livepilot-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited livepilot-release (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run this checklist EVERY time the user says "update everything", "push", "release", "make sure everything is current", or similar.
package.json → "version"package-lock.json → "version" (run npm install --package-lock-only if stale)server.json → "version" (TWO locations: top-level and package)livepilot/.Codex-plugin/plugin.json → "version" (primary Codex manifest)livepilot/.claude-plugin/plugin.json → "version" (must match Codex plugin).claude-plugin/marketplace.json → "version" in plugins arraymcp_server/__init__.py → __version__remote_script/LivePilot/__init__.py → __version__ (log message auto-uses it)m4l_device/livepilot_bridge.js → version in ping responseCLAUDE.md → header linelivepilot/skills/livepilot-core/references/overview.md → header lineCHANGELOG.md → latest version headerdocs/assets/banner-dark.svg and docs/assets/banner-light.svg → current tool/domain displaydocs/M4L_BRIDGE.md → ping response exampleHow to check: grep -rn "1\.[0-9]\.[0-9]" package.json server.json livepilot/.Codex-plugin/plugin.json livepilot/.claude-plugin/plugin.json .claude-plugin/marketplace.json mcp_server/__init__.py remote_script/LivePilot/__init__.py m4l_device/livepilot_bridge.js CHANGELOG.md CLAUDE.md livepilot/skills/livepilot-core/references/overview.md docs/M4L_BRIDGE.md
Current: 467 tools across 56 domains. Spectral/analyzer (bridge-only): 38. The remaining tool surface works without the bridge or degrades gracefully. Backed by 32 bridge commands.
Verify: grep -rc "@mcp.tool" mcp_server/tools/ | grep -v ":0" | awk -F: '{sum+=$2} END{print sum}'
Files that reference tool count:
README.md — header ("467 tools. 56 domains"), bridge section ("38 spectral/analyzer tools require bridge")package.json → "description"server.json → "description"manifest.json → "description"livepilot/.Codex-plugin/plugin.json → "description" (primary Codex manifest)livepilot/.claude-plugin/plugin.json → "description" (must match Codex plugin).claude-plugin/marketplace.json → "description"CLAUDE.md → "467 tools across 56 domains"CONTRIBUTING.md → tool count in introlivepilot/skills/livepilot-core/SKILL.md — tool/domain countlivepilot/skills/livepilot-core/references/overview.md — tool/domain countdocs/manual/index.md — domain table with correct per-domain countsdocs/manual/getting-started.md — bridge copy (avoid hard numeric core/bridge split — use "38 spectral tools require bridge")docs/manual/tool-reference.md — all domains present with correct countsdocs/manual/tool-catalog.md — auto-regenerated by python3 scripts/sync_metadata.py --fix(raw generator is python3 scripts/generate_tool_catalog.py > docs/manual/tool-catalog.md, but you should never need to call it directly — --fix invokes it at the end of the chain after the count bumps so the catalog stays coherent with the live mcp.list_tools() registry)
docs/M4L_BRIDGE.md — bridge copy (avoid hard numeric core/bridge split — use "38 spectral tools require bridge")docs/assets/banner-dark.svg and docs/assets/banner-light.svgtests/test_tools_contract.py → expected total counttests/test_skill_contracts.py → catalog sync test passesHow to check: grep -rn "168\|139\|135\|127\|115\|107" --include="*.md" --include="*.json" --include="*.py" --include="*.html" . | grep -v node_modules | grep -v .git | grep -v __pycache__ | grep -v CHANGELOG
Current: 56 domains: transport, tracks, clips, notes, devices, scenes, mixing, browser, arrangement, memory, analyzer, automation, theory, generative, harmony, midi_io, perception, agent_os, composition, motif, research, planner, project_brain, runtime, evaluation, mix_engine, sound_design, transition_engine, reference_engine, translation_engine, performance_engine, song_brain, preview_studio, hook_hunter, stuckness_detector, wonder_mode, session_continuity, creative_constraints, device_forge, sample_engine, atlas, composer, experiment, musical_intelligence, semantic_moves, diagnostics, follow_actions, grooves, scales, take_lanes, miditool, synthesis_brain, creative_director, user_corpus, audit, grader.
