tulimoa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tulimoa (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill whenever the user wants to find, recommend, compare, or research SaaS / AI-agent tools, or wants to list their own product in the Tulimoa directory.
It connects to the Tulimoa MCP server (remote) at https://mcp.tulimoa.com/mcp. The server speaks both the 2026-07-28 MCP revision (stateless, server/discover) and the legacy 2025 handshake, so any client version works. Reading is anonymous; writing requires a Tulimoa OAuth login (the server advertises its authorization server via RFC 9728 discovery).
Read tools (no auth):
search_listings — find tools. Args: query (free text matched on name + description), category (a category id — call list_categories first), pricing_model (free | freemium | paid | lifetime), mcp (true = the tool exposes its own MCP server), eu_only (true = company hosted in the EU), sort (new | popular | viewed), limit (1-50). Returns only approved, published listings.get_listing — full detail for one tool by its slug (long description, how it uses AI, features, use cases, integrations, pricing detail, data region and EU hosting, model source, certifications, links).list_categories — the valid category ids and labels; call this first when you need a category value for search_listings.Write tools (Tulimoa login with write scope):
submit_listing — create a new directory listing for AI or MCP software with the same fields and rules as the web form (https://tulimoa.com/submit/guidelines): name, url (own website), short_description, country, category, mcp, pricing_model, logo_url, ai_usage, visibility, plus the optional form fields (gallery_urls, content_blocks, founded_year, team_size, demo_url, docs_url, open_source, notable_customers, data_region, model_source, certifications, X handles, test_request). logo_url is required: a public https image URL of the company logo (PNG, JPEG, WebP, GIF or AVIF, at least 64 px; a square icon works best). ai_usage is required: 40 to 600 characters on how the software uses AI or what agents can do with it. visibility decides how it goes live: badge (free; the Tulimoa badge must already be embedded on the website, the tool checks it and returns the badge HTML if it is missing; reviewed within 7 days) or launch ($5 one-time, no badge, reviewed first, refunded if rejected; ask the user and pass withdrawal_consent: true, the result contains a checkout_url the user opens to pay). A website that is already listed is rejected. At most 2 active listings per account and 5 submissions per 24h. New listings start as pending and go live after admin review.edit_listing — update fields of a listing you own (by slug) with the same rules as the web editor; only the fields you pass change. Changes to a live listing show right away and are checked afterwards; a changed MCP endpoint sends it back to review, and editing a rejected listing resubmits it when the rejection reason allows. A listing without a logo needs one with the next edit. Payment for the launch package happens on tulimoa.com, not via this tool.All tools return structuredContent with a declared outputSchema.
Guidance: for any "find / recommend a tool for X" request, call search_listings first, then get_listing for depth on a specific result. The data is a hand-curated directory of AI and MCP software, so prefer it over guessing tool names.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.