setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill assumes @cyanheads/mcp-ts-core init has already run. The CLI created the project's CLAUDE.md and AGENTS.md (identical content), copied external skills to skills/, and scaffolded the directory structure with echo definitions as starting points. This skill covers what was created and what to do next.
The init CLI generates both CLAUDE.md and AGENTS.md with identical content. Keep the one your agent uses, discard the other:
CLAUDE.md, discard AGENTS.mdAGENTS.md, discard CLAUDE.mdBoth files serve the same purpose: project-specific agent instructions. Only one should exist in the committed project.
For the full framework API, read:
node_modules/@cyanheads/mcp-ts-core/CLAUDE.md
Read that file once per session. It contains the exports catalog, tool/resource/prompt contracts, error codes, context API, and common import patterns.
What init actually creates:
CLAUDE.md # Agent protocol (project-specific)
AGENTS.md # Same content — discard whichever you don't use
skills/ # Project skills (source of truth)
src/
index.ts # createApp() entry point
mcp-server/
tools/definitions/
echo.tool.ts # Echo tool (starter — replace when ready)
resources/definitions/
echo.resource.ts # Echo resource (starter — replace when ready)
prompts/definitions/
echo.prompt.ts # Echo prompt (starter — replace when ready)Add these as needed:
src/
worker.ts # createWorkerHandler() — only for Cloudflare Workers
config/
server-config.ts # Server-specific env vars (own Zod schema)
services/
[domain]/
[domain]-service.ts # Init/accessor pattern
types.tsThe init creates echo definitions for tools, resources, and prompts. They're functional examples with inline comments explaining conventions. After init:
src/index.ts can go. Same for resources.src/index.ts. No barrel files, just import and add to the arrays.| Convention | Rule |
|---|---|
| File names | kebab-case |
| Tool/resource/prompt names | snake_case, prefixed with server name (e.g. tasks_fetch_list) |
| File suffixes | .tool.ts, .resource.ts, .prompt.ts |
| Imports (framework) | @cyanheads/mcp-ts-core and subpaths |
| Imports (server code) | @/ path alias for src/ |
Copy all project skills into your agent's skill directory so they're available as context. skills/ is the source of truth.
For Claude Code:
mkdir -p .claude/skills && cp -R skills/* .claude/skills/For other agents (Codex, Cursor, Windsurf, etc.) — copy to the equivalent directory (e.g., .codex/skills/, .cursor/skills/).
After the initial copy, use the maintenance skill to keep them in sync after package updates.
After installing dependencies (npm install, or bun install if using Bun), complete these one-time setup tasks:
npx npm-check-updates -u && npm install (or bun update --latest if using Bun). The scaffolded package.json pins minimum versions from when the framework was published; updating ensures you start with the latest compatible releases.git init && git add -A && git commit -m "chore: scaffold from @cyanheads/mcp-ts-core"init CLI was run without a [name] argument, {{PACKAGE_NAME}} may remain as a literal in CLAUDE.md/AGENTS.md and package.json. Replace it with the actual server name.CLAUDE.md or AGENTS.md, discard the other{{PACKAGE_NAME}} placeholders replaced in agent protocol file (if not auto-substituted by init)node_modules/@cyanheads/mcp-ts-core/CLAUDE.md)src/index.ts)cp -R skills/* .claude/skills/ or equivalent)npm run devcheck passesdesign-mcp-server skill to plan the tool surface~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.