Capytail — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Capytail (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A local MCP capability router that selects relevant skills before loading context.
Capytail is a selector, not an execution gateway. It helps agents avoid loading every skill, agent, or MCP recommendation into context up front.
Experimental 0.1.x.
Use it when you want:
Do not use it as:
npm install -g capytailFrom source:
npm install
npm run build
node dist/src/cli.js --helpStart the read-only MCP server:
capytail mcpPublic MCP tools:
| Tool | Purpose |
|---|---|
capytail_route | Select relevant capabilities for a request. |
capytail_list | List compact discovered capabilities. |
capytail_get_capability | Fetch full content for one selected local skill/agent id. |
Normal agent flow:
capytail_route({ request })
→ capytail_get_capability({ id })route and list return compact metadata only. They do not return full skill bodies.
Add a local skill after a static SkillSpector scan:
capytail add-skill ./my-skill
capytail add-skill ./my-skill --project-root . --name my-skill
capytail add-skill ./my-skill --allow-mediumThe CLI uses a fixed scanner path:
$HOME/.pi/agent/tools/skillspector/.venv/bin/skillspector--skillspector-path is intentionally rejected.
When a skill is accepted, Capytail copies it into:
.capytail/skills/<name>/Then it enriches the copied SKILL.md with missing routing metadata:
aliases: <name>
triggers: ...
use_when: ...It also associates the skill with the current project using the existing capability graph:
{
"graph": {
"projectId": "project:my-project",
"edges": [
{
"from": "project:my-project",
"relation": "project_has_skill",
"to": "skill:project:my-skill"
}
]
}
}The original source skill is not modified.
Capytail reads capytail.config.json or .capytail/config.json from the project root.
See examples/capytail.config.json.
In a local corpus of 43 SKILL.md files:
| Flow | Approx tokens | Time |
|---|---|---|
| Load all skills | ~121k | n/a |
route only | ~1.0k–1.3k | ~10–15ms |
route + get | ~7.4k–40.8k | ~63–80ms |
See docs/benchmarks.md.
See SECURITY.md and docs/security-model.md.
Short version:
--no-llm.npm test
npm run typecheck
npm run buildMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.