skills.rest
ruvnet
ruvnetCOMMUNITY
Explore all skills by this author →
Website𝕏@ruvGitHub

harness-mcp-scan

Statically scans declared MCP servers and tools for policy and permission findings.

70.1k|8.4k|Updated Jun 2, 2025
Search Tags:#static analysis#mcp#security scan#policy#ci#harness#Severity
One-click install
npx skills add https://github.com/ruvnet/claude-flow --skill harness-mcp-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: harness-mcp-scan
Source: https://github.com/ruvnet/claude-flow/tree/main/plugins/ruflo-metaharness/skills/harness-mcp-scan
Command: npx skills add https://github.com/ruvnet/claude-flow --skill harness-mcp-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Teams declaring MCP servers and tools in a harness configuration need a way to catch policy, permission, and dependency issues before deployment, without actually executing any of those tools.

Core Features & Use Cases

  • Static MCP Surface Scan: Enumerates every declared MCP server and tool from .mcp/servers.json and .harness/claims.json without dispatching or executing anything.
  • Severity-Gated Exit Codes: Fails CI with exit code 1 when findings meet or exceed a configurable --fail-on threshold (low, medium, or high).
  • Graceful Degradation: Emits a structured { degraded: true } result and exits 0 when the harness binary is unavailable, so pipelines never hard-fail on tooling issues.
  • Use Case: Add a CI step that runs the scan with --fail-on high on every pull request, archiving the JSON findings as artifacts for security review.

Quick Start

Run a static security scan of the MCP servers declared in this repository and fail on any high-severity findings.

Frequently Asked Questions about harness-mcp-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I statically scan MCP servers for security issues?▼

Run the harness mcp-scan command against your project path to enumerate every declared MCP server and tool from .mcp/servers.json and .harness/claims.json. It flags policy, permission, and dependency issues without executing any tool.

How do I fail a CI pipeline on high-severity MCP findings?▼

Run the scan with --fail-on high so it exits with code 1 whenever any finding is at or above high severity. Use --fail-on medium or low to make the gate stricter; the JSON output can be archived as a CI artifact.

Does the MCP scan execute any of the declared tools?▼

No, the scan is pure static analysis. It only reads the declared configuration files and never dispatches or invokes any MCP tool, making it safe to run in CI environments.

What happens when the harness binary is not available?▼

The scan degrades gracefully by emitting a structured result with degraded set to true and reason metaharness-not-available, then exits 0. This lets pipelines continue when the network or registry is blocked.

What severity levels does the MCP scan report?▼

Findings are ranked low, medium, or high. The default --fail-on threshold is high, meaning only high-severity findings cause a non-zero exit unless you lower the threshold.

Related Skills

Explore More Software Engineering Skills→
thisrohanguptathisrohangupta
1

create-environment

Generate Harness environment YAML configurations and push them via MCP.

Community
Intermediate
ashwnnashwnn

insecure-defaults

Scan codebases for hardcoded secrets, weak cryptography, permissive policies, and debug flags.

Community
Advanced
devkenidevkeni
1

container-security

Scan Docker images, audit Kubernetes clusters, and monitor container runtimes for security weaknesses.

Community
Advanced
RangeyRoverRangeyRover
3

speckit.checker

Run static analysis across multiple languages and generate prioritized issue reports.

Community
Intermediate