Agent Readiness Integrations v0.1.2

Agent Skill, Claude Code and Cursor plugin, and MCP server 0.1.2, built from agent-readiness-kit f15924b and agent-context-doctor 034a74c. Versioned independently of the GitHub Action (v1.2.0 remains its latest release).

• npm: @alipajand/agent-readiness-mcp@0.1.2 (SHA-256 4daba9c0f50fb3d2a6cc5c7939dbe68285fb7380d3e90c3f4a0e14d5966f901a)
• MCP Registry: io.github.alipajand/agent-readiness 0.1.2
• The Cursor plugin has not been tested in Cursor or submitted to its marketplace.

A coordinated release of every integration, for directory compatibility. The audit engines, their
commits (agent-readiness-kit f15924b, agent-context-doctor 034a74c), scoring, and the MCP
server's behavior are unchanged; the MCP package and its registry entry move to 0.1.2 only because
all integrations share one version.

Changed

• The plugin folder has a README.md: purpose, installation, components, engine provenance,
  Node.js requirement, what runs locally and what the AI client may send to its model provider,
  masking limits, and tested clients. Anthropic's plugin directory requires one.
• The Cursor manifest validates against Cursor's published plugin schema: author no longer has a
  url, which the schema does not allow, and it gains displayName.
• The Cursor command has name and description front matter and its own fail-closed rule: if the
  script is denied or fails before printing a report, the model says the audit did not run, gives no
  scores or findings, does not claim success, and does not read the repository's files instead.
  Before, the Cursor command relied on the skill for that rule.

Tests

• Both Cursor manifests are checked against snapshots of Cursor's schemas (cursor/plugins at
  fe53d9e).
• The Cursor command's front matter and fail-closed rule, and the plugin README's required
  disclosures, are checked. Each new test fails on the 0.1.1 files.

Not tested

Cursor itself (not installed on the build machine), Windows, and Claude Code's interactive
permission prompts.

v1.2.0

Updates both bundled engines and adds the portable integrations (Agent Skill, Claude Code and Cursor plugin, local MCP server) to the repository. Inputs, outputs, and the PR comment format are unchanged, and scores on Linux runners are unchanged. Two things can change for existing workflows: on macOS and Windows runners, fixed file names now match case exactly, as on Linux; and with context-audit: 'true', credentials quoted by findings are masked and an .acdrc that links outside the repository fails the step. The integrations are not published with this release; they are versioned separately as integrations-v<version>.

Full notes from CHANGELOG.md:

Added

• Portable integrations built from the same pinned engines, in a new integrations/ workspace package. The action's inputs and outputs are unchanged; its dist/ changes only through the engine update below.
  • Agent Skill agent-readiness-audit with a self-contained, read-only audit script (plugins/agent-readiness/skills/agent-readiness-audit/).
  • Claude Code and Cursor plugin agent-readiness, listed by .claude-plugin/marketplace.json and .cursor-plugin/marketplace.json.
  • Local MCP server @alipajand/agent-readiness-mcp (integrations/mcp-package/, not yet published) with audit_repository, audit_agent_context, and get_audit_report. Each audit runs in a worker confined by Node's permission model, so the server needs Node.js 22.13 or later (23.5 or later on Node.js 23) and refuses to start on older releases; the skill script runs on 22.12.
  • CI job that rebuilds and checks the committed bundles and runs the integration tests on Node.js 22.13 and 24.

Security

• Bundled engines moved to the latest main: agent-readiness-kit b490a30 → f15924b (agent-readiness-kit#33) and agent-context-doctor d70de51 → 034a74c (agent-context-doctor#73 and #74). Both replace fast-glob with tinyglobby, so braces is no longer installed or compiled into dist/ and the integration bundles. braces 3.0.3 has a stack-exhaustion advisory with no patched release (GHSA-vfj7-8cjw-p6xm). Symlinked directories are still not walked, and the .acdrc brace limits still apply. The action's fast-glob dependency, which only supplied the engines, is replaced by tinyglobby. One behavior changes, on case-insensitive filesystems only (macOS and Windows runners): the readiness engine's lookups of fixed file names such as README.md, CHANGELOG.md, package.json, or .tool-versions now match the exact case, as they always did on Linux. A repository with Readme.md audited on a macOS runner loses the README documentation points it got before (one point on the test fixture), the same result Linux runners give. Otherwise the old and new dist/ gave identical output on 21 local repositories and on a fixture of symlinks, brace patterns, mixed-case names, and deep nesting; on a case-sensitive volume, as on Linux, that fixture matched too.
• With context-audit: 'true', the bundled agent-context-doctor (agent-context-doctor#74) changes what the action prints and reads. Scores, grades, issue counts, outputs, and the job summary were identical to the previous engine on 27 local repositories; only the following differ:
  • A recognised credential quoted by a finding other than secrets is masked (ghp_************) in the log, the json output, and the issue table of the job summary and PR comment. Before, a token on a curl | sh line, in a placeholder, in a missing link target, or in a .claude/settings.json permission was shown in full.
  • A credential configured in an MCP server's env or headers is masked in every finding that quotes its line.
  • An .acdrc that is a symlink to a file outside repo-path fails the step with .acdrc … links outside …; refusing to read it. Before, a pull request could link .acdrc to a file on the runner: the step printed the start of that file in a JSON parse error, or applied it as configuration if it was valid JSON. A link to a file inside the repository still works.
  • Masking and evidence no longer take quadratic time on hostile input (a line with thousands of distinct tokens, or a file with tens of thousands of flagged lines).

