polish-docs-meta — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited polish-docs-meta (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
bun run devcheck passes, tests passPrefer running after implementation is complete, but safe to re-run at any point — steps are idempotent.
bun run devcheck passesnpm test)If these aren't met, address them first.
Read all tool, resource, and prompt definitions. Build a mental model of what the server actually does — names, descriptions, input/output shapes, auth scopes. This inventory drives every document below.
Read:
src/index.ts (what's registered in createApp())src/mcp-server/tools/definitions/src/mcp-server/resources/definitions/src/mcp-server/prompts/definitions/src/services/ (if any)src/config/server-config.ts (if any)Capture: tool count, resource count, prompt count, service count, required env vars.
Read references/readme.md for structure and conventions. If README.md doesn't exist, create it from scratch. If it exists, diff the current content against the audit — update tool/resource/prompt tables, env var lists, and descriptions to match the actual surface area. Don't rewrite sections that are already accurate.
Update the project's agent protocol file to reflect the actual server.
Read references/agent-protocol.md for the full update checklist, then review the current file and address what's stale or missing:
searchItems, itemData), replace with real definitions from this serverpackage.json, update the commands table.env.exampleCompare .env.example against the server config Zod schema. Add any missing server-specific vars with a comment and default (if any). Remove vars for features that no longer exist. Group by category. Preserve existing framework vars that are still relevant.
package.json MetadataCheck for empty or placeholder metadata fields. Read references/package-meta.md for which fields matter and why. Fill in anything still missing — skip fields that are already correct.
Key fields: description, repository, author, homepage, bugs, keywords.
server.jsonRead references/server-json.md for the official MCP server manifest schema. If server.json doesn't exist, create it from the surface area audit. If it exists, diff against current state and update stale fields.
Key sync points:
$schema set to https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.jsonname matches mcpName from package.json (reverse-domain: io.github.{owner}/{repo})version matches package.json version (in all three places: top-level + each package entry)description matches package.json descriptionenvironmentVariables reflect the server config Zod schema — server-specific required vars in both entries, transport vars only in HTTP entrybunfig.tomlVerify a bunfig.toml exists at the project root. If not, create one:
[install]
auto = "fallback"
frozenLockfile = false
[run]
bun = trueCHANGELOG.mdIf CHANGELOG.md doesn't exist, create it with an initial entry. If it exists, verify the latest entry reflects the current state:
# Changelog
## 0.1.0 — YYYY-MM-DD
Initial release.
### Added
- [list tools, resources, prompts, key capabilities]Use a concrete version and date. Never [Unreleased].
LICENSEConfirm a license file exists. If not, ask the user which license to use (default: Apache-2.0, matching the scaffolded package.json). Create the file.
DockerfileIf a Dockerfile exists, verify the OCI labels and runtime config match the actual server:
org.opencontainers.image.title matches the package nameorg.opencontainers.image.description is filled in (not empty placeholder)org.opencontainers.image.source points to the real repository URL (add if missing)mkdir and LOGS_DIR uses the correct server nameIf no Dockerfile exists and the server is deployed via HTTP transport, consider scaffolding one — the template is available via npx @cyanheads/mcp-ts-core init.
docs/tree.mdRegenerate the directory structure:
bun run treeReview the output for anything unexpected (leftover files, missing directories).
Run the full check suite one last time:
bun run devcheck
npm testBoth must pass clean.
README.md accurate — tool/resource tables, config, descriptions match actual code.env.example in sync with server config schemapackage.json metadata complete (description, mcpName, repository, author, keywords, engines, packageManager)server.json matches official MCP schema, versions synced, env vars currentbunfig.toml presentCHANGELOG.md exists with current entryLICENSE file presentDockerfile OCI labels and runtime config accurate (if present)docs/tree.md regeneratedbun run devcheck passesnpm test passes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.