release-and-publish — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-and-publish (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill runs after git wrapup. By the time it's invoked:
package.json version is bumpedserver.json version is bumped (top-level + each package entry)CHANGELOG.md has a new entry for this version with a concrete date (never [Unreleased])chore: release v<version>) existsv<version>) exists locallyIf any are missing, halt and tell the user to finish wrapup first. Do not attempt to redo wrapup work from inside this skill.
Stop on the first non-zero exit. No retries, no remediation from inside the skill. Report to the user:
The user fixes locally and re-invokes, or runs the remaining steps manually. Publishes hard-fail with "version already exists" if replayed — that's the signal the step already succeeded.
Read package.json → capture version. Read server.json → verify top-level version matches and every packages[].version matches. Then verify git state:
git status --porcelain # must be empty — clean working tree
git describe --exact-match --tags HEAD 2>&1 # must equal v<version>
git rev-parse --abbrev-ref HEAD # note the branch nameIf working tree is dirty, HEAD isn't on v<version>, or server.json versions drift from package.json, halt.
All three must succeed:
bun run devcheck
bun run rebuild
bun testAny non-zero exit → halt with the failing command's output.
devcheck runs lint + format + typecheck + bun audit. rebuild is a clean + bun build to catch build-time regressions devcheck alone can miss.
git push
git push --tagsIf the remote rejects either push, halt. On a fresh branch, git push may need -u origin <branch> — read the error and re-run if that's the only gap.
bun publish --access publicbun publish uses whatever npm auth the user has configured in ~/.npmrc. If 2FA is enabled on the npm account, the command will prompt for an OTP or open a browser — that's expected; the user completes it interactively.
Friction reducers (optional, configure once):
| Option | How |
|---|---|
| npm granular access token with "Bypass 2FA for publish" | Generate at npmjs.com → replace _authToken in ~/.npmrc → no OTP prompt at all |
1Password CLI TOTP injection (requires brew install --cask 1password-cli + signed-in op) | bun publish --access public --otp="$(op item get 'npm' --otp)" |
Halt on publish error other than "version already exists" (which means this step already ran).
bun run publish-mcpThis repo's publish-mcp script is defined in package.json and runs scripts/validate-mcp-publish-schema.ts before invoking mcp-publisher. Reads server.json at the repo root.
Prereqs:
read:org + read:user scopes, reachable by the publish-mcp script (conventionally stored in Keychain under service mcp-publisher-github-pat on macOS)mcp-publisher CLI installed (npm i -g mcp-publisher or brew install mcp-publisher)If the Keychain entry doesn't exist:
security add-generic-password -a "$USER" -s mcp-publisher-github-pat -w
# paste PAT at the silent promptHalt on any publisher error other than "cannot publish duplicate version".
Print clickable URLs for every destination that succeeded:
https://www.npmjs.com/package/@cyanheads/git-mcp-server/v/<version>https://registry.modelcontextprotocol.io/v0/servers?search=io.github.cyanheads/git-mcp-serverhttps://github.com/cyanheads/git-mcp-server/releases/tag/v<version>Skip any destination that was skipped or failed in its step.
The annotated tag is enough for npm/MCP Registry. A GitHub Release adds a human-readable changelog page and optional assets. Skip unless the project publishes releases to GitHub Releases specifically.
gh release create "v<version>" \
--title "v<version>" \
--notes-file <(awk "/^## v<version>/,/^## v/" CHANGELOG.md | sed '$d')The awk expression extracts just the current version's section from CHANGELOG.md.
v<version>package.json and server.json versions matchbun run devcheck passesbun run rebuild succeedsbun test passesgit push succeedsgit push --tags succeedsbun publish --access public succeedsbun run publish-mcp succeeds~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.