replaced hand-rolled JSON-RPC with SDK macros. Server info: spikes-mcp, protocol 2024-11-05.",
"whatWasLeftUndone": "",
"verification": {
"commandsRun": [
{ "command": "cd cli && cargo test", "exitCode": 0, "observation": "172 tests pass including 12 new MCP tests" },
{ "command": "cd cli && cargo build", "exitCode": 0, "observation": "No errors" },
{ "command": "echo '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}' | cargo run -- mcp serve 2>/dev/null", "exitCode": 0, "observation": "Response contains protocolVersion, capabilities.tools, serverInfo.name=spikes-mcp" },
{ "command": "printf '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\\n{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\",\"params\":{}}\\n' | cargo run -- mcp serve 2>/dev/null", "exitCode": 0, "observation": "Two valid JSON responses, tools/list shows 3 tools" }
],
"interactiveChecks": []
},
"tests": {
"added": [
{
"file": "cli/src/commands/mcp.rs",
"cases": [
{ "name": "test_get_spikes_no_filter", "verifies": "returns all spikes" },
{ "name": "test_get_spikes_filter_page", "verifies": "page filter works" },
{ "name": "test_get_spikes_filter_rating", "verifies": "rating filter works" },
{ "name": "test_get_spikes_unresolved_only", "verifies": "unresolved filter works" },
{ "name": "test_get_element_feedback_by_selector", "verifies": "selector matching" },
{ "name": "test_get_element_feedback_missing_selector", "verifies": "error on missing required param" },
{ "name": "test_get_hotspots_default_limit", "verifies": "returns top 10 sorted desc" },
{ "name": "test_get_hotspots_custom_limit", "verifies": "limit parameter respected" },
{ "name": "test_get_hotspots_empty", "verifies": "no element feedback message" },
{ "name": "test_tools_list", "verifies": "3 tools returned with schemas" }
]
},
{
"file": "cli/tests/mcp_integration.rs",
"cases": [
{ "name": "test_mcp_initialize", "verifies": "JSON-RPC initialize handshake" },
{ "name": "test_mcp_sequential_requests", "verifies": "multiple requests on same connection" }
]
}
]
},
"discoveredIssues": []
}For any CLI feature that integrates with --remote or the hosted API, you MUST verify the actual API contract before implementation:
../spikes-hosted/worker/src/index.ts to see which routes exist and their HTTP methods../spikes-hosted/worker/src/handlers/ to see request/response shapes../spikes-hosted/worker/src/schema.ts for Zod validation requirements~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.