Agent Readiness Integrations v0.1.1

Agent Skill, Claude Code plugin, and MCP server package, built from agent-readiness-kit f15924b and agent-context-doctor 034a74c. Versioned independently of the GitHub Action (v1.2.0 remains its latest release).

The MCP package is not yet on npm, and the Cursor plugin has not been tested in Cursor or submitted to its marketplace.

First release. It packages the same pinned engines as agent-readiness-action v1.2.0 for local
use by AI coding agents: read-only, offline scanning with no LLM scoring.

Version 0.1.0 was never tagged or published, but the plugin was installable from main at 0.1.0
before the fixes below. Claude Code updates an installed plugin only when its version changes, so
the first release is 0.1.1.

Component	Version	Where	Status
Agent Skill agent-readiness-audit	0.1.1	plugins/agent-readiness/skills/agent-readiness-audit/; npx skills add alipajand/agent-readiness-action	Tested in Claude Code
Claude Code plugin agent-readiness	0.1.1	claude plugin marketplace add alipajand/agent-readiness-action, then claude plugin install agent-readiness@agent-readiness	Tested in Claude Code
MCP server @alipajand/agent-readiness-mcp	0.1.1	npm (not yet published); MCP Registry name io.github.alipajand/agent-readiness	Tested with Claude Code as host
Cursor plugin (same agent-readiness directory)	0.1.1	Local install only (~/.cursor/plugins/local/)	Not tested in Cursor; not submitted to the Marketplace

Engines: agent-readiness-kit f15924b and agent-context-doctor 034a74c. Every report and bundle
header names both commits.

Requirements

• Skill and plugin: Node.js 22.12 or later.
• MCP server: Node.js 22.13 or later (23.5 or later on Node.js 23). It refuses to start on older
  releases, because audits run in a worker confined by Node's permission model.

What it does

• audit scores a repository's readiness for AI coding agents (agent-readiness-kit) and checks its
  agent instruction and configuration files (agent-context-doctor), with the engines' own scores
  and findings.
• The MCP server offers audit_repository, audit_agent_context, and get_audit_report (paged,
  with the engines' raw JSON on request), restricted to the directories given with --root.
• The scanner writes nothing to the audited repository, makes no network request, and never runs
  the repository's own scripts. Recognised credentials are masked in its output; see
  docs/SECURITY-FINDINGS.md for what masking does and does not guarantee.

The scanner is offline; the AI client is not

The skill script and the MCP server are deterministic and make no network requests. The AI client
that runs them reads the results and may send them to its model provider. It may also read the
repository's files directly and send those. Credential masking covers the scanner's output only.
See docs/integrations/SECURITY-MODEL.md.

How to invoke it

The tested path in Claude Code is invoking the audit by name: /agent-readiness:audit [path],
/agent-readiness:agent-readiness-audit, or /agent-readiness-audit for the standalone skill.
Asking in plain words relies on the client loading the skill by itself, which is not verified as
reliable: in a headless session Claude Code denied that Skill call and the model read the files
itself. If the script cannot run, the command and the skill now tell the model to say the audit did
not run instead of giving scores or reviewing the files itself. An answer without the engines'
scores and commits means the audit did not run.

Fixed before release

Found in live Claude Code sessions and fixed with regression tests:

• /agent-readiness:audit made the model call the Skill tool, which the command does not
  pre-approve, so Claude Code denied it. The command now needs only the bundled script.
• The skill showed its script as <skill-dir>/scripts/…, so the model built the path itself and the
  call no longer matched the pre-approved command. In Claude Code the skill now gives the exact
  command with ${CLAUDE_SKILL_DIR}.

