report-issue-framework — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited report-issue-framework (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
You've isolated a problem to @cyanheads/mcp-ts-core itself — not your server code, not a misconfiguration, not a missing peer dependency. Typical triggers:
tool(), resource(), prompt()) rejects valid input or produces incorrect outputcreateApp() or createWorkerHandler() fails on a valid configContext properties (ctx.log, ctx.state, ctx.inputs, etc.) behave contrary to docs/utils, /errors, /auth, /storage, /services returns wrong results or throws unexpectedlybun run lint:mcp) produces false positives or misses real violationsFor general gh CLI workflows outside issue filing (PRs, workflows, API access), see the github-cli skill.
bun pm ls @cyanheads/mcp-ts-core or check node_modules/@cyanheads/mcp-ts-core/package.jsonbun outdated @cyanheads/mcp-ts-core. If behind, update and retest before filing.gh issue list -R cyanheads/mcp-ts-core --search "your error message or keyword" --state all
# Assess a close match before commenting — is it already linked to a fix or referenced elsewhere?
gh issue view <number> -R cyanheads/mcp-ts-core # body
gh issue view <number> -R cyanheads/mcp-ts-core --comments # thread only — without a TTY it prints no body
gh api 'repos/cyanheads/mcp-ts-core/issues/<number>/timeline' --paginate \
--jq '.[] | select(.event=="cross-referenced") | .source.issue | "\(.repository.full_name)#\(.number) — \(.title)"'src/ for behavior, docs/ for human-facing reference, and framework-skills/ for agent-facing reference. Skill files marked audience: external are the framework's public contract — treat them as authoritative when evaluating whether a documentation gap exists. Also verify the constants or types you'd reference aren't already exported from @cyanheads/mcp-ts-core or one of its subpaths.Good issues are terse and fact-dense. Budget: a bug reads in ~150 words, a feature in ~250, code and logs excluded. Every section past the form's required fields must earn its place — a section you could delete without changing the fix is noise. One or two sentences per bullet; if a bullet runs long, split it or cut it.
createApp() throws ConfigurationError when MCP_HTTP_PORT is set to 0" beats "There's a problem with the config." A reader should know what's broken or missing before the end of the first sentence.[Hono](https://hono.dev/), [linkedom](https://github.com/WebReflection/linkedom). Link to the canonical repo or homepage so readers can verify the dependency and reach docs in one click.cyanheads/pubmed-mcp-server#34). Bare #N only works for same-repo issues.Related:, the description, or Additional context — not all three. The reader sees them all; redundant linking dilutes signal.GitHub issues are public. Do not include secrets, credentials, API keys, or tokens. Redact sensitive values from env vars, headers, and logs before submitting. Replace with obvious placeholders: REDACTED, sk-...REDACTED. Do not rely on partial masking — partial keys can still be exploited.
The repo has YAML form issue templates. Use --web to open the form in the browser (preferred when available), or pass --title + --body for non-interactive use.
gh issue create -R cyanheads/mcp-ts-core --template "Bug Report" --webStructure the --body to match the template's form fields. Environment is the form's one-row table: the installed mcp-ts-core version from node_modules/@cyanheads/mcp-ts-core/package.json (not the ^ range), the runtime with its version (bun --version), the transport, and the OS. Description is two or three sentences; the reproduction is the minimal code and the observed output, nothing else. Add ### Additional context only when it changes the fix (a workaround, a related issue, the one log line that matters) — omitted by default.
gh issue create -R cyanheads/mcp-ts-core \
--title "bug(scope): concise description" \
--label "bug" \
--assignee "@me" \
--body "$(cat <<'ISSUE'
### Environment
| mcp-ts-core | Runtime | Transport | OS |
|---|---|---|---|
| 0.13.16 | Bun 1.4.4 | stdio | macOS 15.x |
### Description
Brief explanation of the bug — what you expected vs what happened.
### Reproduction
import { tool, z } from '@cyanheads/mcp-ts-core';
export const broken = tool('broken_example', { description: 'Minimal repro.', input: z.object({ id: z.string().describe('ID') }), output: z.object({ name: z.string().describe('Name'), extra: z.string().optional().describe('Optional field'), }), async handler(input, ctx) { return { name: 'test' }; // omitting optional field causes validation error }, });
### Actual behavior
Error: Output validation failed: ...
