deploy-mcp-runrunit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-mcp-runrunit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guides version bump and changelog for the mcp-runrunit npm package. Build and publish run automatically on merge to `main` (GitHub Actions).
Publish is automatic: the workflow .github/workflows/release-mcp-runrunit.yml runs on push to main (when mcp-runrunit/** or the workflow file change). It builds, publishes to npm, and creates the git tag. You only need to update the version and changelog before merging to main.
Copy and track progress:
Release progress:
- [ ] 1. Bump version (semver)
- [ ] 2. Update package.json version
- [ ] 3. Update server.json version (both places)
- [ ] 4. Update CHANGELOG.md
- [ ] 5. Commit, push, and open/merge PR to main (CI will publish)| Bump | When to use | Example |
|---|---|---|
| Patch (x.y.Z) | Bug fixes, small changes, no API change | 1.0.1 → 1.0.2 |
| Minor (x.Y.0) | New features, backward compatible | 1.0.2 → 1.1.0 |
| Major (X.0.0) | Breaking changes, incompatible API | 1.1.0 → 2.0.0 |
Use the new version (e.g. 1.0.2) in all following steps.
File: mcp-runrunit/package.json
Update only the version field (line 3):
"version": "1.0.2",File: mcp-runrunit/server.json
Update both version fields to the same value:
"version": "1.0.2", "version": "1.0.2",Keep all three version values identical (package.json + server.json root + server.json packages[0]).
File: mcp-runrunit/CHANGELOG.md
Use Keep a Changelog format. Add a new section at the top (below the title) for the release.
## [X.Y.Z] - YYYY-MM-DD
### Added
- New feature description.
### Changed
- Change description.
### Fixed
- Bug fix description.
### Removed
- Removed feature (if any).YYYY-MM-DD.# Changelog
## [1.0.2] - 2025-03-09
### Fixed
- Correct task filter when using `ids` in list_tasks.
### Added
- Support for `link_da_branch` in task updates.
## [1.0.1] - 2025-03-01
...After updating version and changelog:
git add mcp-runrunit/package.json mcp-runrunit/server.json mcp-runrunit/CHANGELOG.md
git commit -m "chore(mcp-runrunit): release vX.Y.Z"vX.Y.ZNo local npm publish or manual tagging is required.
Before merging to main:
package.json, server.json (root), and server.json → packages[0].version[X.Y.Z] - date section at the top with correct sections (Added/Changed/Fixed/…)npm run build in mcp-runrunit| File | What to update |
|---|---|
mcp-runrunit/package.json | "version": "X.Y.Z" |
mcp-runrunit/server.json | "version": "X.Y.Z" (root and inside packages[0]) |
mcp-runrunit/CHANGELOG.md | New release section at top |
If the CI workflow fails with npm error code EOTP or "This operation requires a one-time password", the NPM_TOKEN does not bypass 2FA. Fix:
mcp-runrunit-github-actions).mcp-runrunit package (or "All packages").NPM_TOKEN at Settings → Secrets and variables → Actions.Token types like "Automation" (classic) can still require OTP with 2FA enabled; only granular tokens with "Bypass 2FA" work in CI.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.