mcpField
H
harness-mcp-scan

harness-mcp-scan

github.com/ruvnetSecurity80.0k236 installsUpdated today
Repository

About harness-mcp-scan

harness-mcp-scan is a static-analysis skill for reviewing declared MCP servers and tools for policy, permission, and dependency issues. It is suited to repository maintainers and CI pipelines; it does not execute tools and can produce JSON or Markdown output.

Key features

  1. 01Enumerates declared MCP servers and tools
  2. 02Flags policy, permission, and dependency issues
  3. 03Fails at a configurable severity threshold
  4. 04Outputs JSON or Markdown
  5. 05Degrades gracefully when harness is unavailable

Use cases

  1. 01Check MCP configurations in CI
  2. 02Review scan findings as JSON artifacts
  3. 03Run scans when harness is locally available

MCP support

Scans declared MCP servers and tools for static findings; it does not call or execute their tools.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/ruvnet/ruflo --skill harness-mcp-scan

After installing, type/harness-mcp-scanin Claude Code to confirm it loaded.

Details

From the project README

Calls harness mcp-scan to enumerate every declared MCP server + tool and flag policy / permission / dependency issues. Never executes any tool; pure static analysis.

Algorithm

Implementation: scripts/mcp-scan.mjs.

  1. Invoke the pinned harness binary (metaharness@~0.4.1, resolved from a local install or the one-time ~/.ruflo/metaharness-cache-<pin> cache — never @latest): harness mcp-scan <path> --json.
  2. Parse findings[] with { severity, id, server, tool, message }.
  3. --fail-on <severity>: exit 1 when any finding is at or above that level. Default high.
  4. Output JSON (default) or markdown table.

Severity rank

SeverityRank
low1
medium2
high3

--fail-on high (default) only fails on HIGH; --fail-on medium also fails on MEDIUM; --fail-on low fails on any finding.

CI integration

- name: MCP static scan
  run: node plugins/ruflo-metaharness/scripts/mcp-scan.mjs --fail-on high

The exit code is the only thing CI watches; the JSON output goes to artifacts for human review.

Graceful degradation

When harness binary is unavailable (no network, blocked registry), emits structured { degraded: true, reason: 'metaharness-not-available' } and exits 0. Ruflo continues — ADR-150 architectural constraint.

Comments

Markdown supported