appdeploy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited appdeploy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Deploy web apps to AppDeploy via HTTP API.
.appdeploy file in the project rootapi_key, skip to Usage curl -X POST https://api-v2.appdeploy.ai/mcp/api-key \
-H "Content-Type: application/json" \
-d '{"client_name": "claude-code"}'Response:
{
"api_key": "ak_...",
"user_id": "agent-claude-code-a1b2c3d4",
"created_at": 1234567890,
"message": "Save this key securely - it cannot be retrieved later"
} {
"api_key": "ak_...",
"endpoint": "https://api-v2.appdeploy.ai/mcp"
}Add .appdeploy to .gitignore if not already present.
Make JSON-RPC calls to the MCP endpoint:
curl -X POST {endpoint} \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "Authorization: Bearer {api_key}" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "{tool_name}",
"arguments": { ... }
}
}'Call get_deploy_instructions to understand constraints and requirements.
Call get_app_template with your chosen app_type and frontend_template.
Call deploy_app with your app files. For new apps, set app_id to null.
Call get_app_status to check if the build succeeded.
Use get_apps to list your deployed apps.
Use this when you are about to call deploy_app in order to get the deployment constraints and hard rules. You must call this tool before starting to generate any code. This tool returns instructions only and does not deploy anything.
Parameters:
Use this when the user asks to deploy or publish a website or web app and wants a public URL. Before generating files or calling this tool, you must call get_deploy_instructions and follow its constraints.
Parameters:
app_id: any (required) - existing app id to update, or null for new appapp_type: string (required) - app architecture: frontend-only or frontend+backendapp_name: string (required) - short display namedescription: string (optional) - short description of what the app doesfrontend_template: any (optional) - REQUIRED when app_id is null. One of: 'html-static' (simple sites), 'react-vite' (SPAs, games), 'nextjs-static' (multi-page). Template files auto-included.files: array (optional) - Files to write. NEW APPS: only custom files + diffs to template files. UPDATES: only changed files using diffs[]. At least one of files[] or deletePaths[] required.deletePaths: array (optional) - Paths to delete. ONLY for updates (app_id required). Cannot delete package.json or framework entry points.model: string (required) - The coding agent model used for this deployment, to the best of your knowledge. Examples: 'codex-5.3', 'chatgpt', 'opus 4.6', 'claude-sonnet-4-5', 'gemini-2.5-pro'intent: string (required) - The intent of this deployment. User-initiated examples: 'initial app deploy', 'bugfix - ui is too noisy'. Agent-initiated examples: 'agent fixing deployment error', 'agent retry after lint failure'Call get_deploy_instructions first. Then call this once you've decided app_type and frontend_template. Returns base app template and SDK types. Template files auto-included in deploy_app.
Parameters:
app_type: string (required)frontend_template: string (required) - Frontend framework: 'html-static' - Simple sites, minimal framework; 'react-vite' - React SPAs, dashboards, games; 'nextjs-static' - Multi-page apps, SSGUse this when deploy_app tool call returns or when the user asks to check the deployment status of an app, or reports that the app has errors or is not working as expected. Returns deployment status (in-progress: 'deploying'/'deleting', terminal: 'ready'/'failed'/'deleted'), QA snapshot (frontend/network errors), and live frontend/backend error logs.
Parameters:
app_id: string (required) - Target app idsince: integer (optional) - Optional timestamp in epoch milliseconds to filter errors. When provided, returns only errors since that timestamp.Use this when you want to permanently delete an app. Use o
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.