proagentstore-mcp-operator-b7b7df — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited proagentstore-mcp-operator-b7b7df (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user asks you to operate ProAgentStore through their account.
Requires an MCP client that supports OAuth or browser sign-in and access to https://mcp.proagentstore.online/mcp.
All live ProAgentStore account operations must go through the deployed MCP server:
https://mcp.proagentstore.online/mcpDo not bypass MCP with direct database writes, private API calls, local secrets, or browser-only shortcuts unless the user explicitly overrides this rule.
Allowed without MCP:
Requires MCP:
Use the platform MCP endpoint:
npx mcp-remote https://mcp.proagentstore.online/mcpIf the MCP client opens a browser authorization flow, wait for the user to approve it. Do not try to extract, print, or reuse OAuth tokens manually.
Use public trial chat only for discovery:
list_agents -> chat_with_agentUse private instance chat for the real user runtime:
list_agents -> subscribe_agent -> my_instances -> add_instance_knowledge -> chat_with_instance -> instance_messagesThe private instance flow is the product path because it keeps user state, knowledge, memory, and billing credentials separate from the creator's template agent.
Use browser-capable private instances through ProAgentStore runtime tools:
subscribe_agent -> register_instance_runtime -> instance_runtime_status -> run_instance_task -> approve_instance_task -> instance_task_eventsPAGS is the MCP/account control plane. The local ProAgentStore runner executes Playwright, local file uploads, screenshots, terminal actions, and approval-gated browser actions through the outbound relay opened by pags up.
If chat_with_instance returns:
Add your Cloudflare Workers AI account ID and API token before running this agent.the private runtime is working. The instance is correctly refusing to spend platform-owned AI credentials.
The server registers 413 tools; call tools/list for the current set. The tool table in workers/mcp/README.md (or the published platform-docs/mcp.md) lists every tool with its scope, dry-run support, and confirmation value. The always-on platform_guide tool returns a plain-text map of the most commonly used ones — call it at the start of a session to orient yourself without a round-trip through the full list.
Tools span four groups: catalog/reference (no auth required), creator agent tools (write scope), user runtime and instance tools (runtime and destructive scopes), and observability and coding tools (gated to the console surfaces the subscribed agent exposes).
When operating through MCP:
tools/list before a first call and use the exact snake_case parameter names and schemas it declares. IDs, task IDs, session IDs, job keys, runner nodes, cursors and confirm strings are opaque: copy them exactly from the previous result.call_instance_tool, first call list_instance_tools { instance_id, allowed_only: true, schemas: true }, then pass tool as the exact nested tool name and input as exactly that nested schema's argument object. Do not wrap input in another input object.true / false) for boolean fields, not strings. Numeric fields that say they coerce may accept strings, but send numbers when possible.dry_run: true first to preview what the call would do before committing it. The result says dryRun: true and describes the change without applying it.confirm value (compared with ===, never fuzzy-matched). Thirty-six use the tool's own name: write_agent_file, batch_write_agent_files, unregister_instance_runtime, cancel_instance_task, delete_instance_task, delete_connection, delete_agent_task, cancel_instance, delete_instance_knowledge, delete_instance_memory, delete_instance_file, delete_instance_trigger, delete_instance_connector_grant, delete_http_profile, disconnect_discord_bot, revoke_instance_discord_grant, revoke_instance_calendar_grant, disconnect_slack_bot, revoke_instance_slack_grant, reconcile_release_note_delivery, delete_supervision, clear_instance_messages, delete_instance_message, resync_instance_personality, coding_repo_remove, delete_feedback, delete_agent, delete_agent_knowledge, set_agent_capabilities, set_agent_state, chat_with_my_agent, create_agent_version, rollback_agent_version, execute_agent_builder_plan, forget_runner_node, runner_restart (only when forced). The exceptions are remove_repo, which requires confirm: "remove_all_repos" and only when removing every repo. And set_application_runner_settings takes confirm: "auto_submit_real_submissions", only when enabling auto-submit: the owner's acknowledgement that submissions are real and irreversible. A refusal from a confirm-gated tool is mechanical — the gate cannot be argued past; supply the exact value.destructive scope is never granted by default. A client connected with standard browser sign-in cannot run delete- or overwrite-style tools unless the authorization flow explicitly requests the destructive scope.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.