trace-mcp-codemod — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trace-mcp-codemod (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
apply_codemod is the correct tool for any repeated mechanical change. Using Edit for the same pattern twice or more is a waste of tokens and is error-prone.
If you are about to make the same kind of change 2 or more times — whether in one file or across many — stop and use apply_codemod. This includes:
async/await to a set of functionsNo exceptions. "It's just three edits" is still a violation — use apply_codemod.
apply_codemod({
pattern: "oldFunction\\(",
replacement: "newFunction(",
file_pattern: "src/**/*.ts",
dry_run: true // default
})Review the preview: matched files, context lines, and replacement correctness. Look for false positives.
Use filter_content to only touch files that also contain a second marker:
apply_codemod({
pattern: "extractNodes\\(",
replacement: "extractNodes(ctx, ",
file_pattern: "src/**/*.ts",
filter_content: "import.*extractNodes",
dry_run: true
})For patterns that cross line boundaries, enable multiline mode:
apply_codemod({
pattern: "function\\s+foo\\([^)]*\\)\\s*\\{",
replacement: "async function foo() {",
multiline: true,
dry_run: true
})apply_codemod({ ..., dry_run: false })If more than 20 files are affected, add confirm_large: true.
register_edit is not needed for codemods — apply_codemod handles reindexing internally.check_quality_gates with scope: "changed".For changes that span packages or require version awareness (e.g. upgrading a dependency), use plan_batch_change first:
plan_batch_change({
package: "lodash",
from_version: "4.17.0",
to_version: "5.0.0"
})This returns an impact report with all affected files and import references. Combine it with apply_codemod for the actual rewrite.
Edit with replace_all for renames — use apply_rename (see trace-mcp-refactoring).Edit calls with the same old_string pattern shape — use apply_codemod.confirm_large: true on changes >20 files.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.