mcp-publish-prep 100/100

Is mcp-publish-prep safe to install?

SaferSkills independently audited mcp-publish-prep (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/mcp-publish-prep/SKILL.md · 1 file

.claude/skills/mcp-publish-prep/SKILL.md1.5 KB · Markdown

name: mcp-publish-prep

description: Prepare MCP package for publishing (version bump, changelog, validation)

Prepare the MCP package for a new release. Use $ARGUMENTS for the new version number (e.g., 1.5.0).

Steps

Bump version in BOTH files (CRITICAL — must be simultaneous):

dotnet/src/LightningEnable.Mcp/LightningEnable.Mcp.csproj — update <Version>
python/lightning-enable-mcp/pyproject.toml — update version
These MUST match. CI/CD publishes both from the same version.

Validate `server.json`:

Check description field is ≤100 characters (enforced by MCP Registry and CI)
Update version field if present (CI auto-updates via jq, but good to keep in sync)

Update changelog if one exists

Build verification:

Run dotnet build in dotnet/src/LightningEnable.Mcp/
Verify no build errors

Review CI/CD:

Check .github/workflows/publish-mcp.yml is up to date
Verify secrets are configured: NUGET_API_KEY, PYPI_API_TOKEN, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN

Publishing targets (all automated on push to main):

NuGet: https://www.nuget.org/packages/LightningEnable.Mcp
PyPI: https://pypi.org/project/lightning-enable-mcp
Docker Hub: https://hub.docker.com/r/refinedelement/lightning-enable-mcp
MCP Registry: https://registry.modelcontextprotocol.io

Output

Report the version bump, validation results, and build status. Remind the user to push to main to trigger CI/CD.

mcp-publish-prep— agent skill

Is mcp-publish-prep safe to install?

Steps

Publishing targets (all automated on push to main):

Output

Audit the pieces. Scan the whole. Decide.