菜单
Use when configuring or calling the hosted Gomboc MCP server, deciding prefer-MCP vs Docker/orl fallback, or verifying MCP setup. No side effects by itself — callers invoke MCP tools. Underlying capability for rules lookup, classifications, channels, and external-run reporting.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_know_gomboc_mcp |
| description | Use when configuring or calling the hosted Gomboc MCP server, deciding prefer-MCP vs Docker/orl fallback, or verifying MCP setup. No side effects by itself — callers invoke MCP tools. Underlying capability for rules lookup, classifications, channels, and external-run reporting. |
Hosted MCP at https://mcp.app.gomboc.ai/mcp (Cursor server id typically gomboc). Prefer MCP when available for matching intents; otherwise fall back to Docker/orl caps and local references. MCP tools change over time — always re-discover.
Require GOMBOC_PAT in the environment. Add to Cursor MCP config (~/.cursor/mcp.json or project MCP settings):
{
"mcpServers": {
"gomboc": {
"url": "https://mcp.app.gomboc.ai/mcp",
"headers": {
"Authorization": "Bearer ${env:GOMBOC_PAT}"
}
}
}
}
Get a token at https://app.gomboc.ai/settings/tokens. Never log the token.
MCP is available when the gomboc server is connected/ready and tools can be listed. If missing, errored, or unauthorized → treat as unavailable and use Docker/orl (or local refs) without blocking the user.
Verify with /gomboc-community:verify-mcp (smoke: get_channels with name: "default").
For any skill step that maps to an MCP intent:
gomboc (list tools + schemas).page / perPage (or equivalent), paginate fully before deciding MCP is insufficient — see Pagination below.orl path for that step.orl / local path.Do not invent tool names. Soft map entries may go stale; discovery wins.
Many list/search tools are paged. Do not treat the first page as the full result set, and do not fall back to Docker solely because a first page is smaller than total.
When a discovered tool schema includes page and/or perPage (or equivalent):
page (start at 1) and a reasonable perPage (e.g. 50–100 unless the schema constrains it).total (or equivalent) and the current page’s items from the response.page and call again until every item is fetched (page * perPage >= total, or a page returns fewer items than perPage / an empty list).Never skip remaining pages and switch to Docker/orl just because the result set is large. Volume is not a fallback reason when MCP already returns usable payloads (e.g. rule body).
Paged tools known today (re-check via discovery): get_channels_rules, search_rules, search_channels, search_classifications.
| Intent | Prefer MCP tool(s) | Fall back when MCP insufficient |
|---|---|---|
| Channel lookup | get_channels (name optional; use "default" for smoke) | Local channel name / Docker --channel only if MCP channel tools fail |
| List / pull rules in a channel | get_channels_rules (name; paginate page / perPage) — items often include body | Docker orl rules pull --channel via gomboc_community_cap_orl_rules_pull only if MCP list/fetch fails or bodies missing after full pagination |
| Search rules | search_rules (paginate page / perPage; optional query / filters / iacLanguage) — then get_rules by name if body omitted | Docker orl rules pull --search via gomboc_community_cap_orl_rules_pull |
| Fetch / pull rule by name | get_rules (name required) — response includes rule body | Docker orl rules pull via gomboc_community_cap_orl_rules_pull |
| Classification lookup / tree | get_classifications (name required; optional parents / children / expandChildren) | Local references/ / classifications.txt |
| Search classifications | search_classifications (paginate page / perPage) | Local references/ / classifications.txt |
| Search channels | search_channels (paginate page / perPage) | Docker/orl channel name only if MCP search fails |
| Post ORL external run event | post_external_run_event (accountId + event) | scripts/integrations/submit-orl-report.mjs (HTTP) |
Not on MCP today (keep Docker/orl): remediate, walk, test, rules push. When discovery later shows tools for those intents, prefer MCP under the same rules (including pagination when present).
get_rules: Enough when status is success and data.body (or equivalent rule payload) is present — materialize the local .orl / package from that payload; do not fall back to Docker for that name.get_channels_rules: Enough for channel sync when, after full pagination, each needed rule has a body (or you successfully follow up with get_rules for any name missing a body). Materialize every page’s rules locally; do not fall back to Docker because total is large or only page 1 was fetched.search_rules / search_channels / search_classifications: Enough only after full pagination. Use returned names/metadata to drive get_rules / further lookups; if search hits omit body, call get_rules per name before considering Docker.get_channels: channel metadata + query only — enough to refine channel name / search; not enough by itself to write rule packages. Next step: paginate get_channels_rules (or search_rules + get_rules), not Docker-first bulk pull.get_rules also fails/omits body.Same gates as ORL remediate caps for any future MCP tool that changes code: dry-run/preview first; apply only after engineer confirmation; never log tokens. Stricter CRUD rules come later.
https://mcp.app.gomboc.ai/mcp) — do not assume local Docker MCP.orl execution; this skill only defines when to try MCP first (and how to paginate).page, perPage, total, item arrays).