gossipcat — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gossipcat (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
gossipcat is an MCP server (a running relay + tool server + native-agent dispatch), not a set of prompt rules. This skill installs the server. Once it is connected, all operational rules — dispatch, consensus, signals — load live from `gossip_status()` and stay in sync with the running server. This skill does not carry them.
echo $CLAUDECODE prints 1 → Claude Code.echo $CURSOR is set, or you are running inside Cursor → Cursor.If unclear, ask the user which one they use.
Global (works for both Claude Code and Cursor):
npm install -g gossipcat
claude mcp add gossipcat -s user -- gossipcatThe claude mcp add step is required for global installs — the postinstall step cannot write a usable .mcp.json for a global install, so you must register the server manually. (Cursor users: add { "mcpServers": { "gossipcat": { "command": "gossipcat" } } } to ~/.cursor/mcp.json instead of claude mcp add.)
Project-local (run inside the target project):
npm install --save-dev gossipcatThe postinstall step writes .mcp.json into the project root automatically — no claude mcp add needed. Open the IDE in that project.
/mcp (Claude Code) or restartthe IDE so the gossipcat tools load.
gossip_status(). It returns the dashboard URL, the agentroster, and the full live operator playbook. Print the dashboard URL for the user, then tell them: "Set up a gossipcat team for this project."
All dispatch rules, the consensus workflow, and signal discipline are delivered by gossip_status() at runtime — they are kept in sync with the installed server version and are intentionally NOT duplicated in this skill.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.