What problem does it solve? Testing a remote MCP (Model Context Protocol) server for correctness is hard: transport quirks, credential scoping, error envelopes, and parity with REST/GraphQL surfaces all need systematic verification against a live endpoint rather than unit tests. This Skill provides a structured bug-hunting workflow that exercises the real POST /api-gateway/mcp endpoint and turns surprising behavior into deduplicated, reproducible findings. ## Core Features & Use Cases - Journey-based sweeps: Covers transport, discovery, credential boundaries, reads, resources, writes, prompts, result envelope, rate limits, account tools, and real MCP client sessions, each with observable promises to check. - Credential-safe testing: Uses a bundled helper script so API tokens never reach argv, transcripts, or tool calls, and enforces QA-only accounts and synthetic ledgers for write journeys. - Parity and root-cause analysis: Compares MCP results against REST/GraphQL controls, traces failures to specific source files, distinguishes deployment lag from real bugs, and deduplicates against existing board items. - Use Case: Run an anonymous transport and discovery check against production, then use a pinned read-only key to verify every write tool returns FORBIDDEN, filing any confirmed defect with a minimal reproducer. ## Quick Start Ask the agent to run the MCP bug hunt against the default production endpoint, optionally naming specific journeys, a QA ledger, and providing credential environment variable names.
