sl-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sl-mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Sapling (sl). Gives LLMs structured access to Sapling repos with built-in safety guardrails.
claude mcp add --transport stdio sl -- npx -y sl-mcpRestart Claude Code. Verify with /mcp — you should see the sl server listed.
Add to your MCP config file (.mcp.json, claude_desktop_config.json, etc.):
{
"mcpServers": {
"sl": {
"command": "npx",
"args": ["-y", "sl-mcp"]
}
}
}22 tools across three tiers:
| Tier | Tools | Confirmation |
|---|---|---|
| Read | sl_status sl_diff sl_log sl_show sl_blame sl_cat sl_root sl_smartlog | None |
| Write | sl_goto sl_commit sl_amend sl_rebase sl_shelve sl_unshelve sl_add sl_remove sl_forget sl_revert sl_undo | Destructive ops warn LLM to confirm |
| Remote | sl_pull sl_push sl_pr_submit | Always confirm with user |
main/master is blocked server-side (not just a warning)| Env var | Default | Description |
|---|---|---|
SL_MCP_BINARY | sl | Path to Sapling binary |
SL_MCP_TIMEOUT | 30000 | Command timeout in ms |
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.