Mcp Agent App — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Agent App (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A TypeScript service that converts GeoJSON geometries into 3D triangulated meshes using a local LLM (Ollama). It exposes an MCP tool (generate_mesh) and an HTTP API, making mesh generation accessible both to MCP-compatible clients and standard REST consumers.
POST /generate-mesh
│
▼
Express API (src/api/index.ts)
│
▼
generateMeshAgent (src/agents/generate_mesh_agent.ts)
│
▼
Ollama LLM ──────────────────────────────────────────> MeshData
(llama3.2 @ localhost:11434) { vertices, indices, metadata }
MCP server (src/server.ts) exposes the same agent as an MCP tool over stdio| Layer | Technology |
|---|---|
| Language | TypeScript 5 (strict, ES2022, ESM) |
| Runtime | Node.js 18+ with tsx for development |
| Web framework | Express 4 |
| MCP SDK | @modelcontextprotocol/sdk v1.29, @modelcontextprotocol/server v2.0 alpha |
| Schema validation | Zod |
| Local LLM | Ollama (llama3.2 at http://localhost:11434) |
Note: The MCP server and HTTP API use Ollama for inference — no Anthropic API key is required for the core mesh generation. ANTHROPIC_API_KEY is only needed if you extend the agent loop with Claude tool-use.src/
├── server.ts # MCP server — registers and runs the generate_mesh tool
├── agents/
│ └── generate_mesh_agent.ts # Core logic: GeoJSON → Ollama → MeshData
└── api/
└── index.ts # Express HTTP API wrapping the agentllama3.2 model pulled: ollama pull llama3.2
ollama serve # must be running on http://localhost:11434npm installnpm run dev # starts the Express API on port 3000 (default)In another terminal:
curl -X POST http://localhost:3000/generate-mesh \
-H "Content-Type: application/json" \
-d '{"geometry": "{\"type\":\"Polygon\",\"coordinates\":[[[0,0],[1,0],[1,1],[0,1],[0,0]]]}"}'The geometry field accepts either a JSON string or a parsed GeoJSON object (Geometry or Feature).
Expected response shape:
{
"vertices": [0, 0, 0, 1, 0, 0, ...],
"indices": [0, 1, 2, ...],
"metadata": {
"featureType": "Polygon",
"vertexCount": 8,
"triangleCount": 4
}
}| Geometry type | Mesh output |
|---|---|
| Polygon / MultiPolygon | Flat base (z=0) + extruded top (z=10) + side walls |
| LineString | Ribbon mesh, width 0.0001° |
| Point | Small pyramid |
Coordinates map as: longitude → x, latitude → y, elevation → z.
npm run build
npm startnpm run mcp
# or inspect it interactively:
npx @modelcontextprotocol/inspector npx tsx src/server.tsThe MCP server exposes one tool — generate_mesh — that accepts a GeoJSON geometry or Feature as a JSON string and returns the same MeshData structure as the HTTP API.
| Script | Description |
|---|---|
npm run dev | Start API in watch mode via tsx |
npm start | Run compiled dist/api/index.js |
npm run build | Compile TypeScript to dist/ |
npm run mcp | Run the MCP server standalone |
| Variable | Default | Description |
|---|---|---|
PORT | 3000 | Express server port |
CORS_ORIGINS | http://localhost:5173 | Comma-separated list of allowed CORS origins |
Origin header (server-to-server calls) in addition to the CORS allowlist./generate-mesh, and request timeouts via AbortController.StdioClientTransport with StreamableHTTPClientTransport in the MCP manager.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.