菜单
Design, lint, and review Model Context Protocol (MCP) tools, resources, prompts, and server configurations. Use when creating MCP servers, exposing APIs to agents, reviewing tool schemas, or checking tool metadata for safety and usability before publishing.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Build and run lightweight regression evaluations for agents, tools, prompts, and workflows. Use when comparing agent versions, catching behavior drift, measuring pass rates over repeated runs, or turning production failures into replayable test cases.
Audit agent repositories, MCP configurations, tool schemas, prompts, and logs for common security risks: secret exposure, prompt injection payloads, tool poisoning, command execution, broad filesystem access, and unsafe auto-approval.
Inspect agent traces, tool-call logs, and OpenTelemetry/OpenInference-style span exports. Use when debugging why an agent skipped a tool, called the wrong tool, hit errors, exceeded latency budgets, or produced an unsupported answer.
Design and validate graph/state-machine agent workflows with explicit starts, terminal states, guarded cycles, human approval points, and side-effecting tool boundaries. Use when building LangGraph-style, multi-agent, or durable agent workflows.
Safely list, create, and extract zip/tar archives with path traversal checks. Use when packaging artifacts, unpacking downloaded files, or inspecting archive contents on a user's computer.
Build, run, and review browser-using AI agents with Playwright, Browser Use, MCP browser tools, or hosted browser runtimes. Use for web navigation agents, form-filling, UI task automation, screenshots, DOM/vision checks, auth/session handling, and browser-task reliability reviews.
| name | mcp-toolsmith |
| description | Design, lint, and review Model Context Protocol (MCP) tools, resources, prompts, and server configurations. Use when creating MCP servers, exposing APIs to agents, reviewing tool schemas, or checking tool metadata for safety and usability before publishing. |
| version | 1.0.0 |
| author | Zijian Guo |
| license | MIT |
| platforms | ["linux","macos"] |
| prerequisites | {"commands":["python3"]} |
| metadata | {"hermes":{"tags":["agent","mcp","tools","schemas","interoperability","tool-design"]}} |
Use this skill for agent-tool interoperability work, especially when converting local scripts, APIs, or internal systems into agent-callable MCP tools.
MCP has become a public integration layer for agent tools. MCP servers expose tools, resources, and prompts; the market gap is no longer only "can an agent call a tool", but whether the tool schema is clear, least-privilege, auditable, and resistant to malicious metadata.
~/.hermes/skills/mcp-toolsmith/scripts/mcp_schema_lint.py
| Check | Purpose |
|---|---|
| Tool name format | Keeps tools discoverable and stable |
| Description quality | Avoids vague or instruction-like metadata |
| Input schema | Requires object schemas with typed properties |
| Side-effect flags | Highlights write/delete/send/execute tools |
| Poisoning phrases | Detects metadata that tries to steer the model |