maintenance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited maintenance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
bun update --latest yourself and wanting to review the impact (Mode B — typical)| Mode | Starting Point | First Step |
|---|---|---|
| A — Full flow | Lockfile is current; want to update | Step 1 |
| B — Post-update review | User already ran bun update --latest + bun run rebuild + bun test | Skip to Step 3 with the update output or git diff bun.lock |
Both modes converge at Step 3 and end at Step 6.
bun outdatedNote: bun update --latest crosses semver majors; bun update alone respects ranges. Use --latest unless a package is intentionally pinned.
bun update --latestCapture the ↑ package old → new lines from stdout — these feed Step 3. Alternatively, git diff bun.lock surfaces version deltas after the fact.
For each updated package, fetch the release notes or CHANGELOG entries between old and new versions, then cross-reference changes against actual imports in src/. Output per package: what changed, impact on this project, action items.
Focus on packages this server directly depends on:
| Package | Impact Check |
|---|---|
@modelcontextprotocol/sdk | Protocol version bumps, breaking handler signatures, new capabilities |
hono / @hono/node-server / @hono/mcp | HTTP transport API changes, middleware signatures |
@opentelemetry/* | Instrumentation contract changes, exporter config |
tsyringe / reflect-metadata | DI container behavior, decorator semantics |
jose | JWT/JWKS verification API |
pino / pino-pretty | Logger API, transport config |
zod | Schema API (e.g., v3 → v4 refinement changes, .describe() behavior) |
typescript | New strict checks, lib changes affecting existing types |
vitest / @vitest/coverage-v8 | Test runner behavior, coverage provider changes |
eslint / typescript-eslint | New rules flagging existing code |
| Cross-spawn / execa | Child-process spawning semantics used by CliGitProvider |
Use WebFetch or Bash + curl (for full content) against the package's GitHub releases or CHANGELOG. Skim tag-to-tag diffs rather than scrolling the full file.
Apply findings from Step 3:
src/mcp-server/, src/services/, src/utils/, src/storage/, src/container/).env.example, src/config/index.ts Zod schema, and README.md if user-facingKeep diffs focused. Don't sweep refactors beyond the update's scope.
Common spots to re-check:
src/services/git/providers/cli/ if child-process libraries changedsrc/mcp-server/transports/http/ if Hono / MCP SDK changedsrc/utils/telemetry/ if OpenTelemetry SDK changedsrc/mcp-server/transports/auth/ if jose changedbun run rebuild
bun run devcheck
bun testrebuild (clean + build) catches API surface and type-alignment issues that devcheck alone may miss — module resolution, path aliases, post-build processing. devcheck runs lint, format, typecheck, and security audit.
In Mode B, the user already ran rebuild + test before invoking this skill, but run them again here — Step 4 made code changes that need verification.
Fix anything that fails. Re-run until clean.
Present a concise numbered summary to the user:
bun update --latest) — Mode A, or already done by user — Mode Bbun run rebuild succeedsbun run devcheck passes (lint + format + typecheck + audit)bun test passes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.