fai-mcp-kotlin-scaffold — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fai-mcp-kotlin-scaffold (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build MCP servers in Kotlin with coroutines and typed tool definitions.
// build.gradle.kts
dependencies {
implementation("io.modelcontextprotocol:mcp-kotlin:0.9.0")
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0")
implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.3")
}import io.modelcontextprotocol.kotlin.*
import kotlinx.serialization.Serializable
import kotlinx.serialization.json.Json
@Serializable
data class SearchResult(val id: String, val title: String, val score: Double)
val searchTool = Tool(
name = "search_documents",
description = "Search knowledge base documents by query",
parameters = listOf(
Parameter("query", ParameterType.STRING, required = true,
description = "Search query text"),
Parameter("top_k", ParameterType.NUMBER,
description = "Number of results to return"),
)
)
suspend fun handleSearch(args: Map<String, Any?>): String {
val query = args["query"] as String
val topK = (args["top_k"] as? Number)?.toInt() ?: 5
val results = searchService.search(query, topK)
return Json.encodeToString(results)
}fun main() = runBlocking {
val server = McpServer("my-mcp-server", "1.0.0")
server.addTool(searchTool, ::handleSearch)
server.serveStdio()
}| Issue | Cause | Fix |
|---|---|---|
| Coroutine scope leak | Missing structured concurrency | Use coroutineScope or supervisorScope |
| Serialization error | Missing @Serializable | Add annotation to data classes |
| Gradle resolution fail | Wrong Kotlin version | Align kotlin-stdlib with plugin version |
| Practice | Rationale |
|---|---|
| Type all tool parameters | Agent understands expected inputs |
| Write descriptive tool docstrings | Agent matches tasks to tools |
| Validate inputs before processing | Prevent injection and crashes |
| Return structured JSON strings | Consistent parsing by consumers |
| Add error messages in results | Agent can report failures to user |
| Test tools independently | Verify behavior before server integration |
| Transport | Use Case | Config |
|---|---|---|
| stdio | VS Code Copilot, Claude Desktop | Default — no setup needed |
| SSE | Web clients, remote access | Add HTTP server endpoint |
| WebSocket | Real-time bidirectional | For streaming-heavy tools |
fai-mcp-python-generator — Python MCP with FastMCPfai-mcp-typescript-generator — TypeScript MCP with SDKfai-mcp-csharp-scaffold — C# MCP with ModelContextProtocol~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.