report-issue-local — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited report-issue-local (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
The bug is in this server's code, not in @cyanheads/mcp-ts-core. Typical triggers:
server-config.ts) rejects valid env vars or has wrong defaults.describe() on schema fields causing poor LLM tool useIf the issue is in the framework itself (builders, Context, utilities, type exports, linter), use report-issue-framework instead.
For general gh CLI workflows outside issue filing (PRs, workflows, API access), see the github-cli skill.
gh repo view --json nameWithOwner -q '.nameWithOwner'gh issue list --search "your error message or keyword" --state all
# Assess a close match before commenting — is it already linked to a fix or referenced elsewhere?
gh issue view <number> # body
gh issue view <number> --comments # thread only — without a TTY it prints no body
gh api 'repos/{owner}/{repo}/issues/<number>/timeline' --paginate \
--jq '.[] | select(.event=="cross-referenced") | .source.issue | "\(.repository.full_name)#\(.number) — \(.title)"'ctx.log output and any framework telemetry for clues. If running HTTP, check the response body for structured error details.Good issues are terse and fact-dense. Budget: a bug reads in ~150 words, a feature in ~250, code and logs excluded. Every section past the form's required fields must earn its place — a section you could delete without changing the fix is noise. One or two sentences per bullet; if a bullet runs long, split it or cut it.
search_docs returns an empty array for queries containing &" beats "Search is broken." A reader should know what's wrong before the end of the first sentence.[Hono](https://hono.dev/), [Supabase](https://supabase.com/). Link to the canonical repo or homepage so readers can verify the dependency and reach docs in one click.cyanheads/mcp-ts-core#46). Bare #N only works for same-repo issues — useful when the bug depends on or relates to a framework issue.Related:, the description, or Additional context — not all three. The reader sees them all; redundant linking dilutes signal.GitHub issues are public. Do not include secrets, credentials, API keys, or tokens. Redact sensitive values from env vars, headers, and logs before submitting. Replace with obvious placeholders: REDACTED, sk-...REDACTED. Do not rely on partial masking — partial keys can still be exploited.
This repo includes YAML form issue templates (scaffolded from the framework). Use --web to open the form in the browser (preferred when available), or pass --title + --body for non-interactive use.
gh issue create --template "Bug Report" --webStructure the --body to match the template's form fields. Environment is the form's one-row table: the server version from package.json, the installed mcp-ts-core version from node_modules/@cyanheads/mcp-ts-core/package.json (not the ^ range), the runtime with its version (bun --version), the transport, and the OS. Description is two or three sentences; the reproduction is the exact input and the observed output, nothing else. Add ### Additional context only when it changes the fix (a workaround, a related issue, the one log line that matters) — omitted by default.
gh issue create \
--title "bug(tool_name): concise description" \
--label "bug" \
--assignee "@me" \
--body "$(cat <<'ISSUE'
### Environment
| Server | mcp-ts-core | Runtime | Transport | OS |
|---|---|---|---|---|
| 0.4.2 | 0.13.16 | Bun 1.4.4 | stdio | macOS 15.x |
### Description
What happened and what you expected instead.
### Steps to reproduce
1. Call `tool_name` with input: `{ "key": "value" }`
2. Observe error / wrong output
### Actual behavior
Error or incorrect output here
### Expected behavior
What should have happened.
ISSUE
)"Format: type(scope): description
bug, feat, docs, choreconfig, auth, or domain areaExamples:
bug(search_docs): returns empty results for queries with special charactersfeat(analytics): add date range filter to usage_report tooldocs(setup): .env.example missing REDIS_URLEvery issue needs exactly one primary label. Stack secondary labels on top when applicable.
