H2Bis Project Brain Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited H2Bis Project Brain Mcp (MCP Server) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI layer for H2BIS ProjectBrain - Intelligent agents for intent extraction and software development.
h2bis-pb-ai/
├── src/
│ ├── agents/
│ │ └── intent-extraction/ # Intent Extraction Agent
│ ├── services/
│ │ ├── llm/ # LLM service (OpenAI)
│ │ └── cache/ # Caching service
│ ├── config/ # Configuration
│ └── utils/ # Utilities
└── tests/ # Unit & integration testscd h2bis-pb-ai
npm installcp .env.example .envEdit .env and add your OpenAI API key:
LLM_PROVIDER=openai
OPENAI_API_KEY=sk-your-actual-api-key-here
INTENT_EXTRACTION_MODEL=gpt-4-turbo
CACHE_ENABLED=true
LOG_LEVEL=infonpm run buildimport { IntentExtractionAgent } from './src/agents/intent-extraction/intent-extraction.agent.js';
import { UseCase } from './src/agents/intent-extraction/types/intent-analysis.types.js';
// Create agent
const agent = new IntentExtractionAgent();
// Prepare use case
const useCase: UseCase = {
type: 'use_case',
key: 'uc-user-login',
name: 'User Login',
description: 'Allows users to log in using email and password',
// ... other fields
};
// Extract intent
const analysis = await agent.extractIntent(useCase);
console.log('User Goal:', analysis.userGoal);
console.log('System Responsibilities:', analysis.systemResponsibilities);
console.log('Confidence:', analysis.confidenceLevel);{
userGoal: "Access the system using valid credentials",
systemResponsibilities: [
"Validate email and password against stored credentials",
"Create authenticated session",
"Redirect user to dashboard"
],
technicalComponents: {
frontend: { routes: ["/login"], components: ["LoginForm"] },
backend: { endpoints: ["/api/auth/login"], services: ["auth-service"] },
data: [{ entity: "users", operations: ["READ"] }]
},
acceptanceCriteria: [...],
assumptions: ["Assuming bcrypt password hashing"],
ambiguities: ["Session timeout duration not specified"],
securityConsiderations: ["Implement rate limiting", "Use secure session tokens"],
confidenceLevel: "high",
confidenceJustification: "Requirements are clear with explicit flows"
}# Run all tests
npm test
# Run unit tests only
npm run test:unit
# Run integration tests
npm run test:integrationTypical Cost per Extraction:
With 80% Cache Hit Rate:
Cost Controls:
The LLM agent follows comprehensive instructions documented in: src/agents/intent-extraction/AGENT_INSTRUCTIONS.md
Key guidelines:
4 critical checks ensure quality:
userGoal exists and not emptysystemResponsibilities has at least 1 itemacceptanceCriteria count matches inputconfidenceLevel is not "low"Failed validation triggers:
# Development mode with hot reload
npm run dev
# Build TypeScript
npm run build
# Check types
npx tsc --noEmitThe Intent Extraction Agent will be integrated with the API server to replace naive field mapping:
Current Flow:
UseCase → Direct Mapping → Capability
(name → userGoal, description → systemResponsibility)New Flow:
UseCase → Intent Extraction Agent → IntentAnalysis → Capability
(Semantic extraction with LLM)See intent-agent-implementation.md for integration plan.
Error: OpenAI API key not configuredSolution: Set OPENAI_API_KEY in .env
Error: Invalid JSON response from LLMSolution: Agent automatically retries. If persistent, check LLM response format.
Warning: Manual review required - confidence is lowSolution: Review use case for clarity. Add missing details to improve extraction quality.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.