mcp-yaml-testing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-yaml-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when writing or debugging *.test.mcp.yml files for Model Context Protocol servers.
CRITICAL: Before writing ANY YAML test, discover actual response formats:
# Test successful execution
npx aegis query [tool_name] '[valid_params]' --config "./aegis.config.docs-only.json"
# Test failure scenarios
npx aegis query [tool_name] '[invalid_params]' --config "./aegis.config.docs-only.json"
npx aegis query [tool_name] '' --config "./aegis.config.docs-only.json" # Empty paramsnpx aegis query read_file 'path:test.txt' --config "./aegis.config.docs-only.json"
npx aegis query calculator 'operation:add|a:5|b:3' --config "./aegis.config.docs-only.json"
# Nested via dot notation
npx aegis query api_client 'config.host:localhost|config.port:8080' --config "./aegis.config.docs-only.json"npx aegis query complex_tool '{"config": {"host": "localhost"}, "data": [1,2,3]}' --config "./aegis.config.docs-only.json"description: "Test suite description"
tests:
- it: "Test description"
request:
jsonrpc: "2.0"
id: "unique-id"
method: "tools/list" # or "tools/call"
params: {}
expect:
response:
jsonrpc: "2.0"
id: "unique-id"
result: {}
stderr: "toBeEmpty"# TYPE VALIDATION
result:
tools: "match:type:array"
count: "match:type:number"
# STRING PATTERNS
result:
text: "match:contains:substring"
name: "match:startsWith:prefix"
pattern: "match:regex:\\d{4}-\\d{2}-\\d{2}" # Double-escape backslashes!
# ARRAY PATTERNS
result:
tools: "match:arrayLength:3"
tools:
match:arrayElements:
match:partial: # Flexible - only validate specified fields
name: "match:regex:^[a-z_]+$"
description: "match:contains:tool"
# NEGATION
result:
tools: "match:not:arrayLength:0"
text: "match:not:contains:error"# ❌ WRONG - Duplicate YAML keys
result:
tools: "match:arrayLength:1"
tools: ["read_file"] # OVERWRITES above!
# ❌ WRONG - Missing double backslash
result:
text: "match:regex:\d+" # Wrong
text: "match:regex:\\d+" # Correct
# ❌ WRONG - Assuming structure without discovery
result:
tools: "match:arrayLength:3" # Did you verify this exists?# Run YAML tests (docs-only mode)
npm run test:mcp:yaml
# Run YAML tests (full mode with credentials)
npm run test:mcp:yaml:full
# Run specific test file
npx aegis "tests/mcp/yaml/specific.test.mcp.yml" --config "./aegis.config.docs-only.json"
# Debug mode
npx aegis "tests/**/*.test.mcp.yml" --config "./aegis.config.docs-only.json" --verbose --debug# List available tools
npx aegis query --config ./aegis.config.docs-only.json
# Documentation tools
npx aegis query search_sfcc_classes 'query:catalog' --config ./aegis.config.docs-only.json
npx aegis query get_sfcc_class_info 'className:dw.catalog.Product' --config ./aegis.config.docs-only.json
# Agent instructions / skills bootstrap
npx aegis query sync_agent_instructions 'destinationType:temp|dryRun:true' --config ./aegis.config.docs-only.json
# Full mode tools (requires credentials)
npx aegis query get_system_object_definitions --config ./aegis.config.with-dw.json~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.