fai-mcp-java-scaffold — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fai-mcp-java-scaffold (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build MCP servers in Java with Spring Boot and typed tool definitions.
<dependency>
<groupId>io.modelcontextprotocol</groupId>
<artifactId>mcp-spring-boot-starter</artifactId>
<version>0.9.0</version>
</dependency>import io.modelcontextprotocol.annotation.McpTool;
import io.modelcontextprotocol.annotation.McpParam;
import org.springframework.stereotype.Component;
@Component
public class SearchTools {
@McpTool(name = "search_documents",
description = "Search knowledge base documents by query")
public String searchDocuments(
@McpParam(name = "query", required = true,
description = "Search query text") String query,
@McpParam(name = "top_k",
description = "Number of results") Integer topK) {
if (topK == null) topK = 5;
var results = searchService.search(query, topK);
return objectMapper.writeValueAsString(results);
}
}# application.yml
mcp:
server:
name: my-mcp-server
version: 1.0.0
transport: stdio@SpringBootApplication
public class McpServerApplication {
public static void main(String[] args) {
SpringApplication.run(McpServerApplication.class, args);
}
}| Issue | Cause | Fix |
|---|---|---|
| Tool not registered | Missing @Component | Add @Component to tool class |
| Serialization error | Complex return type | Return String (serialize manually) |
| Slow startup | Full Spring context | Use Spring Boot 3.x with AOT |
| Classpath conflict | Dependency version mismatch | Check BOM alignment |
| Practice | Rationale |
|---|---|
| Type all tool parameters | Agent understands expected inputs |
| Write descriptive tool docstrings | Agent matches tasks to tools |
| Validate inputs before processing | Prevent injection and crashes |
| Return structured JSON strings | Consistent parsing by consumers |
| Add error messages in results | Agent can report failures to user |
| Test tools independently | Verify behavior before server integration |
| Transport | Use Case | Config |
|---|---|---|
| stdio | VS Code Copilot, Claude Desktop | Default — no setup needed |
| SSE | Web clients, remote access | Add HTTP server endpoint |
| WebSocket | Real-time bidirectional | For streaming-heavy tools |
fai-mcp-python-generator — Python MCP with FastMCPfai-mcp-typescript-generator — TypeScript MCP with SDKfai-mcp-csharp-scaffold — C# MCP with ModelContextProtocol~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.