Decimermcpserver — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Decimermcpserver (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
mcp-name: io.github.DocMinus/decimer-mcp-server
MCP server that exposes DECIMER image-to-SMILES functionality as tool calls.
This project is a thin adapter over the existing FastAPI service in DecimerServerAPI. It does not run DECIMER models directly. The adapter sends JSON requests by default, with automatic fallback to form payloads for compatibility.
server_health: Checks whether the DECIMER FastAPI server is reachable.analyze_chemical_image: Sends a base64-encoded image to /image2smiles/ and returns structured output.http://localhost:8099)find it at either of these two versions:
cd /Users/a/dev/DecimerMCPServer
uv venv
uv syncCopy .env.example values into your environment:
DECIMER_API_BASE_URL (default http://localhost:8099)DECIMER_API_TIMEOUT_SECONDS (default 60)DECIMER_MAX_IMAGE_BYTES (default 10000000)DECIMER_MCP_LOG_LEVEL (default INFO)uv run decimer-mcp-serveror
uv run python -m decimer_mcp_server{
"mcpServers": {
"decimer": {
"command": "uv",
"args": ["run", "python", "-m", "decimer_mcp_server"],
"env": {
"DECIMER_API_BASE_URL": "http://localhost:8099"
}
}
}
}analyze_chemical_image returns:
{
"ok": true,
"smiles": "CCO",
"reason": null,
"api_status_code": 200,
"api_message": null,
"classifier_score": 0.0000012,
"classifier_threshold": 0.3,
"classifier_decision": "structure_like"
}When no SMILES is returned by API classifier behavior:
{
"ok": true,
"smiles": null,
"reason": "not_chemical_structure",
"api_status_code": 200,
"api_message": "No SMILES returned by API",
"classifier_score": 0.99999,
"classifier_threshold": 0.3,
"classifier_decision": "not_structure_like"
}uv sync --extra dev
uv run pytestMake targets:
make sync
make testRun one health check + one inference call against your DECIMER API:
cd /Users/a/dev/DecimerMCPServer
DECIMER_API_BASE_URL=http://chitchat:8099 uv run decimer-mcp-smoke-test --image /Users/a/dev/DecimerServerAPI/example_usage/structure.pngIf you keep settings in .env, load it with:
uv run --env-file .env decimer-mcp-smoke-test --image /Users/a/dev/DecimerServerAPI/example_usage/structure.pngor use make:
make smokeOverride the image path if needed:
make smoke SMOKE_IMAGE=/absolute/path/to/image.png
## MCP Registry publishing
Tags matching `v*` trigger `.github/workflows/publish-mcp.yml`.
Workflow steps:
- installs `mcp-publisher`
- validates `server.json`
- calls registry publish using secret `MCP_REGISTRY_TOKEN`
- publishes slug `io.github.DocMinus/decimer-mcp-server` (case sensitive; must match registry grant)
Before tagging:
1. Update `pyproject.toml` + `server.json` versions
2. Ensure `server.json` stays valid (`uv pip install jsonschema && python validate snippet from AGENTS.md`)
3. Add GitHub repo secret `MCP_REGISTRY_TOKEN` (GitHub PAT with `repo`, `workflow` scopes)
Release flow:git tag v0.1.1 git push origin v0.1.1
Monitor Actions tab. If publish fails, rerun using workflow dispatch after fixing issues.This project was built by DocMinus with AI-assisted coding support (OpenCode/Copilot-style tooling), then reviewed and tested by the author.
make test) and smoke tests (make smoke) before release.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.