jpyc-agent-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited jpyc-agent-mcp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the task is specifically about operating JPYC Agent MCP through Codex or Claude Code.
Claude Code does not auto-handle OAuth for streamable-http MCP servers. If the JPYC Agent MCP tools are not available as native MCP tools, use the helper script to call tools through the Bash tool:
# Check authentication
powershell.exe -ExecutionPolicy Bypass -File scripts/jpyc_oauth_cache.ps1 auth-status
# Call any tool
powershell.exe -ExecutionPolicy Bypass -File scripts/jpyc_oauth_cache.ps1 call-tool -Tool <tool_name> -Arguments '<json>'If the user has not authenticated yet, guide them through:
scripts/jpyc_oauth_cache.ps1 start -OpenBrowser (Windows) or scripts/jpyc_oauth_cache.py start --open-browser (macOS/Linux)authorization_url in a browser and grant consentscripts/jpyc_oauth_cache.ps1 wait -AuthSessionId <id> to save the tokenFor the full setup guide, see docs/claude-code.md.
This skill is for these tool families:
auth_statuslist_agent_wallets, get_agent_wallet, create_agent_wallet, get_agent_wallet_balancequote_transfer, transfer_jpyc, list_transactions, get_transfer_statusread_contract, quote_contract_write, execute_contract_write, list_contract_call_history, get_contract_call_statusDo not invent tools or assume direct signer access, private keys, or backdoor admin capabilities.
list_agent_wallets before creating a new wallet.quote_transfer -> transfer_jpycquote_contract_write -> execute_contract_writeagent_wallet_id over fuzzy identification when the user already has it.to_address and amount_jpyc.https://jpyc-info.com/mcp/connect as the canonical human fallback.https://jpyc-info.com/api/jpyc-agent-oauth/start plus auth-session polling when the client needs a low-level manual OAuth flow for debugging or compatibility reasons.scripts/jpyc_oauth_cache.ps1 (PowerShell) or scripts/jpyc_oauth_cache.py (Python) and the workflow documented in docs/local-token-cache.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.