Is deploy-mcp safe to install?

SaferSkills independently audited deploy-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/deploy-mcp/SKILL.md · 1 file

.claude/skills/deploy-mcp/SKILL.md3.7 KB · Markdown

name: deploy-mcp

description: Deploy the FutureSearch MCP server to staging or production on GKE. Use when the user wants to deploy, redeploy, roll back, scale replicas, or check deployment status. Triggers on deploy, redeploy, staging, production, rollout, scale, replicas.

Deploying the MCP Server

Quick Deploy

Staging (from main)

gh workflow run "Deploy MCP Server" -f branch=main -f deploy_staging=true

Production (from main)

gh workflow run "Deploy MCP Server" -f branch=main -f deploy_production=true

Both environments

gh workflow run "Deploy MCP Server" -f branch=main -f deploy_staging=true -f deploy_production=true

From a feature branch

gh workflow run "Deploy MCP Server" -f branch=feat/my-branch -f deploy_staging=true

Monitoring a Deploy

# Watch the workflow run
gh run list --workflow="Deploy MCP Server" --limit 3
gh run watch <run-id>

# Check pod rollout
kubectl rollout status deploy/futuresearch-mcp-staging -n futuresearch-mcp-staging --timeout=5m

# Verify pods are running
kubectl get pods -n futuresearch-mcp-staging -o wide

How It Works

The GitHub Actions workflow (.github/workflows/deploy-mcp.yaml) does:

Checks — ruff lint + pytest on the target branch
Build & push — Docker image to GAR, tagged with short SHA (+ latest on main)
Deploy — Helm upgrade with layered values:

values.yaml — base config
values.staging.yaml — staging overrides (MCP_SERVER_URL, REDIS_DB, replicaCount, host)
values.secrets.staging.yaml — SOPS-decrypted secrets (Supabase, API keys)

The deploy uses --atomic so it auto-rolls back on failure.

Scaling Replicas

Via Helm values (persistent)

Edit futuresearch-mcp/deploy/chart/values.staging.yaml:

replicaCount: 2  # Change this

Commit, push, and redeploy.

Via kubectl (temporary, resets on next deploy)

# Staging
kubectl scale deploy futuresearch-mcp-staging -n futuresearch-mcp-staging --replicas=3

# Take offline
kubectl scale deploy futuresearch-mcp-staging -n futuresearch-mcp-staging --replicas=0

Environments

Environment	Namespace	Host	Redis DB
Staging	`futuresearch-mcp-staging`	`mcp-staging.futuresearch.ai`	14
Production	`futuresearch-mcp`	`mcp.futuresearch.ai`	(default in values.yaml)

Both environments hit the same production FutureSearch API — there is no staging API.

Updating Secrets

# View current secrets
sops -d futuresearch-mcp/deploy/chart/secrets.staging.enc.yaml

# Update a value
sops --set '["secrets"]["data"]["KEY_NAME"] "new-value"' futuresearch-mcp/deploy/chart/secrets.staging.enc.yaml

Commit the encrypted file and redeploy.

Key Files

File	Purpose
`.github/workflows/deploy-mcp.yaml`	CI/CD workflow (checks → build → deploy)
`futuresearch-mcp/deploy/chart/values.yaml`	Base Helm values
`futuresearch-mcp/deploy/chart/values.staging.yaml`	Staging overrides
`futuresearch-mcp/deploy/chart/secrets.enc.yaml`	Production secrets (SOPS)
`futuresearch-mcp/deploy/chart/secrets.staging.enc.yaml`	Staging secrets (SOPS)
`futuresearch-mcp/deploy/Dockerfile`	Server container image

Gotchas

Branch protection on main: Can't push directly — create a PR and merge first, then deploy from main.
SOPS decryption requires GCP IAM: Run gcloud auth application-default login if decryption fails.
Concurrent deploys: Workflow uses cancel-in-progress: false — if a deploy is running, the next one queues.
Atomic rollback: --atomic means a failed deploy auto-reverts to the previous release. Check helm history if this happens.

deploy-mcp— agent skill

Is deploy-mcp safe to install?

Deploying the MCP Server

Quick Deploy

Staging (from main)

Production (from main)

Both environments

From a feature branch

Monitoring a Deploy

How It Works

Scaling Replicas

Via Helm values (persistent)

Via kubectl (temporary, resets on next deploy)

Environments

Updating Secrets

Key Files

Gotchas

Audit the pieces. Scan the whole. Decide.