Append Log Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Append Log Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A generic append-only log MCP server. Agents write timestamped JSON entries to a JSONL file and query them back by recency.
| Tool | Description |
|---|---|
append | Append a JSON entry to the log. The server adds a logged_at timestamp. |
query | Return logged entries, optionally filtered to the last N days. |
| Variable | Required | Description |
|---|---|---|
APPEND_LOG_FILE | No | Path to the JSONL file (default: append-log.jsonl in cwd) |
APPEND_LOG_TOOLS | Yes | Comma-separated tools to expose: append, query |
task build # outputs to build/append-log-mcp
APPEND_LOG_FILE=/tmp/log.jsonl \
APPEND_LOG_TOOLS=append,query \
./build/append-log-mcp --transport stdioAPPEND_LOG_FILE=/tmp/log.jsonl \
APPEND_LOG_TOOLS=append,query \
./build/append-log-mcp --transport http --addr :8080The Dockerfile uses Docker Hardened Images (DHI). Building requires Docker Hub authentication:
docker login
docker build -t append-log-mcp .Run via stdio:
docker run -i --rm \
-e APPEND_LOG_TOOLS=append,query \
-v append-log-data:/data \
roberthouse224/append-log-mcpdocker compose upThe compose file mounts a named volume at /data and sets both env vars.
{
"mcpServers": {
"append-log": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "APPEND_LOG_TOOLS=append,query",
"-v", "append-log-data:/data",
"roberthouse224/append-log-mcp"
]
}
}
}Each line is a JSON object:
{"data": {"passage_key": "2680:42"}, "logged_at": "2026-03-25T08:00:00Z"}data accepts any valid JSON value. logged_at is always RFC3339 UTC.
task test # go test ./...
task build # outputs to build/append-log-mcp
go vet ./...
staticcheck ./...~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.