@rhize/skill-forge 0.5.0 → 0.6.1

package/README.md

@@ -161,17 +161,34 @@ guessing between the two).
 |---|---|---|
 | Local directory | `./my-mcp-server` | Copied into quarantine, same as a local skill source. |
 | Git URL | `https://github.com/owner/mcp-server.git` | Shallow-cloned into quarantine, same as a git skill source. |
-| npm package | `@scope/name` or `some-mcp-server` | `npm pack <name> --pack-destination <quarantine>`, then tarball **extraction only** — never `npm install`, never lifecycle scripts. |
+| npm package | `@scope/name` or `some-mcp-server` | `npm pack <name> --ignore-scripts --pack-destination <quarantine>`, then tarball **extraction only** — never `npm install`, never lifecycle scripts. Every tarball member path is validated (absolute paths and `..` segments are rejected) before extraction. |
 
 **What's gated**
 
 Safety runs the same built-in deny-pattern ruleset used for skills (curl\|bash, credential-file
-access, etc.) plus MCP-specific rules: inline credential values in config/env, unpinned `npx -y`
-launch commands, `--dangerously-*`/`--no-sandbox` flags, and filesystem-root launch args — see the
+access, etc.) plus MCP-specific rules: inline credential values in config/env (quoted or
+unquoted), unpinned `npx -y` launch commands (a moving/dist tag like `@latest` counts as
+unpinned, and `npx` is recognized by basename so a full path or `npx.cmd` can't evade it),
+`--dangerously-*`/`--no-sandbox` flags, and filesystem-root launch args — see the
 [MCP safety ruleset table](docs/gate-policy.md#mcp-safety-ruleset). Overlap analysis (Pro, free
 during the 0.x beta) ranks the candidate against the server entries already present in your
 configured `mcpTargets` files, instead of against a skills root.
 
+**Capability profile (v0.6).** The report also includes a **static** capability summary — tool,
+resource, and prompt counts, plus a `declaredConfidence` (`high`/`partial`/`none`) — parsed from
+the candidate's `package.json`, any shipped `.mcp.json`/manifest, and MCP SDK source-text patterns
+(`server.tool(...)`, `setRequestHandler(ListToolsRequestSchema, ...)`, etc.):
+
+```
+Artifact type       : mcp
+Capabilities        : 2 tools, 1 resource, 0 prompts (declaredConfidence: high)
+```
+
+This is free (it's profiling, not a Pro feature) and **never derived by running the candidate
+server** — anything that can't be determined from source text is reported as undetermined rather
+than discovered by executing it. `--json` includes the full `tools`/`resources`/`prompts` name
+lists under `profile.capabilities`.
+
 **Promote semantics**
 
 Promoting an MCP candidate writes ONE server entry into a target MCP config file's `mcpServers`
@@ -192,7 +209,13 @@ map — it never touches a skills root:
 
 There's no MCP equivalent of the skill provenance ledger (`SOURCES.md`) — the pending-ingestion
 queue (Pro) and `--ingest` handoff both apply the same way, keyed on the written config file path
-instead of an installed skill directory.
+instead of an installed skill directory. The queued entry carries the candidate's static capability
+profile (`capabilities`, v0.6, above), so a `--ingest` handoff run on an MCP promote has real
+material to work with: `assets/ingest-prompt.md` branches on `artifactType: "mcp"` and walks the
+same five-verb decide (DEFER/ABSORB/FORK/REJECT/WATCH) applied to a server instead of a skill —
+compare declared capabilities against what's already configured, then keep/tighten/remove the
+promoted config entry accordingly. Same static-only rule as the CLI's own profiling: the deep pass
+never runs or installs the candidate server to inspect it.
 
 **TOML-format agents: detect-only.** `skill-forge init` detects MCP config files for every known
 agent, including TOML-format ones (Codex CLI's `config.toml`) — they show up in `init`'s MCP-target
@@ -245,6 +268,11 @@ implementation status.
 - **Block on HIGH/CRITICAL.** Any finding at `HIGH` or `CRITICAL` severity blocks the candidate
   outright (verdict `block`); a lower-severity finding produces `warn`; a clean scan is `pass`.
   `--yes` honors this: `block` is rejected automatically.
+- **npm-sourced MCP candidates: `--ignore-scripts` + tarball member validation.** An npm-package
+  MCP source is fetched with `npm pack --ignore-scripts`, and the tarball's member list is checked
+  with `tar -tzf` before extraction — any absolute path or `..` path segment refuses the extract
+  with an error instead of running `tar -xzf` (a path-traversal guard against a malicious tarball
+  writing outside the quarantine sandbox).
 - **SkillSpector, when installed.** If [SkillSpector](https://github.com/NVIDIA/SkillSpector)
   (Apache-2.0) is on `PATH`, skill-forge shells out to it (`--no-llm` by default, so scanned skill
   content is never sent to an external LLM provider) and merges its findings into the same report.
@@ -262,7 +290,10 @@ that deeper judgment (which patterns to keep, whether to absorb into an existing
 new one, verifying the result beats baseline) is a job for a coding agent, not the gate. `--ingest`
 hands a promoted skill off to one, running the bundled, agent-neutral prompt at
 `assets/ingest-prompt.md` (Claude Code users get a deeper experience via the companion
-`rhize-skill-forge` plugin skill, but the bundled prompt works with any agent).
+`rhize-skill-forge` plugin skill, but the bundled prompt works with any agent). The same flag works
+on an MCP server promote (`--artifact mcp --ingest`, v0.6): the bundled prompt branches on the
+queue entry's `artifactType` and runs the matching decide pass — see
+[MCP gating](#mcp-gating-v05) above.
 
 ```bash
 skill-forge add owner/name --yes --ingest