What is mcp-requirements-traceability?

A requirements-tracking assistant for MCP servers. It manages functional, technical, and test requirements, plus links showing how each functional requirement is implemented and tested.

Use it to add, edit, map, audit, or regenerate MCP requirements and to fix traceability validation failures.

It helps find missing implementation or test coverage and keeps the requirements database, documentation, and validation checks consistent.

mcp-requirements-traceability — Skill by sharpninja

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/sharpninja/mcpserver/mcp-requirements-traceability

Any agent

npx skills add sharpninja/McpServer --skill mcp-requirements-traceability

Clone the repo

git clone --depth 1 https://github.com/sharpninja/McpServer

Made for: Claude Code, Codex.

Per session 87 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,250 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00087	$0.02250
Opus 5	$0.00044	$0.01125
Sonnet 5	$0.00017	$0.00450
Haiku 4.5	$0.00009	$0.00225

Measured 2d ago against content hash a91aab94c720, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

mcp-requirements-traceability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/mcp-requirements-traceability/SKILL.md · 149 lines

How it starts

The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.

MCP Requirements Traceability

Manage MCP Server functional (FR), technical (TR), and test (TEST) requirements, their FR -> TR/TEST mappings, and structured acceptance criteria. The requirements database is the source of truth; the Markdown files under docs/Project/ are import/export projections that ./build.ps1 ValidateTraceability reads. Keep both in sync so the build stays green.

When to Use

Adding or editing FR / TR / TEST records, or their acceptance criteria.
Linking an FR to its TRs and TESTs (the traceability mapping).
Fixing a failing ./build.ps1 ValidateTraceability run.
Auditing coverage (which FR lacks a TR or a TEST).
Regenerating the requirements Markdown / wiki projections from the database.

When Not to Use

Managing TODO items or session logs: use the todo and session skills instead. Requirement IDs are distinct from TODO IDs (PLAN-AREA-###) and Session IDs.
Editing the requirement Markdown files in docs/Project/ by hand. Never hand-edit Functional-Requirements.md, Technical-Requirements.md, Testing-Requirements.md, TR-per-FR-Mapping.md, or Requirements-Matrix.md. Mutate records through the plugin and regenerate the docs.

Inputs

The workspace marker / API key from AGENTS-README-FIRST.yaml (read once per session).
A requirement area (and subarea for TR), plus title, description, priority.
For mappings: an frId and the trIds / testIds to link.
For validation: the five Markdown files under F:\GitHub\McpServer\docs\Project\.

Critical Rules

The database is authoritative. Markdown under docs/Project/ is a generated projection. After mutating records, regenerate the docs with workflow.requirements.generateDocument so the IDs land in the files the validator scans. Do NOT hand-edit those files.
ID grammar (uppercase, validated server-side):
- FR: FR-<AREA>-### (e.g. FR-MCP-001). Area segment only.
- TR: TR-<AREA>-<SUBAREA>-### (e.g. TR-MCP-ARCH-001). Both area and subarea required.
- TEST: TEST-<AREA>-### (e.g. TEST-MCP-001). Area segment only.
Coverage rule the validator and CI enforce: every FR should map to at least one TR and at least one TEST, and every FR/TR/TEST ID must be present in the matrix.
All requirements work goes through the plugin workflow.requirements.* namespace (the Claude Code plugin wrapper, surfaced over REPL YAML/STDIO). Do not substitute raw REST or another agent's plugin for normal requirements work.
Capture requirements as they emerge during a session; do not defer. Record the new IDs in the session log turn tags.

Read the full file on GitHub · 149 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 149 lines · 87 tokens per session scan A a91aab94c720

Subscribe to this mod's changes

mcp-requirements-traceability is a skill published in the GitHub repository sharpninja/McpServer (2 stars, last pushed 12d ago), licensed Apache-2.0. It adds 87 tokens to every session and 2,250 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Planning Testing ai-agents ai-mcp ai-tools

opencli-sitemap-author

Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.

jackwener/OpenCLI · 67 tokens

golden-rss

Use when testing the rss golden build.

yusufkaraaslan/Skill_Seekers · 12 tokens

omh-buzz

This is a Hermes-native buzz workflow skill.

rlaope/oh-my-hermes · 95 tokens

redteam-api-detail-pack

Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.

Netw0rkNoob/VulnClaw · 61 tokens

redteam-postex-detail-pack

Domain routing and boundary guidance for authorized post-exploitation testing after initial access, including privilege escalation, persistence, lateral movement, data collection, and cleanup considerations. Use when a task belongs to the post-exploitation domain and needs scope, evidence, pivot, or exit criteria.