Gem Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Gem Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="https://img.shields.io/badge/MCP-Server-blueviolet?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI+PHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0xMiAyQzYuNDggMiAyIDYuNDggMiAxMnM0LjQ4IDEwIDEwIDEwIDEwLTQuNDggMTAtMTBTMTcuNTIgMiAxMiAyem0wIDE4Yy00LjQxIDAtOC0zLjU5LTgtOHMzLjU5LTggOC04IDggMy41OSA4IDgtMy41OSA4LTggOHoiLz48L3N2Zz4=" alt="MCP Server"> <img src="https://img.shields.io/badge/Gemini_2.5-Flash%20%7C%20Pro-4285F4?style=for-the-badge&logo=google&logoColor=white" alt="Gemini"> <img src="https://img.shields.io/badge/Groq-Fallback-F55036?style=for-the-badge&logo=groq&logoColor=white" alt="Groq"> <img src="https://img.shields.io/badge/Python-3.10+-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="Python"> </p>
<h1 align="center">💎 gem-mcp</h1>
<p align="center"> <strong>Flash-Fabric Architecture</strong> — An autonomous MCP server for AI-powered software generation </p>
<p align="center"> <a href="#-features">Features</a> • <a href="#-quick-start">Quick Start</a> • <a href="#-configuration">Configuration</a> • <a href="#-tools">Tools</a> • <a href="#-architecture">Architecture</a> </p>
| Feature | Description |
|---|---|
| 🧠 Dual-Engine Strategy | Uses Gemini 2.5 Pro for reasoning and Flash for high-speed generation |
| 🔄 API Key Rotation | Multiple Gemini keys with random load balancing to avoid rate limits |
| 🔁 Groq Fallback | Automatic fallback to Groq when Gemini quota is exceeded |
| 👁️ Visual Inspector | Multimodal UI validation with Playwright + Gemini Vision (OCR fallback) |
| 🛡️ QA Sentinel | Auto-healing test execution with smart diagnostics |
| ⚡ Lazy Loading | Sub-5 second startup time |
# Clone the repository
git clone https://github.com/riccardosecchi/gem-mcp.git
cd gem-mcp
# Create virtual environment
python3 -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Install Playwright browsers (for visual inspection)
playwright install chromium# Copy the example env file
cp .env.example .env
# Edit with your API keys
nano .envRequired keys in `.env`:
# Single Gemini key
GEMINI_API_KEY=your_key_here
# OR multiple keys for rotation (recommended)
GEMINI_API_KEYS=key1,key2,key3,key4
# Groq fallback (optional but recommended)
GROQ_API_KEY=gsk_your_groq_keyAdd the server to your Claude Code global configuration:
# Edit ~/.claude.jsonAdd this configuration:
{
"mcpServers": {
"gem-mcp": {
"command": "/path/to/gem-mcp/venv/bin/python3",
"args": [
"/path/to/gem-mcp/server.py"
]
}
}
}💡 Tip: Replace /path/to/gem-mcp with your actual installation path# Start Claude Code
claude
# Inside Claude, check MCP servers
/mcpYou should see gem-mcp with a green checkmark ✓
sequential_thinkingMeta-cognitive buffer for complex reasoning. Enables 50-step planning before code generation.
Use: "Think through the requirements for building a todo app"architect_blueprintGenerates Clean Architecture JSON blueprints with folder structure and tech stack.
Use: "Create a blueprint for a Flutter expense tracker app"scaffold_projectCreates physical folder structure. Full Flutter support with all platforms.
Use: "Scaffold the project based on the blueprint"intelligent_code_writerFlash-powered code generation with framework-specific linting rules.
Use: "Write the main.dart file with dependency injection setup"visual_inspectorTakes screenshots and validates UI against design expectations.
Use: "Check if the login page matches the design mockup"qa_sentinelExecutes tests with self-healing diagnostics.
Use: "Run pytest and fix any failures"search_codebaseSmart code search with context.
Use: "Find all usages of the UserRepository class"┌─────────────────────────────────────────────────────────────┐
│ Claude Code (LLM) │
└───────────────────────────┬─────────────────────────────────┘
│ MCP Protocol
▼
┌─────────────────────────────────────────────────────────────┐
│ gem-mcp Server │
├─────────────────────────────────────────────────────────────┤
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────┐ │
│ │ Architect │ │ Fabricator │ │ Visual Engine │ │
│ │ (Pro Model) │ │(Flash Model)│ │ (Playwright+Flash) │ │
│ └─────────────┘ └─────────────┘ └─────────────────────┘ │
├─────────────────────────────────────────────────────────────┤
│ Tool Layer (8 Agents) │
│ • sequential_thinking • intelligent_code_writer │
│ • architect_blueprint • visual_inspector │
│ • scaffold_project • qa_sentinel │
│ • search_codebase • clear_thought_process │
└─────────────────────────────────────────────────────────────┘gem-mcp/
├── server.py # Main MCP server with all tools
├── requirements.txt # Python dependencies
├── .env.example # Environment template
├── CLAUDE.md # Instructions for Claude
└── README.md # This file.env (never committed)MIT © 2025
<p align="center"> Made with 💎 by the Flash-Fabric Architecture </p>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.