Skip to content
cccskills
FreePublished on GitHubEnglish overview

harness-mcp-scan

Scan declared MCP servers and tools for permission, policy, and dependency issues without executing them. Produce JSON or a Markdown table, and set a severity threshold that determines whether a CI check fails.

OriginalShow the original description

Static security scan of a harness's declared MCP surface via `harness mcp-scan {path}`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.

ruvnet/ruflo
AI rating90/ 100See how to install

Good for

  • Review declared MCP server and tool permissions
  • Check policy and dependency issues in MCP configuration
  • Fail CI when findings reach a chosen severity
  • Export scan findings for human review

Overview

What it does

harness-mcp-scan checks declared MCP servers and tools for permission, policy, and dependency issues. MCP is a mechanism that connects agents to external tools. The skill reads .mcp/servers.json and .harness/claims.json, analyzing their configuration statically without executing the tools. Results are available as JSON or a Markdown table.

When it helps

It suits developers reviewing MCP configuration and teams adding automated checks to CI. Each finding includes a severity, identifier, affected server and tool, and an explanation, so the output also supports human review.

Example requests

  • “Scan the MCP configuration at this path and show the results in a table.”
  • “Fail CI if any issue has a severity of medium or higher.”

Notes

A working harness environment is required. The skill uses the pinned version range metaharness@~0.4.1, resolved from a local installation or dedicated cache. The default failure threshold is high. If the executable is unavailable, it returns degraded: true and exits with code 0 to indicate that scanning was unavailable. This exit does not mean that no issues were found.

This overview was written by AI (OpenAI Codex) from the public SKILL.md. Check the original below for the exact behavior.

Objective evaluation

AI rated this skill on four points using only the contents of its SKILL.md. Stars and popularity are not taken into account.

Clear instructionsIs it clear when to use it and what it does?
AGoodIt explicitly scans declared MCP configuration for permission, policy, and dependency issues without executing tools.
Concrete stepsAre steps, inputs, outputs, and examples spelled out?
AGoodIt specifies the command, finding fields, severity-based exit conditions, and output formats.
SafetyAre sending data, deleting files, and running commands disclosed?
AGoodThe scan only reads configuration, never executes tools, and explicitly reports degraded output when scanning is unavailable.
Easy setupDoes it need few tools or API keys, and are they documented?
BPartly lackingIt names the metaharness version and local or cache resolution locations but provides no installation procedure.

The total counts each point as A = 25, B = 15, C = 5. Rated by AI (OpenAI Codex) as of Oct 21, 2026. Treat it as a guide and read the original before installing.

Disagree? Request a re-evaluation

Tell us which point is wrong and why. No login needed. We will check it against the SKILL.md, redo the evaluation, and show the result here.

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

Files included (1)

  • SKILL.md1.7 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Calls harness mcp-scan to enumerate every declared MCP server + tool and flag policy / permission / dependency issues. Never executes any tool; pure static analysis.

Algorithm

Implementation: scripts/mcp-scan.mjs.

  1. Invoke the pinned harness binary (metaharness@~0.4.1, resolved from a local install or the one-time ~/.ruflo/metaharness-cache-<pin> cache — never @latest): harness mcp-scan <path> --json.
  2. Parse findings[] with { severity, id, server, tool, message }.
  3. --fail-on <severity>: exit 1 when any finding is at or above that level. Default high.
  4. Output JSON (default) or markdown table.

Severity rank

SeverityRank
low1
medium2
high3

--fail-on high (default) only fails on HIGH; --fail-on medium also fails on MEDIUM; --fail-on low fails on any finding.

CI integration

- name: MCP static scan
  run: node plugins/ruflo-metaharness/scripts/mcp-scan.mjs --fail-on high

The exit code is the only thing CI watches; the JSON output goes to artifacts for human review.

Graceful degradation

When harness binary is unavailable (no network, blocked registry), emits structured { degraded: true, reason: 'metaharness-not-available' } and exits 0. Ruflo continues — ADR-150 architectural constraint.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

add-model-descriptions

FreeSummaryAI rating 80

Compare models available through the HuggingFace router with chat-ui configuration, research missing models, and write short English descriptions of their architecture and capabilities. Add entries to both production and development configuration files and commit the changes.

  • Adding newly available router models to chat-ui
  • Writing concise descriptions of model capabilities
  • Updating production and development model entries together
ruvnet/ruflo78.1KUpdated Oct 21, 2026

adr-create

FreeSummaryAI rating 80

Create an Architecture Decision Record, a document for recording important design choices, with the next sequential number. It generates a Markdown template, registers the record in AgentDB, and links related decisions found through search.

  • Record the reasoning behind adopting a technology
  • Start an ADR for an API or data model change
  • Document an infrastructure decision
ruvnet/ruflo78.1KUpdated Oct 21, 2026

adr-index

FreeSummaryAI rating 90

Build a searchable index and relationship graph from ADRs, records of architectural decisions. Import two supported document formats, refresh existing metadata without duplicate relationships, and review summaries of statuses, missing references, and inconsistencies.

  • Index ADRs imported from another project
  • Refresh a graph that differs from files on disk
  • Set up ADR tracking in an existing codebase
ruvnet/ruflo78.1KUpdated Oct 21, 2026

adr-reindex

FreeSummaryAI rating 70

Rebuild the index of ADRs, records of architectural decisions, after files or relationship lines are deleted. It clears stored records and relationships, indexes the files still present, and checks that the final record count matches.

  • Rebuild the index after deleting an ADR file
  • Remove stale relationships after editing an ADR
  • Reconcile the ADR index on a schedule
ruvnet/ruflo78.1KUpdated Oct 21, 2026

adr-review

FreeSummaryAI rating 80

Review code changes against accepted Architecture Decision Records, documents that capture agreed design choices. Report violations, outdated references, compliant changes, and areas without ADR coverage, then suggest code fixes or a new decision record where appropriate.

  • Check a pull request before merging
  • Review major code changes against agreed design decisions
  • Find references to superseded ADRs
ruvnet/ruflo78.1KUpdated Oct 21, 2026

adr-verify

FreeSummaryAI rating 90

Check saved architecture decision records (ADRs) for broken references, circular replacement relationships, and inconsistent statuses. Use the results to verify imported records or stop a CI check when selected integrity rules fail.

  • Checking ADR integrity after import
  • Blocking CI when ADR issues are found
  • Reviewing ADR data before a release
ruvnet/ruflo78.1KUpdated Oct 21, 2026

See all skills by ruvnet

Report a problem with this skill