exploring_dependency_sources — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited exploring_dependency_sources (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Explores, navigates, and analyzes the internal logic, APIs, and symbol implementations of external libraries, Gradle plugins, and the Gradle Build Tool itself with absolute precision using high-performance, indexed searching.
search_dependency_sources as the primary discovery tool for external library, plugin, and Gradle internal code.projectRoot.{group}/{artifact} prefix for reading specific files (e.g., path="org.mongodb/mongodb-driver-sync/org/mongodb/client/MongoClient.kt"). The dependency parameter should only be used to filter the search scope forperformance when searching across libraries, not as the primary way to specify a path.
:, =, +, -, *, /) in FULL_TEXT searches using a backslash (e.g., \:) or double quotes.read_dependency_sources once a specific file path has been identified via search.fresh: true if a search returns a SearchResponse with an error indicating a missing index.ZipException) are propagated and will cause the tool to fail with a descriptive error.dependency filter targets ONLY the specific library version matched, NOT its transitive dependencies.search_dependency_sources and read_dependency_sources by default to reduce noise.sourceSetPath=":buildscript" (root project) or sourceSetPath=":app:buildscript" (subproject) to search or read plugin source code. This targets the virtual buildscript source set which aggregates all classpathplugins.
gradleSource: true in search_dependency_sources to target Gradle's internal engine when probing core Gradle behavior.gradleSource: true) — unscoped search is no longer supported.grep or find to locate dependency sources; they reside in remote caches whose paths are not predictable in advance.rg or ast-grep to operate on a sources root path explicitly returned by read_dependency_sources or search_dependency_sources in the Sources root: <path> header line. Dependency directories insidethe sources root are symlinks; always pass --follow to rg (e.g., rg --follow <pattern> <sources-root>).
class,interface, or fun. Supports exact names, exact FQNs, glob wildcards (e.g., *, **), and regular expressions. Use name: (discovery) or fqn: (precision) prefix for field-specific searches.
Glob wildcards for FQNs: * matches one segment, ** matches multiple. Example: fqn:org.gradle.*.Project or fqn:org.**.Project.
Regex: Wrap query in / for a full regular expression on the fqn field. Example: fqn:/.*\.internal\..*/ to find all internal declarations.
search_dependency_sources with projectPath, configurationPath, or sourceSetPath to scope to project dependency code.sourceSetPath=":buildscript" to target plugin source code.gradleSource: true to target Gradle Build Tool source code.dependency parameter to filter searches to a single library (group:name:version:variant, group:name:version, group:name, or just group). This bypasses project-level index merging forinstantaneous results.
inspect_dependencies first to verify the exact coordinates of the dependency as resolved by Gradle.fresh: true if project dependencies have recently changed.Sources root: <absolute-path> header. Use this path with rg, ast-grep, or other shell tools for operations not covered by the MCP tools. Always pass --follow to rg forsymlinked dependency directories.
read_dependency_sources with a dot-separated package path (e.g., org.gradle.api) to list its direct symbols and sub-packages.read_dependency_sources to retrieve implementation logic. Use pagination for large files.DECLARATION search to jump directly to its definition.Decision rule: If the question is "what does this API look like or how does it work?" — use this skill. If you need to run code to see what it does at runtime — use interacting_with_project_runtime (REPL). Read before you run.org.gradle.api.Project, Task, DependencyHandler) to understand internal behavior.search_dependency_sources(query="<SymbolName>", searchType="DECLARATION", projectPath=":").read_dependency_sources(path="<path>", projectPath=":") to analyze the implementation.DECLARATION or FULL_TEXT.read_dependency_sources to read the source.search_dependency_sources(query="<ClassName>", searchType="DECLARATION", gradleSource=true).fqn:org.gradle.*.SomeApi or fqn:org.**.SomeApi.read_dependency_sources(path="org/gradle/...", gradleSource=true).gradle_docs (see gradle skill).search_dependency_sources(query="<PluginName>", searchType="DECLARATION", sourceSetPath=":buildscript").read_dependency_sources(path="<group>/<artifact>/...", sourceSetPath=":buildscript").inspect_dependencies or project files.search_dependency_sources(query="<query>", dependency="<group:artifact>", projectPath=":").search_dependency_sources(query="<text>", projectPath=":") (defaults to FULL_TEXT).For official Gradle documentation (User Guide, DSL, Release Notes), use the gradle_docs tool via the gradle skill. See Internal Source Research for authoritative research patterns combining docs and source.
Tool: search_dependency_sources
{
"query": "JsonConfiguration",
"searchType": "DECLARATION",
"projectPath": ":"
}
// Reasoning: DECLARATION search for a class name across both name and FQN fields, scoped to the root project.Tool: search_dependency_sources
{
"query": "Project",
"searchType": "DECLARATION",
"gradleSource": true
}
// Reasoning: Using gradleSource and DECLARATION search to find the ground-truth implementation of the core Project API.Tool: search_dependency_sources
{
"query": "MongoClient",
"searchType": "DECLARATION",
"dependency": "org.mongodb:mongodb-driver-sync",
"projectPath": ":"
}
// Reasoning: The 'dependency' parameter targets only the 'mongodb-driver-sync' library for a fast, focused search.Tool: search_dependency_sources
{
"query": "KotlinPlugin",
"searchType": "DECLARATION",
"sourceSetPath": ":buildscript"
}
// Reasoning: Targeting the buildscript source set to find plugin implementation classes.Tool: search_dependency_sources
{
"query": "fqn:org.gradle.*.Project",
"searchType": "DECLARATION",
"gradleSource": true
}
// Reasoning: Glob wildcard to find Project declarations in any direct sub-package of org.gradle.Tool: search_dependency_sources
{
"query": "fqn:/.*\\.internal\\..*/",
"searchType": "DECLARATION",
"gradleSource": true
}
// Reasoning: Regex on the 'fqn' field to find all internal Gradle declarations.Tool: search_dependency_sources
{
"query": "name:Configuration",
"searchType": "DECLARATION",
"projectPath": ":"
}
// Reasoning: The 'name:' prefix finds classes like 'JsonConfiguration' via CamelCase tokenization.Tool: search_dependency_sources
{
"query": "DEFAULT_TIMEOUT_MS \\: 5000",
"projectPath": ":"
}
// Reasoning: FULL_TEXT (default) with escaped colon to find a specific constant assignment.Tool: search_dependency_sources
{
"query": "**/AndroidManifest.xml",
"searchType": "GLOB",
"projectPath": ":"
}
// Reasoning: GLOB search to find a specific file by name across the dependency graph.Tool: read_dependency_sources
{
"path": "org.jetbrains.kotlinx/kotlinx-coroutines-core/kotlinx/coroutines/Job.kt",
"projectPath": ":"
}
// Reasoning: Reading 'Job.kt' using the recommended `{group}/{artifact}` syntax.Tool: read_dependency_sources
{
"path": "org/gradle/api/Project.java",
"gradleSource": true
}
// Reasoning: Retrieving the source code for a fundamental Gradle class for high-resolution analysis.Tool: read_dependency_sources
{
"path": "org.gradle.api",
"projectPath": ":"
}
// Reasoning: Listing the direct symbols and sub-packages of 'org.gradle.api' using index-backed exploration.gradle_docs documentation lookup with gradleSource: true source searches for authoritative research.search_dependency_sources for details on complex queries and escaping.dependency filter fails, run inspect_dependencies to confirm exact coordinates.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.