add-tool — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-tool (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Add a new MCP tool: $ARGUMENTS
Do NOT start coding immediately. Follow this workflow.
If any of these are unclear, ask before proceeding.
List every file that needs to be created or modified:
src/lib/endpoints.ts — new endpoint URL buildersrc/tools/<category>/<tool-name>.ts — new tool filesrc/tools/index.ts — barrel exportsrc/index.ts — tool registration + routingdocs/TOOLS.md — tool documentationdocs/skill.md — if it affects AI agent workflowsGet user approval before writing code.
Follow this exact order:
Add a new method to the endpoints object. Follow the existing pattern:
toolName: (params: { projectId: string /* other params */ }): string => {
const baseUrl = getBaseUrl();
const { projectId, ...queryParams } = params;
const queryString = buildQueryString(queryParams);
return `${baseUrl}/api/mcp/${projectId}/endpoint-path${queryString}`;
};Run: npm run typecheck
Create the tool file with exactly two exports:
export const toolNameTool = {
name: "tool_name",
description: "...", // Write for AI agents — be specific about when to use this
inputSchema: {
type: "object",
properties: { /* every property MUST have a description */ },
required: [/* required params */]
}
};
export async function handleToolName(args: Record<string, unknown>) {
// 1. Auth
const token = getApiKey(args);
if (!token) throw new Error("Missing TESTDINO_PAT...");
// 2. Validate required params
if (!args?.projectId) throw new Error("projectId is required");
// 3. Build URL
const url = endpoints.toolName({ projectId: String(args.projectId), ... });
// 4. Fetch
const response = await apiRequestJson(url, {
headers: { Authorization: `Bearer ${token}` }
});
// 5. Return formatted
return {
content: [{ type: "text", text: JSON.stringify(response, null, 2) }]
};
}Run: npm run typecheck
Add export line following existing pattern:
export { toolNameTool, handleToolName } from "./<category>/<tool-name>.js";Run: npm run typecheck
Two changes:
tools arrayRun: npm run typecheck && npm run lint
Add test file at tests/tools/<category>/<tool-name>.test.ts covering:
Run: npm run test
docs/TOOLS.md following existing formatdocs/skill.md if the tool creates a new workflow or decision pathREADME.md if applicablenpm run format && npm run typecheck && npm run lint && npm run test && npm run buildAll must pass. git diff to confirm only intentional changes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.