harness-mcp-scan
Static security scan of a harness's declared MCP surface via `harness mcp-scan <path>`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.
Profile →npx skills add ruvnet/ruflo --skill harness-mcp-scan --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
Calls `harness mcp-scan` to enumerate every declared MCP server + tool and flag policy / permission / dependency issues. Never executes any tool; pure static analysis. ## Algorithm Implementation: [`scripts/mcp-scan.mjs`](../../scripts/mcp-scan.mjs). 1. Invoke the pinned `harness` binary (`metaharness@~0.3.0`, resolved from a local install or the one-time `~/.ruflo/metaharness-cache-<pin>` cache — never `@latest`): `harness mcp-scan <path> --json`. 2. Parse `findings[]` with `{ severity, id, server, tool, message }`. 3. `--fail-on <severity>`: exit 1 when any finding is at or above that level. Default `high`. 4. Output JSON (default) or markdown table. ## Severity rank | Severity | Rank | |---|---:| | low | 1 | | medium | 2 | | high | 3 | `--fail-on high` (default) only fails on HIGH; `--fail-on medium` also fails on MEDIUM; `--fail-on low` fails on any finding. ## CI integration ```yaml - name: MCP static scan run: node plugins/ruflo-metaharness/scripts/mcp-scan.mjs --fail-on high ``` The exit code is the only thing CI watches; the JSON output goes to artifacts for human review. ## Graceful degradation When `harness` binary is unavailable (no network, blocked registry), emits stru
- Algorithm
- Severity rank
- CI integration
- Graceful degradation
What does the harness-mcp-scan skill do?
Static security scan of a harness's declared MCP surface via `harness mcp-scan <path>`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.
How do I install it?
Run `npx skills add ruvnet/ruflo --skill harness-mcp-scan --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From ruvnet/ruflo, a repository with 67,015 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.