zephex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited zephex (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ten tools at https://zephex.dev/mcp for the user's project — not training data.
They may only say "use Zephex" or "use MCP." You choose the tool and call it (find_code, read_code, …). Some editors show zephex:find_code — same tool.
| Situation | Chain |
|---|---|
| New repo | get_project_context → optional explain_architecture |
| Feature, fix, refactor | scope_task → read_code on focus_files |
| Unknown location | find_code → read_code |
| Large rename | find_code + exhaustive: true → files_summary |
| Add or upgrade dependency | check_package → audit_package if needed |
| Stuck after 2+ tries | keep_thinking ↔ find_code / read_code |
| Production URL | audit_headers |
| Generic patterns (not their repo) | Zephex_dev_info search → get |
`path` on every repo tool: absolute folder (/Users/jane/api) or github:owner/repo. Monorepo: path = app root, not empty parent.
`inline_files`: only without disk access — { "rel/path": "<full file text>" }.
Max 3 calls of the same tool per turn without new evidence.
New repo or vague ask:
get_project_context({ "path": "/abs/project", "detail_level": "brief" })Before reading many files for a task:
scope_task({
"task": "Add rate limiting to POST /api/upload",
"path": "/abs/project",
"hint_symbols": ["handleUpload"]
})Use focus_files, callers_at_risk, suggested_approach. Good task: one clear sentence. Bad: "fix it".
Known symbol:
read_code({ "target": "handleUpload", "path": "/abs/project" })Unknown location:
find_code({ "query": "validateToken", "path": "/abs/project", "scope": "definitions" })Then read_code on the best hit. Skip find_code if you already know the symbol.
check_package({ "package": "express", "ecosystem": "npm" })explain_architecture({ "path": "/abs/project", "focus": "auth" })audit_headers({ "url": "https://example.com" })keep_thinking({
"thought": "Hypothesis: rate limit runs after handler",
"thoughtNumber": 1,
"totalThoughts": 5,
"nextThoughtNeeded": true,
"confidence": 0.6,
"thoughtType": "hypothesis",
"goalAnchor": "Add rate limiting to POST /api/upload",
"lastActions": ["find_code(query=rateLimit)"]
})Tool name is `keep_thinking`, not thinking.
Zephex_dev_info({ "operation": "search", "query": "Stripe webhook signature" })Then operation: "get" with the slug from search.
| Tool | When | Key args |
|---|---|---|
get_project_context | New session | path, force? |
scope_task | Task before bulk reads | task, path, hint_symbols?, max_files? (1–15) |
find_code | Don't know where | query, path, scope?, exhaustive? |
read_code | Known symbol/files | target or mode+files, path |
check_package | Before install | package, ecosystem |
audit_package | Upgrade/CVE | package, task, from_version? |
explain_architecture | How this repo works | path, focus? |
audit_headers | User gave URL | url |
keep_thinking | Stuck / risky change | thought, thoughtNumber, goalAnchor, lastActions |
Zephex_dev_info | Playbooks | operation: search → get |
read_code callers / blast_radius: local path only — on github: use find_code usages.
path + specific args.| Error | Action |
|---|---|
| Unauthorized | npx zephex setup |
| 429 | Tell user; retry once |
Missing path | Ask absolute project directory |
check_packagescope_taskfind_code when target is knownthinking instead of keep_thinking~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.