servd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited servd (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reference for Servd (servd.host), a Craft-specialised managed hosting platform. Covers git push-to-deploy and the servd.yaml build config, the local → staging → production workflow, the servd/craft-asset-storage plugin, Servd's static caching (and running Blitz alongside it), databases over SSH, backups, the queue runner, the ephemeral filesystem, and how Servd differs from Craft Cloud.
This skill is scoped to Servd specifically — what's different on Servd vs running Craft yourself on Forge or bare metal, and vs Pixel & Tonic's Craft Cloud. For generic Craft deployment, see the craftcms skill's deployment.md. For Craft Cloud, see the craft-cloud skill.
{% dynamicInclude %} islands in cached pages, transform usage, CSRF in cached forms).Authoritative sources used to write this skill (Servd's own docs):
Per-claim URLs appear in each reference file. Last verified against the docs on 2026-05-30. Some operational details (cron, exact plan tiers) are not in the public docs and are flagged as Verify where they appear.
Each row is a place self-hosted habits will mislead you.
| Concern | Self-hosted | Servd |
|---|---|---|
| Config file | .env, config/*.php, web-server config | `servd.yaml` at repo root for the build step (optional; overrides dashboard); platform settings + runtime env vars in the Servd dashboard |
| Deploy | Whatever you've wired | Git push-to-deploy (GitHub/GitLab/Bitbucket or any SSH host) → Composer install + optional Node build |
| Environments | Yours to define | Fixed local → staging → production, uni-directional; allowAdminChanges off everywhere except local |
| Filesystem | Local disk | Ephemeral + load-balanced — disk writes don't persist; use Redis (Craft data cache) or a remote asset volume |
| Assets | Local or your own S3 config | `servd/craft-asset-storage` — S3-backed Flysystem on the *.files.svdcdn.com CDN, auto-separated per environment |
| Image transforms | Native / Imager-X / ImageOptimize on-server | Off-server transforms via the Servd Asset Platform; Imager-X uses transformer: 'servd' |
| Database | Whatever you installed | MariaDB or MySQL 8, reached over an SSH tunnel |
| Page caching | Blitz or similar | Servd static caching built in; Blitz runs alongside it in reverse-proxy mode (not instead of) |
| Queue | You run a worker | Default AJAX-triggered; opt into the Dedicated Queue Runner (paid plans) for isolated immediate processing |
| Cron | crontab | Not documented as a user-configurable feature — design around the queue (Verify for a given plan) |
| Redis | You install it | Provided — Craft's data cache is auto-mapped to a stateful Redis |
| SSH | ssh user@server | Yes — SSH sessions (used e.g. for the DB tunnel) |
| Env vars | .env | Dashboard-managed per environment (not a committed .env) |
Both are managed Craft hosting with git deploy, ephemeral filesystems, S3 assets, off-server transforms, and dashboard env vars. Key differences for a developer:
| Servd | Craft Cloud | |
|---|---|---|
| Repo config | servd.yaml (build) + dashboard | craft-cloud.yaml |
| Asset layer | servd/craft-asset-storage plugin | craftcms/cloud bundled filesystem |
| Database | MariaDB or MySQL 8 | MySQL 8 / Postgres 15 (no MariaDB) |
| SSH | Yes | No |
| First-party CLI | None (plugin console commands + dashboard) | craftcms/cloud + php craft cloud/up |
| Caching | Servd static cache; Blitz runs alongside | Edge static caching; Blitz redundant |
| Transforms | Servd Asset Platform (svdcdn.com) | Cloudflare Images at the edge |
| Queue | Dedicated Queue Runner (paid) | Auto-processed |
references/limitations.md.allowAdminChanges: false on staging and production and syncs uni-directionally (local → staging → production). Make changes in local, commit, deploy. See references/deploy-and-environments.md.references/caching.md..env. SERVD_PROJECT_SLUG / SERVD_SECURITY_KEY come from the dashboard's Assets page.servd/craft-asset-storage filesystem so they land on the Servd Asset Platform and survive deploys. See references/asset-storage.md.servd.yaml or the dashboard instead. See references/deploy-and-environments.md.references/database-and-queue.md.references/database-and-queue.md.Read the relevant reference file(s) for your task. Multiple files often apply.
Task examples:
deploy-and-environments.mdservd.yaml" → deploy-and-environments.mddeploy-and-environments.md + local-dev.mdasset-storage.mdasset-storage.md + limitations.mdasset-storage.mdcaching.mdcaching.md (Blitz reverse-proxy mode)caching.md ({% dynamicInclude %})database-and-queue.mddatabase-and-queue.mddatabase-and-queue.md + local-dev.mdlocal-dev.mdlocal-dev.mdlimitations.mdlimitations.mdlimitations.md (Servd vs Cloud) + this file's tableLoad only the reference files your task needs.
| Reference | Scope | ~Lines |
|---|---|---|
references/deploy-and-environments.md | Git push-to-deploy, the build step (Composer + Node, servd.yaml keys, Node versions), environments (local → staging → production, uni-directional), Project Config + allowAdminChanges, env vars & secrets, the deploy/clone workflow | ~150 |
references/asset-storage.md | servd/craft-asset-storage plugin (composer package, handle, install), SERVD_PROJECT_SLUG/SERVD_SECURITY_KEY, the Servd filesystem on *.files.svdcdn.com, per-environment dirs, off-server transforms, Imager-X (transformer: 'servd') and ImageOptimize integrations | ~140 |
references/caching.md | Servd static caching (enable + TTL, Full vs Tag-Based purge, exclude prefixes, {% dynamicInclude %} tag, CSRF injection, auto cache-busting on save, clear-caches/servd-static-cache + servd-edge-caches), and running Blitz in reverse-proxy mode | ~140 |
references/database-and-queue.md | MariaDB / MySQL 8, SSH-tunnel access, automatic + manual backups (30-day retention, 90-day deleted-asset window), the Dedicated Queue Runner, the cron caveat, console sync commands | ~130 |
references/local-dev.md | DDEV-based local dev (no first-party Servd local env), SERVD_* vars for local, servd-asset-storage/local/pull-assets·push-assets·pull-database·push-database, servd-asset-storage/clone, uni-directional sync discipline | ~120 |
references/limitations.md | Ephemeral + load-balanced filesystem (Redis + remote volumes for runtime files), plugin/feature constraints, the documented-vs-unknown gaps (cron), the full Servd-vs-Craft-Cloud comparison, and the repo detection signals (servd/craft-asset-storage, servd.yaml, SERVD_* env vars) | ~140 |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.