npm view livepilot version matches local versionnpm publishgh repo edit dreamrec/LivePilot --description "...")gh release list)Draft. If a tag was deleted-then-recreated during release recovery (e.g., to move the tag to a fix commit), GitHub silently demotes the attached release to Draft AND clears its Latest flag. The release object survives (asset + body preserved) but the public-facing "what's the latest version" badge stays on the prior release. Fix in one call: gh release edit v${VERSION} --draft=false --latestThis trap caught v1.18.0-era recovery and the v1.25.0 .amxd-freeze fix recovery. Always re-verify after a tag-recreate flow.
python3 scripts/verify_codex_plugin_sync.py passes after npx livepilot --install-codex-pluginpython3 scripts/verify_plugin_sync.py passes after Claude plugin cache/mirror sync~/.claude/plugins/cache/dreamrec-LivePilot/livepilot/ has current version directory~/.claude/plugins/installed_plugins.json → livepilot@dreamrec-LivePilot entry: update version, installPath, gitCommitSha, lastUpdateddocs/assets/banner-dark.svg and docs/assets/banner-light.svg — tool count and domain listREADME.md — features match current capabilities, "Coming" section is accuratedocs/manual/getting-started.md — install instructions currentdocs/manual/tool-reference.md — all 56 domains listed, all 467 tools presentdocs/M4L_BRIDGE.md — architecture accurate, core/bridge counts correctm4l_device/LivePilot_Analyzer.amxd — frozen JS matches source? All commands present?livepilot_bridge.js changed → amxd needs rebuilding in Max editordist/livepilot-${VERSION}.mcpb — MCPB bundle for Claude Desktop one-click install.REQUIRED for every release — the README's "Easiest: Claude Desktop Extension (1 click)" path points at this asset. From v1.17 through v1.20.2 every release silently shipped without it; v1.20.3+ MUST attach the bundle to the GitHub release.
# Build (produces dist/livepilot-${VERSION}.mcpb — versioned, in dist/, ~4-5 MB)
bash scripts/build_mcpb.sh
# Attach to the release (run after `gh release create`)
VERSION=$(python3 -c "import json; print(json.load(open('manifest.json'))['version'])")
gh release upload "v${VERSION}" "dist/livepilot-${VERSION}.mcpb" --clobberThe script stages manifest.json + bin/livepilot.js + mcp_server/ + remote_script/ + m4l_device/ + installer/ + requirements.txt, strips __pycache__/*.pyc/.DS_Store, zips into dist/, and verifies the embedded manifest name+version+entry_point.
@mcp.tool() count matches documented tool count: grep -r "@mcp.tool" mcp_server/tools/ | wc -lpython3 -m pytest tests/ -vpython scripts/sync_metadata.py --check — all metadata in syncpython -m pytest tests/test_command_boundary_audit.py — no invalid TCP targetspython -m pytest tests/test_move_annotations.py — all moves annotatedpython -m pytest tests/test_capability.py — capability contract workspython -m pytest tests/test_capability_probe.py — doctor probe worksdocs/archive/release-smoke-board-v1.10-era.md scenariosagainst a real Ableton session (archived — still a useful pre-flight checklist even if written against v1.10 tool surface)
echo "=== Versions ===" && grep -h '"version"' package.json server.json manifest.json livepilot/.Codex-plugin/plugin.json livepilot/.claude-plugin/plugin.json .claude-plugin/marketplace.json | head -8 && grep __version__ mcp_server/__init__.py remote_script/LivePilot/__init__.py && echo "=== Metadata ===" && python3 scripts/sync_metadata.py --check && echo "=== Plugin sync ===" && python3 scripts/verify_codex_plugin_sync.py --quiet && python3 scripts/verify_plugin_sync.py --quiet && echo "=== Tests ===" && python3 -m pytest tests/ -q 2>&1 | tail -1~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.