v1.3.0 — Windsurf, Grok Build, Codex user MCP

Native Windsurf / Cascade coverage. Also ships 1.2.0 (Grok Build provider) and 1.2.1 (Codex user MCP under --global) — those trains were never published as their own npm versions. 99 checks, 457 tests. Still offline on check.

Install

npx @chimix/agentscan@latest
npx skills add SimaAlexandru99/agentscan

GitHub Action:

- uses: SimaAlexandru99/agentscan@v1
  with:
    fail-on: error

Skill: https://skills.sh/simaalexandru99/agentscan/agentscan

Native Windsurf / Cascade coverage against 2026-08-31 official docs.
99 checks, 457 tests.

Added

• Spec captures docs/spec/windsurf-rules.md, windsurf-agents-md.md,
  windsurf-mcp.md.
• Workspace rules: .devin/rules/*.md (preferred), .windsurf/rules/*.md
  (fallback), subdirectory-scoped trees, legacy .windsurfrules.
  .devin is a scan-root signal.
• Character budgets: windsurf.rule.too-large (12,000) and
  windsurf.rule.global-too-large (6,000). Never cursor.rule.too-large.
• windsurf.rule.missing-trigger on workspace .devin / .windsurf rules
  that omit frontmatter trigger. Not on .windsurfrules,
  global_rules.md, or AGENTS.md.
• Portable lowercase agents.md (same sourceProvider: unknown as
  AGENTS.md).
• --global Cascade MCP at ~/.codeium/windsurf/mcp_config.json
  (windsurf-json). Launch is command or serverUrl or url.
  windsurf.mcp.no-launch when none are set. Never
  claude.mcp.url-without-type.
• --global ~/.codeium/windsurf/memories/global_rules.md only. Other
  files in that memories directory stay unread.

Unread (intentional)

• Devin Local CLI MCP (no published path).
• Auto-generated memories other than global_rules.md.
• System / enterprise rule directories.
• Project MCP (none quoted).
• Marketplace, admin allowlists, OAuth stores.

Also in this npm version

1.2.1 — 2026-08-31

Codex user MCP under --global. 95 checks, 441 tests.

Added

• $CODEX_HOME/config.toml (default ~/.codex/config.toml) is opened only
  with --global. Same codex-toml shape as project .codex/config.toml.
• Same-name user and project servers both stay in the inventory. The
  published page does not quote a replace-entirely rule, so this scanner
  does not invent codexEffective.
• Spec recapture docs/spec/codex-mcp.md (user path, CODEX_HOME, unread
  system / managed / requirements / profiles / plugins / trust / auth.json).

Unread (intentional)

• System /etc/codex/config.toml, managed preferences, requirements.toml,
  profile files, plugin MCP, trust_level.
• User-file project_doc_* knobs.
• Claude global settings; Command Code projects/{slug}/mcp.json.

1.2.0 — 2026-08-31

Native Grok Build provider against 2026-08-31 official docs. 95 checks,
435 tests. Compatibility with Claude or Cursor is not schema identity.

Added

• Spec captures docs/spec/grok-mcp.md, grok-hooks.md, grok-skills.md,
  grok-rules.md, grok-agents.md.
• Profiles: grok-toml MCP, grok hook and skill schemas.
  inferHookSchemaProfile("grok") is "grok", not "claude".
• Project .grok/config.toml walk-up (cwd → scan boundary). User
  $GROK_HOME/config.toml or ~/.grok/config.toml under --global.
  Same-name project replaces user; closer project file wins.
  grok.mcp.no-launch when neither command nor url is set. Never
  claude.mcp.url-without-type on grok-toml.
• .grok/hooks/*.json and user hooks under --global. Fourteen events;
  handlers command / http. Copilot version: 1 remap is not applied.
• .grok/skills (and user skills under --global). Frontmatter required;
  name / description optional. Agent Skills directory-match and Claude
  listing-budget checks do not run.
• .grok/rules/*.md with no size cap. Agents.md and AGENT.md as Grok
  instruction files beside AGENTS.md.
• Conformance fixture tests/fixtures/conformance/grok-toml/.
• spec:check drifts Grok hook event names against the live hooks page.

Unread (intentional)

• Managed / requirements TOML, plugins, marketplaces, personas, LSP,
  sandbox.toml, pager.toml.
• [skills] paths (no quoted resolution base).
• .grok/agents/ (directory named, no filename pattern).
• Claude / Cursor / .mcp.json as Grok-consumed.
• .gitignore skip for instruction files.
• Credential files (auth.json, mcp_credentials.json).