mcp server publish gate

Model Context Protocol (MCP) servers often fail in production because agents cannot interpret their tools or because they lack safety guards. This skill provides a rigorous pre-flight audit for MCP servers before they are published to registries like Smithery or deployed to internal teams. It identifies silent protocol failures, ambiguous tool descriptions, and security risks.

What it does

• Schema validation checks that inputSchema uses narrow types and explicit properties while blocking additionalProperties injection surfaces.
• Agent clarity scoring evaluates tool descriptions to ensure they specify exact triggers and return values for LLM reasoning.
• Safety annotation audit identifies missing destructiveHint or readOnlyHint flags on sensitive operations like payments or deletions.
• Transport verification scans for console.log statements in stdio paths that corrupt the protocol and cause silent agent crashes.
• Error path analysis flags tools that return empty objects or stack traces instead of actionable instructions for agent self-correction.

How it works

1. Point the skill to your server manifest (package.json) and tool implementation source files.
2. The agent executes a 7-gate audit covering schema, descriptions, safety, secrets, errors, transport, and runtime rails.
3. It generates a status table showing PASS/FAIL/WARN for every gate across your toolset.
4. You receive a prioritized remediation list ordered by severity to fix before publishing.

Frameworks & tools

Works with any MCP server implementation, specifically targeting stdio and sse transport layers. Supports Node.js, Python, and Go implementations following the Model Context Protocol specification.

Why this beats prompting it yourself

Generic prompts miss the subtle technicalities of the MCP spec, such as how stray stdout logs break the JSON-RPC framing or why agents ignore tools with broad schemas. This skill uses a structured 7-gate framework developed specifically for agentic interoperability and safety.

Use cases

• Auditing a server before submitting to the Smithery or Agensi registries.
• Debugging a tool that an agent refuses to call or calls with the wrong parameters.
• Performing a safety review on inherited code before granting an agent write access.
• Hardening a wrapper for a paid API to prevent unexpected token usage or costs.

Known limitations

Performs static analysis of code and manifests only. It does not execute tools against live environments or verify third-party API credentials. Audit results for registry requirements are advisory.