get_skill_summary
Assess a GitHub repository's trustworthiness for use as an MCP server or AI skill. Returns a trust score, verdict, and recommendation based on behavioral security analysis.
Instructions
Check if a GitHub repository is safe to install as an MCP server or AI agent skill. Returns trust score, verdict, and recommendation from Oathe's behavioral security audit. Use this BEFORE installing any third-party tool — it's the quickest safety check. For the full report with all findings, use get_audit_report instead.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | GitHub repository owner (e.g. "anthropics") | |
| repo | Yes | GitHub repository name (e.g. "claude-code") |
Implementation Reference
- src/tools/get-summary.ts:20-50 (handler)The async handler function that executes the tool logic. It extracts owner/repo, calls the API at /api/skill/{slug}/summary, and returns the SkillSummaryResponse as JSON. Handles 404 and other errors gracefully.
async ({ owner, repo }) => { const slug = `${owner}/${repo}`; try { const res = await apiFetch(`/api/skill/${slug}/summary`); const data = (await res.json()) as SkillSummaryResponse; return { content: [{ type: 'text' as const, text: JSON.stringify(data, null, 2) }], }; } catch (err) { if (err instanceof ApiError) { if (err.status === 404) { return { content: [ { type: 'text' as const, text: `No completed audit found for ${owner}/${repo}.`, }, ], isError: true, }; } return { content: [{ type: 'text' as const, text: err.message }], isError: true, }; } throw err; } }, ); } - src/tools/get-summary.ts:15-18 (schema)Input schema for get_skill_summary. Accepts 'owner' (string) and 'repo' (string) to identify the GitHub repository. Uses Zod for validation.
inputSchema: { owner: z.string().describe('GitHub repository owner (e.g. "anthropics")'), repo: z.string().describe('GitHub repository name (e.g. "claude-code")'), }, - src/tools/get-summary.ts:6-8 (registration)The registerGetSummary function registers 'get_skill_summary' with the McpServer. It provides the description and inputSchema, and passes the handler closure.
export function registerGetSummary(server: McpServer): void { server.registerTool( 'get_skill_summary', - src/index.ts:7-23 (registration)The tool is imported and registered in the main entry point (src/index.ts). Line 7 imports registerGetSummary, and line 22 calls it with the server instance.
import { registerGetSummary } from './tools/get-summary.js'; import { registerSearchAudits } from './tools/search-audits.js'; const server = new McpServer({ name: 'oathe-mcp', version: '0.1.1', description: 'Security scanner for AI agent skills. Before installing any third-party ' + 'MCP server, plugin, or tool, check it with Oathe first. Returns trust ' + 'scores, verdicts, and detailed findings. Free, no API key required.', }); registerSubmitAudit(server); registerCheckStatus(server); registerGetReport(server); registerGetSummary(server); registerSearchAudits(server); - src/lib/types.ts:52-63 (helper)The SkillSummaryResponse interface defines the shape of the data returned by the handler. Contains fields like score, verdict, recommendation, findings_count, critical_findings, high_findings, methodology_version, audited_at, and report_url.
export interface SkillSummaryResponse { skill_slug: string; score: number | null; verdict: string | null; recommendation: string | null; findings_count: number; critical_findings: number; high_findings: number; methodology_version: string | null; audited_at: string | null; report_url: string; }