Is mcp-operations safe to install?

SaferSkills independently audited mcp-operations (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/mcp-operations/SKILL.md · 1 file

.claude/skills/mcp-operations/SKILL.md0.9 KB · Markdown

name: mcp-operations

description: Operate and maintain the local MCP server for this project. Use when creating MCP host config, troubleshooting tool connectivity, modifying tool domains, or adjusting safety policy flags.

MCP Operations

Use this skill whenever work touches mcp/ behavior or MCP host integration.

Core workflow

Confirm dashboard API is running (/api/health).
Confirm MCP server build status.
Validate env flags for mutation/destructive modes.
Verify host configuration path and command.

Safe operations policy

Default to read-only mode (MCP_DASHBOARD_ALLOW_MUTATIONS=false).
Enable mutations only for explicit admin tasks.
Enable destructive mode only transiently and require explicit confirmation token.

Required verification for code changes

npm run mcp:typecheck
npm run mcp:build

References

Host config examples: references/host-config.md
Operations runbook: references/runbook.md

mcp-operations— agent skill

Is mcp-operations safe to install?

MCP Operations

Core workflow

Safe operations policy

Required verification for code changes

References

Audit the pieces. Scan the whole. Decide.