### Expected behavior
Omitting an optional output field should pass validation.
ISSUE
)"Format: bug(<scope>): concise description
| Scope | When |
|---|---|
tool | Tool builder, handler, format, annotations |
resource | Resource builder, handler, list, params |
prompt | Prompt builder, generate, args |
context | Context, logger, state, progress, elicit |
config | AppConfig, parseConfig, env parsing |
errors | McpError, error factories, typed contracts (errors[] / ctx.fail), conformance lint, httpErrorFromResponse, auto-classification |
auth | Auth modes, scope checking, JWT/OAuth |
storage | StorageService, providers |
transport | stdio/http transport, SSE, session handling |
worker | createWorkerHandler, Worker runtime |
utils | Utilities (formatting, parsing, pagination, etc.) |
linter | Definition linter false positives/negatives |
types | Type exports, type inference |
services | LLM, Speech, Graph services |
deps | Dependency issues, peer dep conflicts |
Every issue needs exactly one primary label. Stack secondary labels on top when applicable.
Primary (required — pick one):
| Label | When |
|---|---|
bug | Something broken |
enhancement | Feature request or improvement |
documentation | Documentation is wrong, missing, or misleading |
Secondary (optional — stack on top of primary):
| Label | When |
|---|---|
regression | Worked before, broken after an update |
performance | Memory, CPU, latency, or resource usage |
security | Vulnerability, CVE, or hardening work |
breaking-change | Fix/feature will break public API |
blocked-by-sdk | Fix requires changes in @modelcontextprotocol/sdk |
surplus-token-idea | Worth exploring when token budget allows |
Combine labels: --label "bug" --label "regression".
For long output, write to a file and attach. Note: --body-file replaces the entire body — it does not supplement a --body flag. For structured bugs with logs, either embed the log content in the Additional context section of a normal --body, or file the issue first and add the log as a comment:
bun run rebuild && bun run start:stdio 2>&1 | head -100 > /tmp/mcp-error.log
# As part of a new issue (the log becomes the entire body — no template fields)
gh issue create -R cyanheads/mcp-ts-core \
--title "bug(transport): stdio crashes on large payload" \
--label "bug" \
--assignee "@me" \
--body-file /tmp/mcp-error.log
# Or as a comment on an existing issue
gh issue comment <number> -R cyanheads/mcp-ts-core --body-file /tmp/mcp-error.loggh issue create -R cyanheads/mcp-ts-core --template "Feature Request" --webThe first three headings are the Feature Request form's own fields, in its order — Use case and Proposed API are required by the form, so a body without them does not satisfy it. Out of scope is one or two lines. Nothing else by default: a Scope, Flow, Design / Tradeoffs, or Depends on block is added only when the reader cannot act without it, and each stays to a few lines.
gh issue create -R cyanheads/mcp-ts-core \
--title "feat(scope): concise description" \
--label "enhancement" \
--assignee "@me" \
--body "$(cat <<'ISSUE'
### Use case
One or two sentences: who hits this gap in the framework and why it matters. Name the specific builder, utility, context method, or config field. Kept short on purpose — a field that invites a paragraph gets padded with background and skipped by the next reader.
Related: #N
### Proposed API
What you want the framework to do, then the API as a consumer would call it. Link external libraries on first mention: [lib name](https://github.com/owner/repo).
import { withRetry } from '@cyanheads/mcp-ts-core/utils';
const result = await withRetry(() => fetchExternal(url), { maxAttempts: 3, backoff: 'exponential', });
### Alternatives considered
What you tried or evaluated instead, and why it didn't fit.
### Out of scope
- Adjacent work that belongs in a separate issue
ISSUE
)"# Check issue status, then its comment thread (--comments without a TTY prints no body)
gh issue view <number> -R cyanheads/mcp-ts-core
gh issue view <number> -R cyanheads/mcp-ts-core --comments
# Add context or respond to maintainer questions
gh issue comment <number> -R cyanheads/mcp-ts-core --body "Additional context..."
# List your open issues
gh issue list -R cyanheads/mcp-ts-core --author @me@cyanheads/mcp-ts-core, not server codesrc/, docs/, framework-skills/, and public exports don't already cover the surfacebug / enhancement / documentation)Use case and Proposed API present (the form's required fields), Alternatives considered third; Out of scope defined~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.