Primary (required — pick one):
| Label | When |
|---|---|
bug | Something broken |
enhancement | New feature or improvement |
documentation | Documentation is wrong, missing, or misleading |
Secondary (optional — stack on top of primary):
| Label | When |
|---|---|
regression | Worked before, broken after a change |
performance | Memory, CPU, latency, or resource usage |
security | Vulnerability, CVE, or hardening work |
breaking-change | Change will break public API or an existing tool contract |
blocked-by-framework | Fix requires a released change in @cyanheads/mcp-ts-core; pairs with a Depends on: cyanheads/mcp-ts-core#N line in the body |
blocked-by-sdk | Fix requires changes in @modelcontextprotocol/sdk |
surplus-token-idea | Worth exploring when token budget allows |
blocked-by-framework comes off when this server adopts the release that ships the fix. An issue blocked on the SDK through the framework takes blocked-by-framework, not blocked-by-sdk — the server's own unblock is still a framework release.
Combine labels: --label "bug" --label "regression".
Secondary labels are not GitHub defaults — if gh issue create --label "regression" fails with label not found, create it once:
gh label create regression --color e99695 --description "Worked before, broken after a change"
gh label create performance --color 5319e7 --description "Memory, CPU, latency, or resource usage"
gh label create security --color b60205 --description "Vulnerability, CVE, or hardening work"
gh label create breaking-change --color d93f0b --description "Change will break public API or an existing tool contract"
gh label create blocked-by-framework --color fbca04 --description "Fix requires a released change in @cyanheads/mcp-ts-core"
gh label create blocked-by-sdk --color c5def5 --description "Fix requires changes in @modelcontextprotocol/sdk"
gh label create surplus-token-idea --color FF10F0 --description "Worth exploring when token budget allows"Note: --body-file replaces the entire body — it does not supplement a --body flag. For structured bugs with logs, either embed the log content in the Additional context section of a normal --body, or file the issue first and add the log as a comment:
bun run rebuild && bun run start:stdio 2>&1 | head -200 > /tmp/server-error.log
# As part of a new issue (the log becomes the entire body — no template fields)
gh issue create \
--title "bug(ingest): crashes on large payload" \
--label "bug" \
--assignee "@me" \
--body-file /tmp/server-error.log
# Or as a comment on an existing issue (preferred — keeps the structured body intact)
gh issue comment <number> --body-file /tmp/server-error.loggh issue create --template "Feature Request" --webRead .github/ISSUE_TEMPLATE/feature_request.yml and match its field labels and order. The default form requires Use case and Proposed behavior; Alternatives considered and Additional context are optional. Include an optional section only when it changes what the reader needs to do. Scope boundaries belong in Additional context when necessary, not in a mandatory extra heading.
gh issue create \
--title "feat(scope): concise description" \
--label "enhancement" \
--assignee "@me" \
--body "$(cat <<'ISSUE'
### Use case
One or two sentences: who hits this gap and why it matters. Name the specific tool, service, resource, or domain area. Kept short on purpose — a field that invites a paragraph gets padded with background and skipped by the next reader.
Related: #N
### Proposed behavior
What you want the server to do, then the new behavior or surface. For tool/resource changes, show example input/output or the new schema fields. Link external libraries or services on first mention: [lib name](https://github.com/owner/repo).
// Example: new input field or output shape
### Alternatives considered
What you tried or evaluated instead, and why it didn't fit.
### Additional context
Only context needed to act, such as a relevant dependency or a scope boundary. Omit this section when it adds nothing.
ISSUE
)"Not sure where the bug lives? Quick checks:
| Signal | Likely framework | Likely server |
|---|---|---|
Error originates in node_modules/@cyanheads/mcp-ts-core/ | Yes | |
Error in src/mcp-server/tools/ or src/services/ | Yes | |
Same bug reproduces with a bare tool() definition (no services) | Yes | |
| Bug disappears when you swap in a dummy handler | Yes | |
ctx.state, ctx.log, ctx.inputs behave wrong on any tool | Yes | |
| Only one specific tool/resource is affected | Yes |
When genuinely ambiguous, file against this server's repo and note that it might be a framework issue. The maintainer can transfer it upstream.
# View the issue body, then its comment thread (--comments without a TTY prints no body)
gh issue view <number>
gh issue view <number> --comments
# Add context
gh issue comment <number> --body "Additional findings..."
# List your open issues
gh issue list --author @me
# Close if resolved
gh issue close <number> --reason completed --comment "Fixed in <commit or PR>"type(scope): description formatbug / enhancement / documentation)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.