mcp-source — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-source (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are switching the com.coplaydev.unity-mcp package source in one or more Unity projects.
Bash, Read, Edit, ReadMcpResourceTool, ListMcpResourcesTool
The user's argument is: $ARGUMENTS
Valid values: main, beta, branch, local, or empty.
If empty or not one of the four valid values, ask the user to choose:
Run these git commands from the current working directory to find the unity-mcp repo:
git rev-parse --show-toplevel # → repo_root
git rev-parse --abbrev-ref HEAD # → branch_name
git remote get-url origin # → origin_urlConvert SSH origins to HTTPS: if origin_url starts with [email protected]:, transform it to https://github.com/{owner}/{repo}.git.
Try two approaches to find Packages/manifest.json files to update:
Approach A — MCP resources (preferred): Read mcpforunity://project/info for each connected Unity instance (use ListMcpResourcesTool to find available instances). Extract projectRoot and use {projectRoot}/Packages/manifest.json.
Approach B — filesystem fallback: If no MCP instances are connected, search upward from the current working directory for Packages/manifest.json files using Bash:
find "$(pwd)" -maxdepth 3 -name "manifest.json" -path "*/Packages/manifest.json" 2>/dev/nullIf multiple manifests are found, update all of them (confirming with the user first).
Based on the user's selection, construct the dependency value:
| Selection | URL |
|---|---|
main | https://github.com/CoplayDev/unity-mcp.git?path=/MCPForUnity#main |
beta | https://github.com/CoplayDev/unity-mcp.git?path=/MCPForUnity#beta |
branch | {origin_https}?path=/MCPForUnity#{branch_name} |
local | file:{repo_root}/MCPForUnity |
For branch: use the HTTPS-normalized origin URL and current git branch name. For local: use the absolute path to the repo root with file: prefix (no //), e.g. file:/Users/davidsarno/unity-mcp/MCPForUnity.
For each discovered manifest.json:
"com.coplaydev.unity-mcp" dependency lineAfter updating, tell the user:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.