AGENTS.md
+10 −10
https://raw.githubusercontent.com/cyanheads/first-epss-mcp-server/HEAD/AGENTS.md
− **Version:** 0.1.3− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.16`− Five read-only tools expose FIRST EPSS scores, daily history, threshold discovery, prioritization with caller-supplied CVSS base severity, and static reference guidance. There are no resources, prompts, apps, or user-data stores. FIRST is keyless; no server-specific environment variables are required. Standard framework configuration selects stdio or Streamable HTTP and optional HTTP authentication.− - **Literal accounting and completion.** Malformed identifiers render as Markdown-escaped JSON string literals to preserve embedded whitespace/control bytes; canonical CVEs stay plain. Measure the final escaped notice trailer. Exhausted batch/candidate offsets report completion; empty exact-year pages describe only that page. Threshold positive safe-integer limits above 10,000 clamp before the service call and disclose requested/applied values.− Handlers use `ctx.enrich({ notice })` for success caveats and `ctx.fail(reason)` for declared tool errors. The service threads `ctx.signal` through pacing, retries, body consumption, and model-header reads.− | `src/mcp-server/tools/{format,history,schemas}.ts` | Text output, exact-date policy, described schemas |− | `tests/` | Tool, service, and integration tests |− Run `bun run list-skills` for the current registry. Canonical development skills live in `framework-skills/`; agent copies live in `.claude/skills/` and `.agents/skills/`. They are contributor instructions, not installed plugin skills. After framework updates, follow `framework-skills/maintenance/SKILL.md` to sync them.− `manifest.json` defines the Node stdio MCPB launch. `.mcpbignore` excludes source, tests, scripts, coverage, and private material. `scripts/clean-mcpb.ts` prunes dev dependencies and dependency-shipped agent docs/native bindings after packing.− Keep package, registry, MCPB, Claude/Codex plugins, Docker labels, and README consistent. A new user-supplied env variable must be wired through `server.json`, MCPB `user_config` / `mcp_config.env`, Claude `userConfig`, and Codex `env_vars`. An empty runtime env value replaces the user's value; it is not an optional-config hint.+ **Version:** 0.2.0+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.18`+ Five read-only tools expose FIRST EPSS scores, daily history, threshold discovery, prioritization with caller-supplied CVSS base severity, and static reference guidance. One published Agent Skill, `skills/first-epss-guide/SKILL.md`, is served as `skill://` resources via `createApp({ skills: 'skills' })`; there are no other resources, prompts, apps, or user-data stores. Every gate and identifier claim in the skill is verified against live behavior — re-check it when tool behavior changes. FIRST i+ - **Literal accounting and completion.** Malformed identifiers render as Markdown-escaped JSON string literals to preserve embedded whitespace/control bytes; canonical CVEs stay plain. Measure the final quoted notice trailer (`measuredSurfaces` mirrors the framework's `ctx.enrich.notice` blockquote byte-for-byte). Exhausted batch/candidate offsets report completion; empty exact-year pages describe only that page. Threshold positive safe-integer limits above 10,000 clamp before the service call a+ Handlers use `ctx.enrich.notice(text)` for success caveats (a blockquote in `content[]`, the raw text in `structuredContent.notice`) and `ctx.fail(reason)` for declared tool errors. The service threads `ctx.signal` through pacing, retries, body consumption, and model-header reads.+ | `src/mcp-server/tools/{format,history,response-budget,schemas}.ts` | Text output, exact-date policy, byte budgeting, described schemas |+ | `tests/` | Tool, service, integration, and bundle-script tests |+ Run `bun run list-skills` for the current registry. Canonical development skills live in `framework-skills/`; agent copies live in `.claude/skills/` and `.agents/skills/`. They are contributor instructions, not installed plugin skills. After framework updates, follow `framework-skills/maintenance/SKILL.md` to sync them. Root `skills/` is the separate, author-managed tree the server publishes to the agents that install it (`add-skill`); no sync creates or modifies it.+ `manifest.json` defines the Node stdio MCPB launch. `.mcpbignore` excludes source, tests, scripts, docs, coverage, plugin manifests, agent docs, and private material with root-anchored lines only (`/docs/`, never `docs/`); root `skills/` ships. `scripts/clean-mcpb.ts` prunes dev dependencies, package-root agent docs, native bindings, node-gyp output, and build-only framework files after packing; nested runtime `skills/` modules (the MCP SDK's `dist/ext/skills/`) stay, pinned by `tests/scripts/ag+ Keep package, registry, MCPB, Claude/Codex plugins, the Agent Plugins root pair (`plugin.json` + `mcp.json`), Docker labels, and README consistent. A new user-supplied env variable must be wired through `server.json`, MCPB `user_config` / `mcp_config.env`, Claude `userConfig`, and Codex `env_vars`. An empty runtime env value replaces the user's value; it is not an optional-config hint.