Juicy Designs Quote — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Juicy Designs Quote (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Request and read-only capabilities for AI agents, exposed two ways:
| Transport | Path | For |
|---|---|---|
| MCP (Streamable HTTP) | POST /mcp | ChatGPT / Claude / agent connectors |
| REST request | POST /quote, POST /strategy-session | Agentic browsers / OpenAPI clients |
| REST read | GET /service-catalog /service-areas /case-studies /client-reviews /faqs | Read reference data |
| Discovery | GET /, GET /openapi.json | Health + machine-readable spec |
| Tool | Type | Purpose |
|---|---|---|
get_quote | request | Submit a free, no-obligation quote request. Consent-gated. |
book_strategy_session | request | Request a free strategy session. Consent-gated. |
get_service_catalog | read | Services + reference "from" floors (reference only). |
get_service_areas | read | Where Juicy Designs works. |
get_case_studies | read | Track record and portfolio pointer. |
get_client_reviews | read | Aggregate Google rating and review source. |
get_faqs | read | Common questions and answers. |
Both request tools share the same server-side validation and the same forwardLead() sink, which posts the lead to the existing Juicy Designs Apps Script form handler as form_type=quote — leads land exactly where the website form's leads land (email + the "Leads" Google Sheet). Read tools return curated static data only; no PII, no external calls.
references only, never a quote or estimate. Confirms receipt + the four-working-hour SLA only.
cd mcp-quote-worker
npm install
# 1) Lead sink (the existing Apps Script /exec URL)
npx wrangler secret put LEAD_ENDPOINT
# paste: https://script.google.com/macros/s/AKfycb.../exec
# 2) (optional) per-IP rate limit — Apps Script already throttles 5/10min
# npx wrangler kv namespace create RATELIMIT # then paste id into wrangler.toml + uncomment
npx wrangler deployDeploy prints the Worker URL, e.g. https://juicy-designs-quote.<subdomain>.workers.dev. Put that origin into openapi.yaml (servers.url) and wherever you advertise the endpoint.
npx wrangler dev # serves on http://localhost:8787
# REST
curl -s localhost:8787/quote -H 'content-type: application/json' -d '{
"name":"Sipho Dlamini","email":"[email protected]","service":"seo",
"project_summary":"E-commerce store, want to rank for running shoes in SA.",
"budget_range":"25k_75k","timeline":"1_3_months","consent_to_contact":true
}'
# MCP: list tools
curl -s localhost:8787/mcp -H 'content-type: application/json' -d \
'{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# MCP: call get_quote
curl -s localhost:8787/mcp -H 'content-type: application/json' -d \
'{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_quote","arguments":{"name":"Sipho","email":"[email protected]","service":"seo","project_summary":"Need SEO for a new store in Pretoria.","consent_to_contact":true}}}'A request without consent_to_contact:true must come back as an error — that is the POPIA gate working.
Claude (Settings → Connectors → Add custom connector): URL = https://<worker>/mcp. ChatGPT (Settings → Connectors / Developer mode): add an MCP server with the same /mcp URL. The connector lists one tool, get_quote. The agent should read the fields back and confirm consent with the user before calling. No authentication is required (the tool only creates a lead).
After deploy, advertise the endpoints from the site:
/connect/ or a section on /quote/) listing the MCP + OpenAPI URLs.## For AI agents
- MCP server (request a quote): https://<worker>/mcp
- OpenAPI 3.1 spec: https://<worker>/openapi.json(Left out of llms.txt until you have the real Worker URL — paste it in post-deploy so there is no dead link.)
| MCP/REST input | sent as | shown in email/sheet |
|---|---|---|
service (enum) | services (label) | Services |
budget_range (enum) | budget (label) | Budget |
project_summary (+ timeline + source) | message | Message |
name / email / phone / company | same | as-is |
form_type | quote | routes to the quote email/template |
Swap the body of forwardLead() in src/index.ts to send leads elsewhere (CRM, webhook, Resend).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.