# Auto Skill Build Mcp Conformance Harness

> >

- **Type:** Skill
- **Install:** `agentstack add skill-arnie016-codex-prompt-templates-auto-skill-build-mcp-conformance-harness`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Arnie016](https://agentstack.voostack.com/s/arnie016)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Arnie016](https://github.com/Arnie016)
- **Source:** https://github.com/Arnie016/codex-prompt-templates/tree/main/skills/auto-skill-build-mcp-conformance-harness
- **Website:** https://github.com/Arnie016/codex-prompt-templates

## Install

```sh
agentstack add skill-arnie016-codex-prompt-templates-auto-skill-build-mcp-conformance-harness
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP Conformance Harness

Generated by: Codex Supercharge maintenance automation.

Goal: turn MCP server testing into a repeatable harness with clear evidence,
secret handling, and pass/fail gates.

## Workflow

1. Use `$sandbox-source-intake` and `$mcp-safety-review` before running a fresh
   MCP server, unknown CLI, install script, or broad-account tool.
2. Identify the target matrix:
   - transport: HTTP or stdio
   - auth: none, static token, OAuth interactive, OAuth headless, or M2M
   - checks: doctor, tool surface, protocol, OAuth, apps UI
3. Prefer read-only checks first: `server probe`, `server doctor`, and
   `server export` with `--no-telemetry` and JSON output.
4. Add `protocol`, `oauth`, or `apps` conformance suites only after auth and
   blast radius are understood; emit JUnit/XML or JSON summary artifacts.
5. Capture before/after `server export` snapshots and sort them before diffing
   when release tool-surface drift is the risk.
6. Use the command recipes in `references/mcp-conformance-harness.md` instead
   of expanding long shell blocks into the skill body.
7. Store reports as CI artifacts, but keep credentials out of artifacts. Prefer
   environment secrets, credentials files with mode `0600`, or CI secret stores.
8. Summarize failures by phase: transport, auth, protocol, tool schema, apps UI,
   or release diff.

## Harness Contract

```md
# MCP Harness Plan
Target:
Transport/auth:
Read-only checks:
Conformance suites:
Tool-surface diff:
Secrets:
Artifacts:
Pass/fail gates:
Known skips:
```

## Skip When

- The user only wants to manually explore one server once.
- No MCP endpoint, stdio command, or runnable server target is available.
- The server/tool is untrusted and has not passed source intake or safety review.
- Running the harness would call write/destructive tools without explicit scope.

## References

- `references/mcp-conformance-harness.md`
- Source inspiration only, code not executed: `sources/mcpjam-inspector`
- Support skills: `$mcp-server-lab`, `$mcp-safety-review`, `$auto-skill-safety-mcp-secret-guard`

## Validation

```bash
plugins/codex-supercharge/scripts/skill_audit.sh plugins/codex-supercharge/skills
python3 "$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py" \
  plugins/codex-supercharge/skills/auto-skill-build-mcp-conformance-harness
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Arnie016](https://github.com/Arnie016)
- **Source:** [Arnie016/codex-prompt-templates](https://github.com/Arnie016/codex-prompt-templates)
- **License:** MIT
- **Homepage:** https://github.com/Arnie016/codex-prompt-templates

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-arnie016-codex-prompt-templates-auto-skill-build-mcp-conformance-harness
- Seller: https://agentstack.voostack.com/s/arnie016
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.