test-suite-7c9925 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited test-suite-7c9925 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run behavioral tests against a live Thoughtbox MCP server whose public surface is Code Mode.
The authoritative hosted contract is:
thoughtbox_searchthoughtbox_executethoughtbox_peer_notebookThe legacy progressive-disclosure suite (thoughtbox_init, thoughtbox_operations, raw per-domain tools) is no longer the primary behavioral contract for /mcp. Treat the old 01-09 markdown files in this folder as historical reference only unless you are explicitly auditing legacy behavior.
| # | File | Focus | Tests |
|---|---|---|---|
| 01 | tests/01-codemode-surface.md | Public MCP surface and instructions | 4 |
| 02 | tests/02-codemode-search.md | Search catalog discovery | 5 |
| 03 | tests/03-codemode-thought.md | Thought workflows: all types, branching, revision, agents | 15 |
| 04 | tests/04-codemode-sessions.md | Session CRUD, search, resume, export, analysis | 8 |
| 05 | tests/05-codemode-knowledge.md | Knowledge graph: entities, relations, traversal | 5 |
| 06 | tests/06-codemode-protocols.md | Theseus, Ulysses, and observability lifecycles | 8 |
| 07 | tests/07-hub.md | Hub coordination via tb.hub.*: identity, workspaces, problems, proposals, consensus, channels | 15 |
Total: 60 behavioral tests across the 3-tool Code Mode surface
Every test creates real data in Supabase and verifies it through retrieval. The suite should leave named sessions visible in the web app's Runs view.
Confirm the live MCP server is reachable and using the Code Mode surface:
tools/list.thoughtbox_searchthoughtbox_executethoughtbox_peer_notebookIf raw tools like thoughtbox_init, thoughtbox_session, or thoughtbox_hub appear in tools/list, the behavioral suite should fail immediately because the hosted surface is not the intended Code Mode contract.
Track results in a state object:
{
"started": "<timestamp>",
"currentFile": 1,
"currentTest": 1,
"results": {},
"summary": { "pass": 0, "fail": 0, "skip": 0 }
}For each test file (01 through 07):
.Codex/skills/test-suite/tests/NN-*.mdthoughtbox_search and thoughtbox_execute toolspass, fail, or skipExample:
[02/07] thoughtbox_search: 5/5 passProduce a concise summary:
Thoughtbox Code Mode Behavioral Suite — Results
==============================================
01-codemode-surface: 4/4 pass
02-codemode-search: 5/5 pass
03-codemode-thought: 15/15 pass
04-codemode-sessions: 8/8 pass
05-codemode-knowledge: 5/5 pass
06-codemode-protocols: 8/8 pass
07-hub: 15/15 pass
----------------------------------------------
Total: 60/60 passIf anything fails, list the exact test and the observed discrepancy.
A test is not PASS unless the response proves the claim.
The first check is always tools/list. The hosted contract is the public surface. Internal handlers or historical resources do not count as proof.
When thoughtbox_search returns a module, operation, prompt, resource, or resource template, verify the returned names/URIs/descriptions match the intended query. "It returned something relevant" is not enough.
For thoughtbox_execute, verify both:
Examples:
tb.thought(...), verify the resulting session is visible through tb.session.list() or tb.session.get(...)init, verify status reports the active sessionconsole.log(...), verify logs were capturedtb.hub is part of the supported SDK surface (covered by tests/07-hub.md). Retired namespaces such as tb.init or tb.gateway must be absent (undefined), not gracefully shimmed.
If the server exposes more than the intended three tools, or if search/execute exposes an out-of-scope namespace for this release, that is a failure against the current Code Mode contract.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.