router — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited router (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A mcp__webstorm__*, mcp__rider__*, or mcp__idea__* tool is listed in the session's available tools. Check once per session — if none are present, the JetBrains MCP server isn't connected and this skill's guidance doesn't apply (use native tools; the hook will fail open).
JetBrains IDEs register their MCP tools under the key name from mcpServers in .claude.json. The auto-configure button produces canonical defaults:
| IDE | Default prefix |
|---|---|
| WebStorm | mcp__webstorm__* |
| Rider | mcp__rider__* |
| IntelliJ IDEA | mcp__idea__* |
If you renamed your mcpServers entry, set JETBRAINS_MCP_PREFIX=<your-name> in your shell before launching Claude Code so the hook redirects to the right prefix.
Only one IDE is active per session. If multiple IDEs are running, JETBRAINS_MCP_PREFIX determines which one receives routed calls.
*Always use the JetBrains replacement whenever a `mcp__<ide>__ tool is registered.** The PreToolUse` hook exits 2 on a native call with a stderr redirect naming the IDE tool and the pre-translated project-relative path — going native first incurs the round-trip for nothing.
For the full native-to-IDE mapping (required parameters, usage notes, when to pick search_symbol over search_text, when get_file_problems replaces a build run), see references/tool-map.md. Load it before the first routed call in a session.
JetBrains tools take project-relative paths via pathInProject / file_path / path, not absolute paths.
Translation rule: strip the project root prefix and convert backslashes to forward slashes.
D:\Projects\Work\DLL\GPRICE-Unified-Pricing-Portal\packages\ui\src\app.ts → packages/ui/src/app.tsD:/Projects/Work/DLL/GPRICE-Unified-Pricing-Portal/README.md → README.mdsrc/app.ts) → leave as-is.Pass projectPath explicitly when the session cwd is not the project root, using the absolute path of the project root.
execute_terminal_command caps output at 2000 lines and prompts the user in the IDE unless "Brave Mode" is enabled.get_repositories only surfaces basic state and doesn't replace git status's detail.read_file errors on binaries; use native Read or a Bash probe for binary inspection..claude/, .idea/, .gradle/, .kotlin/, .git/, .gitignore, etc.CLAUDE.md, README.md, docs/guide.md, etc.package.json, tsconfig.json, etc.docs/ directory..yml, .yaml, .toml, .ini, .cfg, .conf, .properties, .lock, .env.Grep / Glob: if the path parameter points to one of these areas, native tools are used; whole-project searches still redirect.get_project_modules returns all modules as WEB_MODULE (WebStorm) or PROJECT for non-C# files (Rider) and the project contains .kt or .java files, the Kotlin/Java symbol index is not populated — search_symbol and get_file_problems will return empty. Use native tools. Kotlin/Java require IntelliJ IDEA (JAVA_MODULE type) for semantic indexing.PROJECT type modules). search_symbol will return empty for .cs files in other IDEs.Some tools are only available on certain IDEs. Check which prefix is registered before using these:
WebStorm + Rider only — database tools + IntelliJ inspection scripting: cancel_sql_query, execute_sql_query, generate_inspection_kts_api, generate_inspection_kts_examples, generate_psi_tree, get_database_object_description, list_database_connections, list_database_schemas, list_recent_sql_queries, list_schema_object_kinds, list_schema_objects, preview_table_data, run_inspection_kts, test_database_connection
IDEA only — debugger session control + Jupyter notebooks: runNotebookCell, xdebug_control_session, xdebug_evaluate_expression, xdebug_get_debugger_status, xdebug_get_frame_values, xdebug_get_stack, xdebug_get_threads, xdebug_get_value_by_path, xdebug_list_breakpoints, xdebug_remove_breakpoint, xdebug_run_to_line, xdebug_set_breakpoint, xdebug_set_variable, xdebug_start_debugger_session
Rider only: permission_prompt — pass through without interception.
These are session-level controls — set by the human in their shell before launching Claude Code, or by a project-scoped .envrc. They are NOT for command-prefix use.
JETBRAINS_ROUTER_BYPASS=Read,Edit,Write (comma-separated, no spaces) leaves those specific native tools alone while the rest still redirect. Use when you know the IDE's open project doesn't match this session's cwd for a subset of operations.JETBRAINS_ROUTER_DISABLE=1 kill-switches every redirect for the session.Anti-bypass: the hook explicitly blocks any Bash command that prefixes itself with JETBRAINS_ROUTER_*=… (e.g. JETBRAINS_ROUTER_DISABLE=1 cat foo). Setting these in a command does not actually disable the hook — the hook reads its own process env, not the inner command's — and pattern-bypassing through env-prefix tricks is treated as a bypass attempt. If a redirect is genuinely wrong (binary file mistakenly matched, exotic flag combo), surface that to the user; do not work around it.
Read / Grep / Glob / Edit / Write of a session, verify mcp__webstorm__*, mcp__rider__*, or mcp__idea__* tools are listed. If yes, use the IDE replacement; if no, use native.get_project_modules once to confirm the project is what you expect. If all modules report as WEB_MODULE and the project has .kt or .java files, fall back to native tools for the session — see "Stay on native tools for".search_symbol returns a result, check lineText first — it often contains the full implementation body (reliable in WebStorm and IDEA; Rider resolves the file but lineText contains only the first line). Only call read_file if you need more context than lineText provides.search_symbol returns empty for a symbol you can confirm exists in a source file, the language is not indexed by this IDE — switch to search_in_files_by_text for the rest of the session and do not retry search_symbol.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.