fai-mcp-php-scaffold — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fai-mcp-php-scaffold (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build MCP servers in PHP with typed handlers and Composer packaging.
mkdir my-mcp-server && cd my-mcp-server
composer init --name=org/mcp-server --type=project
composer require modelcontextprotocol/php-sdk<?php
use ModelContextProtocol\Tool;
use ModelContextProtocol\ToolResult;
class SearchDocumentsTool extends Tool
{
public function getName(): string { return 'search_documents'; }
public function getDescription(): string { return 'Search knowledge base documents'; }
public function getInputSchema(): array {
return [
'type' => 'object',
'properties' => [
'query' => ['type' => 'string', 'description' => 'Search query'],
'top_k' => ['type' => 'integer', 'description' => 'Results count', 'default' => 5],
],
'required' => ['query'],
];
}
public function execute(array $args): ToolResult {
$query = $args['query'];
$topK = $args['top_k'] ?? 5;
$results = $this->searchService->search($query, $topK);
return ToolResult::text(json_encode($results));
}
}<?php
require __DIR__ . '/vendor/autoload.php';
use ModelContextProtocol\Server;
$server = new Server('my-mcp-server', '1.0.0');
$server->addTool(new SearchDocumentsTool($searchService));
$server->serveStdio();| Issue | Cause | Fix |
|---|---|---|
| Tool not found | Not registered with addTool | Register before serveStdio() |
| JSON decode error | Invalid input schema | Validate schema matches spec |
| Memory limit | Large result sets | Paginate results, limit response size |
| Autoload fails | Composer not run | Run composer install / dump-autoload |
| Practice | Rationale |
|---|---|
| Type all tool parameters | Agent understands expected inputs |
| Write descriptive tool docstrings | Agent matches tasks to tools |
| Validate inputs before processing | Prevent injection and crashes |
| Return structured JSON strings | Consistent parsing by consumers |
| Add error messages in results | Agent can report failures to user |
| Test tools independently | Verify behavior before server integration |
| Transport | Use Case | Config |
|---|---|---|
| stdio | VS Code Copilot, Claude Desktop | Default — no setup needed |
| SSE | Web clients, remote access | Add HTTP server endpoint |
| WebSocket | Real-time bidirectional | For streaming-heavy tools |
fai-mcp-python-generator — Python MCP with FastMCPfai-mcp-typescript-generator — TypeScript MCP with SDKfai-mcp-csharp-scaffold — C# MCP with ModelContextProtocol~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.