scaffold-mcp-tool — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited scaffold-mcp-tool (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A checklist for adding a tool without forgetting any of the six places it needs to land. The substrate tool discipline is set by ADR 0001 (docs/decisions/0001-chronometric-tool-design.md); newer servers follow the same pattern.
Servers in scope:
packages/mcp-chronometric/packages/mcp-cognitive-graph/packages/mcp-guardrail/packages/mcp-task-fractionator/packages/mcp-translation/(Native-host and CLI tools are out of scope here — different bindings.)
skipped.
Walks through the six required edits, in order. The skill does not perform the edits — it surfaces the checklist and the canonical examples to follow.
Add packages/mcp-<server>/schemas/<tool_name>.schema.json. Use one of these as a template:
packages/mcp-cognitive-graph/schemas/record_fact.schema.json (inputwith $ref defs, output, errors, examples, compatibility)
packages/mcp-task-fractionator/schemas/decompose.schema.json (arrayoutput, dependency model, error vocabulary)
packages/mcp-translation/schemas/translate_incoming.schema.json (LLMprovenance, eval-corpus slice reference)
Required top-level keys: $schema, $id, title, description, version, properties.input, properties.output, errors, examples, compatibility.
Add packages/mcp-<server>/src/<package>/tools/<tool_name>.py. Look at packages/mcp-cognitive-graph/src/neurodock_mcp_cognitive_graph/tools/record_fact.py for the shape: typed Pydantic models, a single async def handle(input, ctx), explicit error raising mapped to the schema's errors block.
Add the handler to packages/mcp-<server>/src/<package>/server.py in the tool registration block. The MCP server enumerates handlers; an unregistered handler is dead code.
Add at least packages/mcp-<server>/tests/test_<tool_name>.py with:
examples[] in the schema.errors.* key.auto-create entities).
If the tool's existence or signature affects the substrate design, update the relevant ADR under docs/decisions/. Per ADR 0001, "new tools are added by extending the schema set; renames or required-param additions require a new ADR." For purely additive tools, a one-line note in the existing ADR's "Tool inventory" section is enough.
Append to packages/mcp-<server>/CHANGELOG.md under a new ## Unreleased section. Use the version-impact skill before opening the PR to confirm the bump kind matches the change.
This skill is a checklist, not a script. Read it before starting the work and again at the end as a self-review pass.
If a generator script is later added (e.g. scripts/scaffold-mcp-tool.sh), the steps above remain authoritative — the script is convenience, not the contract.
$id URL is unique acrossservers — duplicate $ids will cause confusing validator errors elsewhere.
MCP server (none today) would differ.
This is a procedure, not a creative brief. List the steps, name the canonical examples, then stop. The contributor reading this is already mid-task and does not want philosophy about why MCP tools exist.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.