mcp-tool-registration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-tool-registration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
I know the MCP tool registration conventions in this codebase.
Every tool is a const object with this shape (from src/mcp/tools/getFigmaDesignTool.ts):
export const myTool = {
name: "tool_name", // snake_case MCP name
description: "...", // brief description
parametersSchema, // Zod schema (validation + MCP input schema)
handler: myToolHandler, // async (params, figmaService, ...) => MCPResult
} as const;const parametersSchema = z.object({
fileKey: z
.string()
.regex(/^[a-zA-Z0-9]+$/, "File key must be alphanumeric")
.describe("The key of the Figma file..."),
optionalParam: z.number().optional().describe("..."),
});
export type MyToolParams = z.infer<typeof parametersSchema>;async function handler(params, figmaService, ...) {
try {
const validated = parametersSchema.parse(params);
// business logic
return { content: [{ type: "text", text: result }] };
} catch (error) {
const message = error instanceof Error ? error.message : JSON.stringify(error);
Logger.error("Context:", message);
return { isError: true, content: [{ type: "text", text: `Failed: ${message}` }] };
}
}Rules:
parametersSchema.parse(params) at entry{ content: [...] } on success{ isError: true, content: [...] } on failureLogger.error/warn/log — no raw console.errorsrc/mcp/index.ts)server.registerTool(
myTool.name,
{
title: "My Tool",
description: myTool.description,
inputSchema: myTool.parametersSchema,
annotations: { readOnlyHint: true },
},
(params) => myTool.handler(params, figmaService /* extra deps */),
);Tools that depend on configuration (e.g., skipImageDownloads) use a guard:
if (!options.skipImageDownloads) {
server.registerTool(imageFillsTool.name, { ... }, ...);
}src/mcp/tools/index.tsexport { myTool } from "./my-tool";
export type { MyToolParams } from "./my-tool";Use this when:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.