gitwhy-context-saving — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gitwhy-context-saving (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Save, retrieve, and share the reasoning behind AI-generated code — tied to commits.
Workflows: See WORKFLOWS.md for when/how to save, retrieve, and push. Troubleshooting: See TROUBLESHOOTING.md for common errors and diagnostics.
GitWhy works via MCP tools (if available) or CLI commands (always available). Both are equivalent — use whichever works in your environment.
| MCP Tool | CLI Command | Purpose |
|---|---|---|
gitwhy_status | git why log | Check saved contexts and pending commits |
gitwhy_save | git why save --file context.md | Save structured context |
gitwhy_get | git why get <id> | Retrieve context by ID |
gitwhy_search | git why search "query" | Search contexts with hybrid full-text search (ranked results with snippets) |
gitwhy_list | git why tree / git why log | Browse domain/topic structure |
gitwhy_sync | git why push <context-id> | Upload to cloud (private) |
gitwhy_publish | git why push <context-id> --share | Share with team |
gitwhy_post_pr | git why post-pr [context-id...] | Post to GitHub PR |
MCP fallback rule: If an MCP tool fails or is unavailable, inform the user and use the equivalent CLI command instead. Every MCP operation has a CLI equivalent.
When saving context, wrap content in <context> XML tags. The CLI renders this into rich markdown for storage.
<context>
<!-- Required -->
<title>Short title of what was done</title>
<story>
Organize by phases. Write in first-person engineering journal style.
Phase 1 — Setup:
What user asked, what you did, challenges faced, how you resolved them.
Include back-and-forth with the user where it shaped the outcome.
Phase 2 — Implementation:
Technical details, decisions made during coding, problems solved.
</story>
<reasoning>
Why you chose this approach.
<decisions>
- RS256 over HS256 — allows key rotation without redeploying
- 24h token expiry — balances security vs UX
</decisions>
<rejected>
- Session cookies — requires server-side session store
- OAuth2 external provider — overkill for internal service
</rejected>
<tradeoffs>
- No refresh tokens in v1 — simplifies MVP but means 24h hard limit
</tradeoffs>
</reasoning>
<files>
src/auth/middleware.ts — new — Token verification middleware
src/routes/login.ts — modified — Added token signing on login
package.json — modified — Added jsonwebtoken dependency
</files>
<!-- Optional -->
<agent>claude-code (claude-opus-4)</agent>
<tags>auth, jwt, middleware</tags>
<tools>MCP: nia, sequential-thinking</tools>
<verification>All 14 tests passing. Build successful.</verification>
<risks>No rate limiting on login endpoint yet.</risks>
</context>| Tag | Required | Notes |
|---|---|---|
<title> | Yes | Short title of the work done |
<story> | Yes | Phase-organized engineering journal. First-person, chronological. |
<reasoning> | Yes | Why this approach. Nest <decisions>, <rejected>, <tradeoffs> inside. |
<files> | Yes | One per line. Flexible format: path — status — desc or just path |
<agent> | Optional | Agent name and model |
<tags> | Optional | Comma-separated keywords for discovery |
<tools> | Optional | MCPs, CLI tools, resources used |
<verification> | Optional | Test results, build status |
<risks> | Optional | Open questions, follow-up items |
Context ID, repository, branch, date, domain/topic, and commits are auto-populated by the CLI.
gitwhy_status (MCP) or git why log (CLI)<context> XML tags using the template abovegitwhy_save(markdown="<context>...</context>")git why save --file context.mdecho '<context>...</context>' | git why saveTo retrieve past context:
gitwhy_get(id="ctx_a1b2c3d4") or git why get ctx_a1b2c3d4gitwhy_search(query="authentication") or git why search "auth" — supports repo, domain, and limit filtersgitwhy_list() or git why treeTo share with team:
gitwhy_sync or git why push <context-id>gitwhy_publish(ids=...) or git why push <context-id> --sharegitwhy_post_pr or git why post-pr [context-id...]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.