rami-setup-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rami-setup-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Three things have to be in place before Rami can review and the autofix loop can run:
Do these in order. Skipping ahead causes confusing errors — e.g., the MCP server returns auth_required if OAuth isn't done, or not_found if the GitHub App isn't installed on the repo.
You cannot do this programmatically. Ask the user to open this URL and authorize the app on at least one repository:
https://github.com/apps/rami-code-remeowThis enables automatic PR reviews on every push. After install, the user should see Rami appear as a reviewer on new PRs in the chosen repos.
Pick the right snippet based on the user's MCP client.
claude plugin marketplace add rami-code-review/claude-code-marketplace
claude plugin install rami@rami-code-reviewThis installs the MCP server, the slash commands (/rami:review, /rami:status, /rami:usage), and handles OAuth.
claude mcp add rami --transport http https://rami.reviews/mcpAdd to .cursor/mcp.json in the project root:
{
"mcpServers": {
"rami": {
"url": "https://rami.reviews/mcp"
}
}
}Install the Rami plugin from this marketplace's Codex metadata. The Codex plugin exposes the same MCP server as the Claude plugin and gives Codex sessions the same /rami:review, /rami:status, and /rami:usage workflows.
Hosted MCP server URL:
https://rami.reviews/mcpUse the standard mcpServers config shape your client expects, with transport: http and that URL.
On first use, the MCP server prompts for OAuth. The exact UX depends on the client.
For Claude Code:
/mcp in Claude Code.plugin:rami:rami (or the equivalent for direct-MCP install).For Cursor, Codex, and others, the client typically opens an OAuth window the first time you call any Rami tool. Follow its prompt.
Run a cheap, side-effect-free call to confirm everything is wired up:
mcp__plugin_rami-code-review_rami__get_usage()A successful response includes remaining_reviews, quota_limit, credit_balance, and a dashboard URL. If you see auth_required, OAuth didn't complete — go back to Step 3. If the call returns successfully but says you have zero reviews, the user may need to upgrade plans, but the wiring is fine.
You can also probe the auth resource directly:
ReadMcpResource(uri="rami://auth/status")This returns auth state without consuming any quota.
If the user has an open PR on a repo where the GitHub App is installed, run:
mcp__plugin_rami-code-review_rami__get_current_branch_pr(remote_url=$REMOTE, branch=$BRANCH)
mcp__plugin_rami-code-review_rami__get_review_results(pr_url=<from above>)If get_review_results blocks for a while and then returns status: completed, Rami is fully set up and the autofix loop is available.
Once these three steps are done, the user has access to:
get_review_results after every push, fix or rebut findings via get_fix_prompt / rebut, and re-run until ready_for_review: true./rami:review, /rami:status, /rami:usage.| Symptom | Likely cause | Fix |
|---|---|---|
auth_required from any tool | OAuth not completed | Run Step 3 |
not_found from get_review_results for a real PR URL | GitHub App not installed on this repo | Step 1, scope the install to include this repo |
get_current_branch_pr returns status: not_found | No PR exists for this branch yet | Push the branch and open a PR first |
| Rate-limited responses | Quota exceeded for current period | Check get_usage; may need a paid plan or credits |
The public-facing version of this guide lives at:
https://rami.reviews/llms.txtIf anything in this skill drifts from llms.txt, llms.txt wins — it is what every other LLM client fetches and is what users see.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.