msw-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited msw-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Dynamically add, update, and remove MSW handlers while the app keeps running. Run commands from the project directory (or pass -s <name> for a named session).
Project not set up yet? Use the msw-setup skill or run `msw-cli setup` first.
When using this skill to change mocks:
handlers.ts, mocks/handlers). msw-cli applies add / update / remove / reset to the browser runtime over the WebSocket session. Changing on-disk handler modules is the wrong tool and can confuse the next dev reload.status -s <name>) to see connection and handlers. Only run `open` when no suitable session is active—avoid duplicate daemons for the same work.msw-cli open # prints WebSocket URL + port
# If port ≠ app config, update MSW_WS_URL (or VITE_MSW_WS_URL / NEXT_PUBLIC_MSW_WS_URL) to match output
msw-cli add "http.get('/api/users', () => HttpResponse.json([{ id: 1 }]))"
msw-cli status # connected must be true for mocks to apply
msw-cli closeUse msw-cli open --port 6789 when the app already hard-codes that port. `list` works without a session. Handler commands (add, update, remove, reset, status) require an open session for that cwd (or -s) — otherwise you get "Session not open".
ws://127.0.0.1:<port> in MSW_WS_URL / VITE_MSW_WS_URL / NEXT_PUBLIC_MSW_WS_URL env.add / update / remove / reset — handler changes.status — confirm browser connected.close when finished.Sessions: default name = current directory basename. State: ~/.msw-cli/sessions/.
http, graphql, HttpResponse, bypass, passthrough, delay are in scope (no imports).Response via HttpResponse (e.g. HttpResponse.json({ ok: true })).bypass() to avoid an infinite intercept loop:msw-cli add "http.get('*/api/user', async ({ request }) => { const res = await fetch(bypass(request)); const data = await res.json(); return HttpResponse.json({ ...data, role: 'admin' }) })"status displays handlers as METHOD URL, e.g. GET */api/v1/users/*. But remove / update patterns match the handler URL only (substring or * glob) — not the method.
| Command | Pattern is… | Example |
|---|---|---|
status | Display only: METHOD + URL | GET */api/v1/users/* |
remove/update | URL substring or * glob | */api/v1/users/* |
-m, --method <methods...> (e.g. remove "*/api/users" -m GET)."GET */api/users", copied from status) is auto-split into a method filter, so pasting a status line works — but prefer the URL-only pattern plus -m for clarity.remove/update report how many handlers matched. `Removed 0` or `0 matched` means the pattern matched nothing — fix the pattern, do not retry with another update (that just adds a duplicate).| Command | Purpose |
|---|---|
open [--port N] [-s name] [--no-persist-handlers] [--persist-handlers N] [--single-client] | Start/reuse daemon (required first) |
add "<handler>" | Add handler(s) |
update "<pattern>" [-m METHOD...] -h "<handler>" | Replace handlers matching pattern |
remove "<pattern>" [-m METHOD...] | Remove handlers (reports match count) |
reset [handlers...] | Clear runtime handlers (optional new set) |
status | Connection + active handlers |
list | All open sessions |
close [name] / close-all | Stop daemon(s) |
msw-cli list; if no session for this project, run open, then retry.open; fix port/env and reload.*/api/users/*).status, e.g. remove "*/api/v1/users/*". Use -m GET to filter by method.update pattern matched nothing, so it added a second handler instead of replacing (the CLI warns 0 matched). remove "*/api/..." the extras, then update/add once with a correct URL pattern.open without --port and sync app to the new port.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.