harness-mcp-scan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited harness-mcp-scan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Calls harness mcp-scan to enumerate every declared MCP server + tool and flag policy / permission / dependency issues. Never executes any tool; pure static analysis.
Implementation: scripts/mcp-scan.mjs.
npx -p metaharness@latest harness mcp-scan <path> --json.findings[] with { severity, id, server, tool, message }.--fail-on <severity>: exit 1 when any finding is at or above thatlevel. Default high.
| Severity | Rank |
|---|---|
| low | 1 |
| medium | 2 |
| high | 3 |
--fail-on high (default) only fails on HIGH; --fail-on medium also fails on MEDIUM; --fail-on low fails on any finding.
- name: MCP static scan
run: node plugins/ruflo-metaharness/scripts/mcp-scan.mjs --fail-on highThe exit code is the only thing CI watches; the JSON output goes to artifacts for human review.
When harness binary is unavailable (no network, blocked registry), emits structured { degraded: true, reason: 'metaharness-not-available' } and exits 0. Ruflo continues — ADR-150 architectural constraint.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.