mushi-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mushi-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Mushi Mushi is a TDD/PDCA engine for web apps: it captures bugs, maps user stories from your live app, auto-generates Playwright tests, and continuously improves them via PDCA loops.
| Environment | Base URL |
|---|---|
| Hosted (default) | https://kensaur.us/mushi-mushi/admin |
| Local monorepo | http://localhost:6464 after pnpm dev |
| Override | MUSHI_CONSOLE_URL (CLI + browser opens) |
Resolution order: env → saved consoleUrl in ~/.config/mushi/config.json → localhost probe → monorepo heuristic → hosted.
| Command | Use when |
|---|---|
npx mushi-mushi / mushi init | First SDK install — framework detect, packages, .env.local |
mushi connect --project-id <uuid> --endpoint <url> --write-env --wire-ide --wait | Have ID + key; want env + Cursor MCP + heartbeat proof |
mushi login | Save credentials before other commands |
mushi setup | MCP-only wiring from saved config (not SDK install) |
Do not mint SDK keys under Settings → BYOK. Use Setup → Verify → Generate API key (report:write).
Open the Mushi admin console (local: http://localhost:6464).
report:write). Shown once.Or run npx mushi-mushi — the wizard opens /onboarding?tab=steps&setup=cli, verifies via whoami, then installs.
You need:
MUSHI_PROJECT_ID — UUID from success panel or Projects chipMUSHI_API_KEY — mushi_… from Verify tab# Recommended — wizard handles framework + env
npx mushi-mushi
# Or manual
npm install @mushi-mushi/webimport { Mushi } from '@mushi-mushi/web'
Mushi.init({
projectId: process.env.MUSHI_PROJECT_ID!,
apiKey: process.env.MUSHI_API_KEY!,
capture: {
discoverInventory: {
enabled: true,
routeTemplates: ['/items/[id]', '/users/[userId]/profile'],
},
},
})npm install -g @mushi-mushi/cli
mushi login --api-key mushi_... --project-id <uuid>
# endpoint defaults to Mushi Cloud when omitted after login
mushi stories map --url https://your-app.vercel.app --waitReview proposals: Inventory → Discovery → Past proposals.
mushi tdd pending
mushi tdd gen <story-id> --mode review
mushi tdd approve <qa-story-id>If no saved config and no --project-id / --api-key flags:
?setup=cliUse /onboarding?tab=steps&setup=cli or Projects → New project so the create form stays visible when you already have projects.
mushi keys list
MUSHI_BYOK_KEY=sk-ant-... mushi keys add --provider anthropic --label "Backup account"Console: Settings → API Key Pool (not the same as SDK ingest keys on Verify).
After mushi login:
mushi setup # writes .cursor/mcp.json
# or full wiring:
mushi connect --project-id <uuid> --endpoint <url> --write-env --wire-ide --waitManual MCP block:
{
"mcpServers": {
"mushi": {
"command": "npx",
"args": ["@mushi-mushi/mcp"],
"env": {
"MUSHI_API_KEY": "mushi_...",
"MUSHI_API_ENDPOINT": "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api",
"MUSHI_PROJECT_ID": "<uuid>"
}
}
}
}Integrations → Slack → Add to Slack
mushi slack status
mushi slack testmushi doctor --server --qa-stories
pnpm smoke:cli-setup # monorepo: Playwright smoke for create → copy ID (skips if unsigned)Common flags:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.