lsp-investigate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited lsp-investigate (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when you need to understand code structure, trace bugs through call chains, find all usages of a symbol, or check compiler diagnostics across a codebase.
karellen-lsp-mcp must be installed and on PATHclangd — install via pip install --user karellen-lsp-mcp[clangd] or system package managerjdtls — install via pip install --user karellen-lsp-mcp[jdtls]pyright — install via pip install --user karellen-lsp-mcp[pyright]rust-analyzer — install via rustup component add rust-analyzerpip install --user karellen-lsp-mcp[all]Optionally scan first to see what languages are present:
lsp_scan_languages(project_path="/path/to/project")Then register:
lsp_register_project(project_path="/path/to/project")Auto-detection identifies the language, build system, and LSP server configuration. See /karellen-lsp-mcp:lsp-register for detailed registration options.
Start with hover to get the type signature without reading the file:
lsp_hover(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)Then jump to the definition, declaration, or type definition:
lsp_read_definition(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)
lsp_read_declaration(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)
lsp_read_type_definition(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)Find all references or implementations:
lsp_find_references(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)
lsp_find_implementations(project_id="<id>", file_path="/path/to/file.java", line=10, character=14)Search for symbols by name across the project:
lsp_workspace_symbols(project_id="<id>", query="MyClassName")Trace call chains — use the recursive tree tools to get the full hierarchy in one shot:
lsp_call_tree_incoming(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)
lsp_call_tree_outgoing(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)Or use the single-level versions if you only need immediate callers/callees:
lsp_call_hierarchy_incoming(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)
lsp_call_hierarchy_outgoing(project_id="<id>", file_path="/path/to/file.cpp", line=42, character=10)Get the full recursive type tree in one shot:
lsp_type_tree_supertypes(project_id="<id>", file_path="/path/to/file.java", line=10, character=14)
lsp_type_tree_subtypes(project_id="<id>", file_path="/path/to/file.java", line=10, character=14)Or single-level:
lsp_type_hierarchy_supertypes(project_id="<id>", file_path="/path/to/file.java", line=10, character=14)
lsp_type_hierarchy_subtypes(project_id="<id>", file_path="/path/to/file.java", line=10, character=14)List all symbols in a file to understand its structure:
lsp_document_symbols(project_id="<id>", file_path="/path/to/file.cpp")Get compiler errors and warnings for a specific file:
lsp_diagnostics(project_id="<id>", file_path="/path/to/file.cpp")lsp_deregister_project(registration_id="<registration_id>")lsp_hover to get the signature and docslsp_read_definition to see the implementationlsp_call_tree_incoming to get the full caller treelsp_call_tree_outgoing to get the full callee treelsp_find_references to find all usages of the symbol being changedlsp_call_tree_incoming to get the full caller treelsp_hover to understand how it uses the symbollsp_diagnostics on affected files after making changeslsp_document_symbols to find relevant functionslsp_read_definition to follow suspicious callslsp_call_tree_incoming to trace the data flow backwardslsp_hover on variables to check typeslsp_type_tree_supertypes to get the full supertype treelsp_type_tree_subtypes to get the full subtype treelsp_document_symbols on key classes to compare their structurelsp_find_references on interface methods to see polymorphic usagecmake, make, meson, cargo build, gradle,mvn, pip install, etc.) on the user's project. The LSP adapter handles build configuration automatically. Register the project and let the adapter handle it.
monorepos or polyglot projects, use lsp_detect_project first to find the correct root for each language (where Cargo.toml, pyproject.toml, CMakeLists.txt, etc. lives). Registering at a parent directory that lacks the language's build system marker will fail or produce no results.
lsp_hover is fast and often provides enough context(type signature, docs) without needing to read the full file.
lsp_find_references is semantically aware; itfinds actual references, not string matches.
automatically, but lsp_indexing_status shows progress.
default readiness timeout. Use higher values for large codebases (e.g. timeout=300).
cleans managed data and force-restarts the LSP server.
registration_id to release resources.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.