Agent-Hellboy/mcp-server-fuzzer
Instructions file CodexOpenCode
Instructions for Agent-Hellboy/mcp-server-fuzzer, covering ai agent instructions, branch creation, commit message style, lint and tests and tox venv setup.
Agent-Hellboy/mcp-server-fuzzer
Instructions file
Instructions for Agent-Hellboy/mcp-server-fuzzer, a project described as: A generic mcp server fuzzer.
Hook Claude Code
Runs before the agent uses a tool for Bash tool calls, running an inline shell check. From Agent-Hellboy/mcp-runtime.
Settings file Claude Code
Agent settings declaring 1 hook event (PreToolUse).
Skill Claude CodeCodex
API and system design principles for MCP Runtime — RESTful resource design, HTTP semantics, versioning, and the broader system principles (least privilege, secure/deny by default, fail-closed, stable contracts, separation of concerns, validate at boundaries, idempotency, observability, audit, minimized blast radius…
Skill Claude CodeCodex
Turn any folder of files into a navigable knowledge graph with community detection, an honest audit trail, and three outputs: interactive HTML, GraphRAG-ready JSON, and a plain-language GRAPHREPORT.md.
Skill Claude CodeCodex
Operate or debug the MCP Runtime public k3s deployment and related hack scripts, including setup, clean/restore, rollout, registry TLS/auth, ImagePullBackOff, node DNS vs pod DNS, and post-change live validation. Use when touching hack/deploy/mcpruntime-org/, config/deployments/mcpruntime-org.env.example, public TLS…
Skill Claude CodeCodex
Audit MCP Runtime Kubernetes posture — RBAC, ServiceAccounts, Pod Security Standards, NetworkPolicies, manifest hygiene, secret access, and cluster CIS controls — across operator, sentinel, registry, traefik, and mcp-servers namespaces. Use when Codex reviews or changes RBAC roles, ServiceAccounts, Deployments…
Skill Claude CodeCodex
Apply and debug MCP Runtime access grants, agent sessions, gateway policy, and MCP JSON-RPC traffic with governance headers. Use when working on MCPAccessGrant, MCPAgentSession, adapter proxy/stdio, access CLI, platform API grant/session endpoints, or allow/deny tool calls.
Skill Claude CodeCodex
Local Kind contributor endpoints, API keys, test-mode logins, port-forward URLs, and Sentinel auth for MCP Runtime. Use when developing against kind-mcp-runtime, curling /api/v1 or MCP paths on localhost:18080, or debugging 401s in test-mode — after cluster bring-up (qa-cluster-bringup).
Skill Claude CodeCodex
Configure and debug public MCP Runtime installs with MCPPLATFORMDOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use…
Skill Claude CodeCodex
Debug MCP Runtime cluster, ingress, registry, Sentinel auth, MCPServer pods, and platform UI failures on Kind or k3s. Use when setup, doctor, e2e, or live traffic fails; when investigating 401/404/ImagePullBackOff/ACME/TLS/registry push errors; or when AGENTS.md points here for the full failure-mode checklist.
Skill Claude CodeCodex
Validate MCP Runtime against the upstream Model Context Protocol specification at github.com/modelcontextprotocol/modelcontextprotocol — protocol version negotiation, Streamable HTTP transport headers, JSON-RPC 2.0 envelope, initialize/tools/resources/prompts/sampling shapes, session semantics, error codes, and merged…
Skill Claude CodeCodex
Stand up a real Kind+test-mode MCP Runtime cluster end-to-end (the contributor flow from docs/getting-started.md#3-contributor-test-mode-cluster) so the qa-e2e- skills can run real validation. Use when Codex is asked to QA on a live cluster, prepare a target environment for qa-e2e-operations / qa-e2e-security /…
Skill Claude CodeCodex
Real-cluster operational QA for MCP Runtime — operator/CRD reconciliation, CLI flows, setup/test-mode regressions, registry pulls, ingress wiring, rollout health, and observability — against the live Kind contributor cluster. Use when Codex is asked to verify a change does not regress operator, CLI, setup, registry…
Skill Claude CodeCodex
Real-cluster performance regression QA — MCP tools/call latency (p50/p95/p99), concurrent throughput against the gateway, /api/v1/analytics/usage latency under load, and operator burst-reconcile latency. Compares against a stored per-branch baseline and flags regressions above a configurable threshold (default +25…
Skill Claude CodeCodex
Real-cluster security regression QA — backend auth enforcement, grant/session policy, gateway deny paths, audit emission, trust escalation, UI/API security headers, HTTPS redirect modes, and secret-leak scanning in live logs. Use when Codex is asked to verify a change did not regress auth, governance, gateway policy…
Skill Claude CodeCodex
Browser-first real-cluster Sentinel UI/dashboard QA - role-based navigation, auth flows, every tab, forms, filters, destructive actions, rendered data, network/API evidence, console evidence, responsive/accessibility checks, cleanup, static assets, and public-host defenses. Use when Codex is asked to QA UI changes…
Skill Claude CodeCodex
Compose MCP Runtime pre-merge, ship, canary, and release readiness across CI parity, live Kind operations, security, UI/browser QA, protocol compliance, performance, docs, and deployment evidence. Use when asked if a branch can ship, to prepare a release, run a canary, produce release evidence, or coordinate final…
Skill Claude CodeCodex
Audit and update repository documentation, AGENTS.md, contributor runbooks, and test guidance so they match implemented behavior. Use when code, UI, CLI, API/CRD, config, deployment, or test-flow changes may affect user-facing docs, setup instructions, operational/debugging guidance, golden help snapshots, E2E…
Skill Claude CodeCodex
Run a deep platform-wide security audit of MCP Runtime — every component, every trust boundary, against an explicit threat model. Use when Codex is asked for a thorough security review (not a single PR), pre-release sign-off, red-team-style assessment, or to produce a structured report of findings across operator…
Skill Claude CodeCodex
Audit a single MCP Runtime change for security risks and choose the relevant local or CI security checks. Use when Codex reviews or changes authentication, authorization, secrets, TLS, ingress, registry/image handling, Kubernetes RBAC or pod security, gateway policy, audit logging, dependencies, GitHub Actions…
Skill Claude CodeCodex
Audit MCP Runtime supply chain — Go modules, container images, base images, SBOMs, signatures, and GitHub Actions workflows — for known vulnerabilities, unsigned artifacts, weak action pinning, license violations, and pwn-request exposure. Use when Codex bumps dependencies, changes Dockerfiles or workflows, prepares a…
Instructions file CodexOpenCode
Instructions for Agent-Hellboy/mcp-runtime, covering agents.md — developer and ai-agent guide, repository map (where to look), agent workflow passes, build, test, and quality (before you push) and conventions for code changes.