Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Ruvnet/Harness Mcp Scan — measured AI agent skill | DecimalAI

ruvnet/harness-mcp-scan

SkillScore95Maintained

Static security scan of a harness's declared MCP surface via `harness mcp-scan <path>`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.

by ruvnet

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull ruvnet-harness-mcp-scan

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/ruvnet-harness-mcp-scan/SKILL.md

Raw file: /s/ruvnet-harness-mcp-scan/SKILL.md ↗ · machine-readable summary at /s/ruvnet-harness-mcp-scan.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 2d ago

—-35% tokens0% turns95% of whole cases pass with skill (21/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	-15%	0%
case-05	✗→✓	▲ Improved	-27%	0%
case-02	✗→✓	▲ Improved	92%	0%
case-01	✗→✓	▲ Improved	-12%	0%
case-07	✗→✓	▲ Improved	-25%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/2/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

ruvnet / ruflo

plugins/ruflo-metaharness/skills/harness-mcp-scan/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

Calls harness mcp-scan to enumerate every declared MCP server + tool and flag policy / permission / dependency issues. Never executes any tool; pure static analysis.

Algorithm

Implementation: scripts/mcp-scan.mjs.

Invoke the pinned harness binary (metaharness@~0.3.0, resolved from a

local install or the one-time ~/.ruflo/metaharness-cache-<pin> cache — never @latest): harness mcp-scan <path> --json.

Parse findings[] with { severity, id, server, tool, message }.
--fail-on <severity>: exit 1 when any finding is at or above that

level. Default high.

Output JSON (default) or markdown table.

Severity rank

| Severity | Rank | |---|---:| | low | 1 | | medium | 2 | | high | 3 |

--fail-on high (default) only fails on HIGH; --fail-on medium also fails on MEDIUM; --fail-on low fails on any finding.

CI integration

yaml
- name: MCP static scan
  run: node plugins/ruflo-metaharness/scripts/mcp-scan.mjs --fail-on high

The exit code is the only thing CI watches; the JSON output goes to artifacts for human review.

Graceful degradation

When harness binary is unavailable (no network, blocked registry), emits structured { degraded: true, reason: 'metaharness-not-available' } and exits 0. Ruflo continues — ADR-150 architectural constraint.

Want to see if ruvnet/harness-mcp-scan would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.