add-mcp-tool — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-mcp-tool (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Adding a tool touches several layers that must stay in sync. A tool that has a schema but no router case, or a handler with no validation, ships broken. This card is the checklist that keeps the chain complete.
As of v1.5.0 the tool definitions and the request router live together in `src/index.ts`:
TOOLS array in src/index.ts(each entry: name, description, inputSchema).
CallToolRequestSchema handler in the same file — aswitch (request.params.name) with one case "amplify_*" per tool.
src/tools.ts.src/storage.ts.⚠️src/index.tsalready holds 13 tool schemas and is growing. Schemas are not split into per-tool modules yet. When you add a tool, follow the existing in-index.tspattern for consistency — but ifindex.tsis becoming unwieldy, do the split as its own dedicated, reviewable change (move theTOOLSarray intosrc/schemas.tsand import it), never as a drive-by inside a feature commit. Do not bolt a new schema onto a file that someone is mid-way through splitting.
TOOLS array in src/index.ts(name, a precise description, and a complete inputSchema with required fields and enums). The description is what the agent reads to decide when to call it — make it specific.
case "amplify_<name>": in theCallToolRequestSchema handler so the tool actually dispatches.
src/tools.ts, validate inputs at the top of thehandler (required fields present, enums in range, sane sizes). Fail with a clear message — never silently coerce.
method in src/storage.ts. If it writes, it must use the v1.5.0 read-back pattern (re-read the row; throw AmplifierWriteError on empty) so it can never report a hallucinated success.
tests/<name>.test.js covering asuccess path (returns the expected result / numeric id) and a failure path (invalid input rejected; on a write tool, a simulated read-back failure surfaces ERROR: ... NOT recorded). See design-memory-eval for how to structure these.
README.md / CLAUDE.md /CHANGELOG.md only when user-visible behavior or the tool list changes. Do not churn docs for internal refactors.
Before calling the tool done: npm test is green, the new tool appears in the tools/list response, and a manual case dispatch test confirms the router reaches your handler. A tool with a schema but no reachable handler is not done.
case (tool listed but un-callable).index.ts and adding a feature in the samecommit — make the structural move separately so it's reviewable.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.