add-resource — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-resource (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Resources use the resource() builder from @cyanheads/mcp-ts-core. Each resource lives in src/mcp-server/resources/definitions/ with a .resource.ts suffix and is registered in the barrel index.ts.
For the full resource() API, pagination utilities, and Context interface, read:
node_modules/@cyanheads/mcp-ts-core/CLAUDE.md
{paramName} for path parameters (e.g., myscheme://{itemId}/data)src/mcp-server/resources/definitions/{{resource-name}}.resource.tssrc/mcp-server/resources/definitions/index.tsbun run dev:stdio or dev:http/**
* @fileoverview {{RESOURCE_DESCRIPTION}}
* @module mcp-server/resources/definitions/{{RESOURCE_NAME}}
*/
import { resource, z } from '@cyanheads/mcp-ts-core';
export const {{RESOURCE_EXPORT}} = resource('{{scheme}}://{{{paramName}}}/data', {
description: '{{RESOURCE_DESCRIPTION}}',
mimeType: 'application/json',
params: z.object({
{{paramName}}: z.string().describe('{{PARAM_DESCRIPTION}}'),
}),
// auth: ['resource:{{resource_name}}:read'],
async handler(params, ctx) {
ctx.log.debug('Fetching resource', { {{paramName}}: params.{{paramName}} });
// Pure logic — throw on failure, no try/catch
return { /* resource data */ };
},
list: async (extra) => ({
resources: [
{
uri: '{{scheme}}://all',
name: '{{RESOURCE_LIST_NAME}}',
mimeType: 'application/json',
},
],
}),
});For resources that return large result sets, include cursor in the URI template params and use opaque cursor pagination in the handler. The cursor arrives as a validated URI param. paginateArray requires a RequestContext for logging — create one from requestContextService:
import { extractCursor, paginateArray, requestContextService } from '@cyanheads/mcp-ts-core/utils';
// URI template: '{{scheme}}://{{{paramName}}}/items'
params: z.object({
{{paramName}}: z.string().describe('{{PARAM_DESCRIPTION}}'),
cursor: z.string().optional().describe('Opaque pagination cursor'),
}),
async handler(params, ctx) {
const allItems = await fetchAllItems(params.{{paramName}});
const cursor = extractCursor({ cursor: params.cursor });
const reqCtx = requestContextService.createRequestContext({
operation: 'list-{{paramName}}',
parentContext: { requestId: ctx.requestId, traceId: ctx.traceId },
});
const page = paginateArray(allItems, cursor, 20, 100, reqCtx);
return {
items: page.items,
nextCursor: page.nextCursor,
};
},// src/mcp-server/resources/definitions/index.ts
import { {{RESOURCE_EXPORT}} } from './{{resource-name}}.resource.js';
export const allResourceDefinitions = [
// ... existing resources
{{RESOURCE_EXPORT}},
];src/mcp-server/resources/definitions/{{resource-name}}.resource.ts{paramName} syntax for path parametersparams fields have .describe() annotations@fileoverview and @module header presenthandler(params, ctx) is pure — throws on failure, no try/catchlist() function provided if the resource is discoverableextractCursor/paginateArray)definitions/index.ts barrel and allResourceDefinitionsbun run devcheck passesbun run dev:stdio or dev:http~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.