chisel — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited chisel (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Chisel (source: ~/Documents/coding_projects/Chisel, CLI: chisel, MCP server: chisel, PyPI: chisel-test-impact) maps tests to code and code to git history, answering: what to run, what's risky, who touched it. Zero dependencies, per-project .chisel/ SQLite DB.
chisel analyze . # first time, or after big structural changes
# ... edit code ...
chisel diff-impact # which tests are impacted by my changes?
chisel run -- pytest tests/ # run tests AND auto-record pass/fail results
chisel triage # top risks + coverage gaps + stale tests in one call
chisel update # incremental refresh (near-instant when nothing changed)Prefer the MCP tools when the chisel server is connected (26 tools): diff_impact, suggest_tests, triage, risk_map, test_gaps, record_result, stats; start_job/job_status/cancel_job for long analyses. Pass auto_update=true on query tools to refresh a stale DB inline. The CLI is equivalent and scripting-safe.
CHISEL_INCLUDE_IGNORED=1 overrides; non-git projects are unfiltered.chisel analyze && pytest scripting works (status: error|git_error → 1).edge_rebuild_skipped: true); a one-file update rebuilds in seconds, not minutes.working_tree=true to risk_map / test_gaps / suggest_tests / diff_impact.CHISEL_SHARDS=pkg1,pkg2 (or .chisel/shards.toml); shard param on analyze/update/start_job (MCP and CLI --shard). Query tools aggregate across shards automatically.hybrid > direct > import_graph > co_change > static_require > working_tree > fallback.import_partners / import_coupling._meta.uniform_components (and reweighted) before trusting the composite; exclude_new_file_boost=true for stable long-term rankings.| Symptom | Action |
|---|---|
no_data | Run analyze on the repo root. |
stale_db | auto_update=true, or run analyze/update. |
| New/untracked file invisible | working_tree=true. |
suggest_tests empty | fallback_to_all=true or working_tree=true. |
| MCP timeout on analyze | start_job + poll job_status, or run chisel analyze in a terminal. |
Full protocol: docs/AGENT_PLAYBOOK.md and docs/LLM_CONTRACT.md in the Chisel repo.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.