add-resource — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-resource (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Resources use the resource() builder from @cyanheads/mcp-ts-core. Each resource lives in src/mcp-server/resources/definitions/ with a .resource.ts suffix. The standard registration pattern uses a definitions/index.ts barrel that collects all resources into an allResourceDefinitions array for createApp(). Fresh scaffolds start with direct imports in src/index.ts — the barrel is introduced as definitions grow. Match the pattern already used by the project you're editing.
Tool coverage. Not all MCP clients expose resources — many are tool-only (Claude Code, Cursor, most chat UIs). Before adding a resource, verify the same data is reachable via the tool surface — either through a dedicated tool, included in another tool's output, or bundled into a broader tool. A resource whose data has no tool path is invisible to a large share of agents.
{paramName} for path parameters (e.g., myscheme://{itemId}/data)src/mcp-server/resources/definitions/{{resource-name}}.resource.tscreateApp() resource list (directly in src/index.ts for fresh scaffolds, or via a barrel if the repo already has one)bun run rebuild && bun run start:stdio (or start:http)/**
* @fileoverview {{RESOURCE_DESCRIPTION}}
* @module mcp-server/resources/definitions/{{RESOURCE_NAME}}
*/
import { resource, z } from '@cyanheads/mcp-ts-core';
export const {{RESOURCE_EXPORT}} = resource('{{scheme}}://{{{paramName}}}/data', {
description: '{{RESOURCE_DESCRIPTION}}',
mimeType: 'application/json',
// size: 1024, // optional: content size in bytes, if known
params: z.object({
{{paramName}}: z.string().describe('{{PARAM_DESCRIPTION}}'),
}),
// auth: ['resource:{{resource_name}}:read'],
async handler(params, ctx) {
ctx.log.debug('Fetching resource', { {{paramName}}: params.{{paramName}} });
// Pure logic — throw on failure, no try/catch
return { /* resource data */ };
},
list: async (extra) => ({
resources: [
{
uri: '{{scheme}}://all',
name: '{{RESOURCE_LIST_NAME}}',
mimeType: 'application/json',
},
],
}),
});For resources that return large result sets, include cursor in the URI template params and use opaque cursor pagination in the handler. The cursor arrives as a validated URI param. paginateArray requires a RequestContext for logging — create one from requestContextService:
import { extractCursor, paginateArray, requestContextService } from '@cyanheads/mcp-ts-core/utils';
// URI template: '{{scheme}}://{{{paramName}}}/items'
params: z.object({
{{paramName}}: z.string().describe('{{PARAM_DESCRIPTION}}'),
cursor: z.string().optional().describe('Opaque pagination cursor'),
}),
async handler(params, ctx) {
const allItems = await fetchAllItems(params.{{paramName}});
const cursor = extractCursor({ cursor: params.cursor });
const reqCtx = requestContextService.createRequestContext({
operation: 'list-{{paramName}}',
parentContext: { requestId: ctx.requestId, traceId: ctx.traceId },
});
const page = paginateArray(allItems, cursor, 20, 100, reqCtx);
return {
items: page.items,
nextCursor: page.nextCursor,
};
},// src/index.ts (fresh scaffold default)
import { createApp } from '@cyanheads/mcp-ts-core';
import { {{RESOURCE_EXPORT}} } from './mcp-server/resources/definitions/{{resource-name}}.resource.js';
await createApp({
tools: [/* existing tools */],
resources: [{{RESOURCE_EXPORT}}],
prompts: [/* existing prompts */],
});If the repo already uses src/mcp-server/resources/definitions/index.ts, add the export to that barrel instead:
export { {{RESOURCE_EXPORT}} } from './{{resource-name}}.resource.js';errors[] contractResources can opt into the same typed error contract as tools — bound to a typed ctx.fail(reason, …) keyed by the declared reason union:
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
export const articleResource = resource('article://{pmid}', {
description: 'Read an article by PMID.',
errors: [
{ reason: 'no_pmid_match', code: JsonRpcErrorCode.NotFound,
when: 'PMID not found in the index.',
recovery: 'Use pubmed_search_articles to discover valid PMIDs first.' },
{ reason: 'withdrawn', code: JsonRpcErrorCode.NotFound,
when: 'Article was withdrawn upstream.',
recovery: 'Check PubMed directly for retraction or withdrawal notices.' },
{ reason: 'upstream_throttled', code: JsonRpcErrorCode.RateLimited,
when: 'Upstream PubMed quota hit.', retryable: true,
recovery: 'Wait a few seconds and retry the request.' },
],
params: z.object({ pmid: z.string().describe('PubMed ID') }),
async handler(params, ctx) {
const article = await fetchOne(params.pmid);
if (!article) throw ctx.fail('no_pmid_match', `PMID ${params.pmid} not indexed`);
if (article.withdrawn) throw ctx.fail('withdrawn');
return article;
},
});Without errors[], the handler receives plain Context (no fail method) and throws via error factories (notFound, serviceUnavailable, …) directly. The contract is opt-in. See skills/api-errors/SKILL.md for the full pattern, baseline codes, and conformance rules.
Add a complete map to enable autocompletion for URI template variables. The SDK auto-installs completion/complete handling and advertises the completions capability when a registered resource template has completion callbacks — no other changes needed.
import { resource, z } from '@cyanheads/mcp-ts-core';
const ITEM_IDS = ['item-001', 'item-002', 'item-abc'];
export const itemResource = resource('items://{itemId}', {
description: 'Retrieve an item by ID.',
params: z.object({ itemId: z.string().describe('Item identifier') }),
handler: (params) => ({ id: params.itemId }),
list: () => ({ resources: ITEM_IDS.map((id) => ({ uri: `items://${id}`, name: id })) }),
// Per-variable completion callbacks — keys must match URI template variable names.
complete: {
itemId: async (partial) => ITEM_IDS.filter((id) => id.startsWith(partial)),
},
});Only applies to templated resources (URI templates with {variable} syntax). Static URIs don't support completion.
resource() optionsBeyond description, params, handler, and list, the builder also supports:
| Field | Purpose |
|---|---|
name | Short human-readable name for resources/list. Defaults to a slug derived from the URI template if omitted. |
output | Optional Zod schema for runtime validation of the handler return value (parity with tool()'s output). |
format | Optional formatter mapping the handler's return to the ReadResourceResult.contents[] shape. Default: string passthrough; objects serialized to JSON. Override when you need to attach permissions, custom encodings, or split into multiple content items. |
annotations | Resource annotations (e.g., audience, priority) — see ResourceAnnotations. |
title | Human-readable display title (defaults to name). |
examples | Array of { name, uri } example entries surfaced in resources/list for discoverability. |
complete | Per-variable completion callbacks for URI template variables. Keys match template variable names. Enables completion/complete and the completions capability. |
src/mcp-server/resources/definitions/{{resource-name}}.resource.tsresource() uses a valid URI template with {paramName} syntaxparams fields have .describe() annotationsoutput schema added if the handler returns structured data that benefits from runtime validation@fileoverview and @module header presenthandler(params, ctx) is pure — throws on failure, no try/catcherrors[] contract declared: every entry has a recovery field (≥5 words, lint-enforced)src/mcp-server/tools/definitions/ for a tool that exposes this data, or document why this resource is resources-onlylist() function provided if the resource is discoverableextractCursor/paginateArray) — applies to both handler data and list() catalogs with many entriescreateApp() resource list (directly or via barrel)bun run devcheck passesbun run rebuild && bun run start:stdio (or start:http)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.