Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Static security scan of a harness's declared MCP surface via `harness mcp-scan <path>`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.
.claude/skills/ruvnet-harness-mcp-scan/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-04 | ✗→✓ | ▲ Improved | -15% | 0% |
| case-05 | ✗→✓ | ▲ Improved | -27% | 0% |
| case-02 | ✗→✓ | ▲ Improved | 92% | 0% |
| case-01 | ✗→✓ | ▲ Improved | -12% | 0% |
| case-07 | ✗→✓ | ▲ Improved | -25% | 0% |
Calls harness mcp-scan to enumerate every declared MCP server + tool and flag policy / permission / dependency issues. Never executes any tool; pure static analysis.
Implementation: scripts/mcp-scan.mjs.
harness binary (metaharness@~0.3.0, resolved from alocal install or the one-time ~/.ruflo/metaharness-cache-<pin> cache — never @latest): harness mcp-scan <path> --json.
findings[] with { severity, id, server, tool, message }.--fail-on <severity>: exit 1 when any finding is at or above thatlevel. Default high.
| Severity | Rank | |---|---:| | low | 1 | | medium | 2 | | high | 3 |
--fail-on high (default) only fails on HIGH; --fail-on medium also fails on MEDIUM; --fail-on low fails on any finding.
yaml- name: MCP static scan run: node plugins/ruflo-metaharness/scripts/mcp-scan.mjs --fail-on high
The exit code is the only thing CI watches; the JSON output goes to artifacts for human review.
When harness binary is unavailable (no network, blocked registry), emits structured { degraded: true, reason: 'metaharness-not-available' } and exits 0. Ruflo continues — ADR-150 architectural constraint.
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-20 | pass→pass | 19,057 | 13,103 | -31% | 1 | 1 | 0% | 3,617 | 3,159 | -13% | 0 | 0 | — |
case-04 | fail→pass | 10,261 | 5,906 | -42% | 1 | 1 | 0% | 1,727 | 1,460 | -15% | 0 | 0 | — |
case-05 | fail→pass | 10,687 | 4,836 | -55% | 1 | 1 | 0% | 1,771 | 1,284 | -27% | 0 | 0 | — |
case-02 | fail→pass | 5,879 | 7,875 | +34% | 1 | 1 | 0% | 1,016 | 1,955 | +92% | 0 | 0 | — |
case-03 | fail→fail | 12,976 | 12,772 | -2% | 1 | 1 | 0% | 2,659 | 1,942 | -27% | 0 | 0 | — |
case-01 | fail→pass | 14,127 | 23,911 | +69% | 1 | 1 | 0% | 2,724 | 2,408 | -12% | 0 | 0 | — |
case-06 | pass→pass | 11,822 | 2,833 | -76% | 1 | 1 | 0% | 1,965 | 868 | -56% | 0 | 0 | — |
case-07 | fail→pass | 16,852 | 4,098 | -76% | 1 | 1 | 0% | 1,069 | 800 | -25% | 0 | 0 | — |
case-08 | pass→pass | 6,281 | 2,916 | -54% | 1 | 1 | 0% | 1,079 | 926 | -14% | 0 | 0 | — |
case-09 | pass→pass | 7,152 | 2,439 | -66% | 1 | 1 | 0% | 1,226 | 828 | -32% | 0 | 0 | — |
case-19 | pass→pass | 10,653 | 7,071 | -34% | 1 | 1 | 0% | 2,001 | 1,789 | -11% | 0 | 0 | — |
case-10 | fail→pass | 25,768 | 2,787 | -89% | 1 | 1 | 0% | 2,443 | 694 | -72% | 0 | 0 | — |
case-11 | fail→pass | 11,149 | 4,320 | -61% | 1 | 1 | 0% | 1,206 | 718 | -40% | 0 | 0 | — |
case-12 | fail→pass | 12,315 | 2,837 | -77% | 1 | 1 | 0% | 2,062 | 990 | -52% | 0 | 0 | — |
case-13 | pass→pass | 15,823 | 1,439 | -91% | 1 | 1 | 0% | 2,836 | 639 | -77% | 0 | 0 | — |
case-14 | fail→pass | 13,333 | 1,649 | -88% | 1 | 1 | 0% | 1,349 | 665 | -51% | 0 | 0 | — |
case-15 | fail→pass | 4,873 | 1,444 | -70% | 1 | 1 | 0% | 824 | 651 | -21% | 0 | 0 | — |
case-16 | fail→pass | 6,961 | 1,238 | -82% | 1 | 1 | 0% | 1,160 | 571 | -51% | 0 | 0 | — |
case-17 | fail→pass | 8,757 | 1,741 | -80% | 1 | 1 | 0% | 1,825 | 727 | -60% | 0 | 0 | — |
case-18 | fail→pass | 18,641 | 2,471 | -87% | 1 | 1 | 0% | 3,271 | 658 | -80% | 0 | 0 | — |
case-21 | pass→pass | 9,264 | 7,592 | -18% | 1 | 1 | 0% | 1,818 | 1,819 | +0% | 0 | 0 | — |
case-22 | pass→pass | 14,650 | 9,134 | -38% | 1 | 1 | 0% | 2,695 | 2,215 | -18% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +59 percentage points is the difference between those two pass rates over the 21 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.