Tested

• Claude Code 2.1.278, signed in, headless: the plugin command, the plugin's skill, the skill
  installed from GitHub with npx skills add, installation from the GitHub marketplace, and the
  packed MCP server as the session's MCP server.
• The skill's JSON equals ark audit --json --no-history and acd audit --json on 28 repositories
  and fixtures.
• Linux CI on Node.js 22.13.0 and 24; macOS locally on Node.js 22.13.0 and 24.

Not tested

• Cursor (not installed on the build machine).
• Claude Code in an interactive session, and plain-language invocation of the skill.
• Windows.
• Codex and other skill clients.

v1.1.0

Updates both bundled engines. Inputs, outputs, and the PR comment format are unchanged, but readiness and context scores can change. See the notes below before upgrading a workflow that gates on min-score.

Readiness scores are ecosystem-aware

Node.js, Python, Go, and Rust are detected from their manifests, and the lockfile, version pin, test runner, linter, formatter, and .gitignore signals count each ecosystem's own files. Test files are detected in more languages, and workflow commands are read from Makefile, justfile, Taskfile, pyproject.toml, tox.ini, and noxfile.py.

• Node.js-only repositories keep their score, apart from evidence the engine used to miss.
• Python, Go, and Rust repositories usually score higher.
• Repositories with several stacks are scored on every detected stack, so a Node.js and Python repository with Node.js tooling only can score lower and may fall below min-score. Add the missing stack's tooling or adjust min-score.
• baseline-ref audits the base commit with the same engine, so upgrading does not by itself produce a score-delta or trip max-score-drop.

More accurate context-audit

New issues for commands of a package manager the repository does not use, instruction files that disagree on the package manager or on skipping tests, advice to skip tests in other words, and missing root-level files named in inline code. Fewer false positives for plain-language reporting guidance, non-JavaScript validation commands, delegating CLAUDE.md files, and ignored paths. A repository with no agent context files now scores 0.

Security

With context-audit: 'true':

• package.json, the root Makefile, and broken-references existence checks no longer follow symlinks out of the audited repository.
• Makefile target parsing is linear; a 1 MB line could stall the step for minutes.
• .acdrc rules.ignoreFiles patterns with deeply nested or exploding braces fail as a config error instead of exhausting the stack or memory (GHSA-vfj7-8cjw-p6xm).

agent-readiness-kit keeps root file reads inside the repository and no longer enters symlinked directories named in a glob pattern.

uses: alipajand/agent-readiness-action@v1 now resolves to this release.

Full changelog: v1.0.1...v1.1.0

v1.0.1

Metadata release for GitHub Marketplace. The audit behaviour is unchanged from v1.0.0.

• The action's display name is now Agent Readiness Action. The previous name, "Agent Readiness Audit", belongs to an unrelated Marketplace action.
• The description mentions the instruction file checks from the bundled agent-context-doctor.

Workflows reference the action by repository, so uses: alipajand/agent-readiness-action@v1 keeps working and now resolves to this release.

Full changelog: v1.0.0...v1.0.1

v1.0.0

First release of agent-readiness-action: a deterministic GitHub Action that scores how ready a repository is for AI coding agents and checks the quality and safety of its agent instruction files.

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: alipajand/agent-readiness-action@v1

Features

• Readiness score (0–100) from the bundled agent-readiness-kit. The action prints a per-category breakdown in the log and the job summary. Set min-score to fail below a threshold.

• Block regressions: baseline-ref and max-score-drop audit the pull request's base commit in a temporary worktree and fail when the score drops too far.

• Instruction file checks: with context-audit, the bundled agent-context-doctor reviews AGENTS.md, CLAUDE.md, Cursor, Copilot, and other agent files. It reports:

  • contradictions, secrets, hidden Unicode, broken references, and stale commands
  • risky Claude Code settings, hooks, commands, and subagents
  • risky MCP server configs

  Use context-fail-on to gate on severity.

• PR comment: comment-on-pr keeps a single summary comment up to date.

• Report: output writes a Markdown report inside the repository.

• Outputs: score, passed, categories, report-path, baseline-score, score-delta, context-score, context-grade, and context-issue-count.

Security

Designed to run on pull requests from contributors you don't fully trust:

• No runtime downloads. Both engines are compiled into dist/index.js from pinned submodules.
• No telemetry and no LLM calls. The only network access is the optional PR comment.
• Contained writes. The report must resolve inside repo-path and is never written through a symlink.
• Injection-safe output. Audited text is logged with workflow commands paused and escaped in Markdown.
• Comment ownership. Only the action's own bot comment is edited.
• Least privilege. Auditing needs contents: read. PR comments also need pull-requests: write and issues: write.

See SECURITY.md and docs/ARCHITECTURE.md.

Versioning

@v1 follows the latest 1.x release. Pin @v1.0.0 or a full commit SHA to review every change before it runs.

Full changelog: CHANGELOG.md