codex-osf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex-osf (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Go command-line client for the Open Science Framework (OSF).
osf auth whoami — Identify the authenticated OSF accountosf auth login — Guided personal-access-token bootstrap for username/password usersosf projects list|get — List and inspect projectsosf components list — List project componentsosf files list|download|upload|mkdir|rm — Browse, download, upload, create folders, and delete OSF Storage filesosf search and osf preprints list — Search OSF and list preprintsosf registrations create — Create draft registrations for an existing nodeosf export — Export a node snapshot as JSON or a summary tableosf-mcp — Stdio MCP server exposing read-only OSF tools for agent clientsosf completion bash|zsh|fish|powershell — Shell completion scriptsRequirements:
go install github.com/edithatogo/osf-cli-go/cmd/osf@latest
go install github.com/edithatogo/osf-cli-go/cmd/osf-mcp@latestOr from a local checkout:
go build -o bin\osf.exe ./cmd/osf
go build -o bin\osf-mcp.exe ./cmd/osf-mcp
.\scripts\build.ps1Set OSF_TOKEN in your shell session. Do not commit the token or write it into project files. OSF_USERNAME and OSF_PASSWORD are supported as an opt-in fallback credential source, but personal access tokens remain preferred for automation and for accounts using SSO or two-factor authentication.
$env:OSF_TOKEN = '<your-token>'For guided token setup:
osf auth loginosf --help
osf auth whoami
osf projects list
osf projects get https://osf.io/abc12/
osf components list abc12
osf files list abc12
osf files download --file <file-id> ./output/
osf files download --tree abc12 ./output/
osf files upload --node abc12 ./report.pdf
osf search "open science"
osf preprints list
osf registrations create abc12 --schema <schema-id> --title "Analysis plan"
osf export abc12 --jsonosf-mcp runs a stdio MCP server with read-only tools: osf_whoami, osf_projects_list, osf_project_get, osf_components_list, osf_files_list, and osf_contributors_list.
Local development configs are included for GitHub Copilot, VS Code, Claude, Codex, Gemini CLI, and Qwen Code. Public registry metadata is in server.json and registry/.
All commands support --output table|json and --json shorthand:
osf projects list --json
osf auth whoami --output jsonThe CLI is offline-tested for read-only operations, file downloads, WaterButler write primitives, search, preprint listing, draft registration creation, project create/update/delete operations, and node export. All Conductor tracks are reconciled against their per-track plans with closeout review evidence; live OSF validation remains opt-in because it requires credentials and network access.
Apache 2.0 — see LICENSE.
If you use this software in your research, please cite it using the metadata in CITATION.cff.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.