mcp-ship-checklist
Skill0 starsChanged 24 days agoMITView on GitHub
Pre-publish and release checklist for MCP family packages and control-plane. Use before npm publish, tagging, or claiming client install commands work.
- Reads credentials
Files
MCP Ship Checklist
All packages
npm test(andnpm run check/ integration if present) passes- README limitations and coverage claims match code
- No secrets in repo (
.env, keys, live SQLite) - Protocol versions documented honestly
- Privacy: no unexpected network/telemetry
- License present (MIT for public tools)
- Version bumped intentionally (
0.1.0MVP until ready)
Tool servers (npm)
- Confirm npm name ownership before documenting
npx -y <name>(skip if already published — e.g. security-guard) filesfield / pack contents reviewed (npm pack --dry-run)- Absolute-path local install still documented as primary pre-publish path
- Example MCP client JSON uses placeholders, not machine-specific secrets
- Tool descriptions without instruction-injection patterns
mcp-security-guard extras
npm run build+npm test(+ bench if rules changed)- CHANGELOG + PRIVACY.md match new egress
- Plugin/Cowork: optional keys keep empty defaults when required for load
- Cloud/Team still fail open; admin actions remain CLI-only
- Release workflow / Registry / Action inputs still accurate
Control plane
ADMIN_TOKENnot default/committed; length ≥32 enforced- Production notes: HTTPS proxy, rate limit, volume, backups
- Product ID list matches all shipped family tools
- Quota defaults labeled as testing defaults, not commercial pricing
After publish
- Update READMEs to enable
npx/ install snippets only for published artifacts - Tag release; note breaking MCP protocol or tool schema changes in changelog if present
In this repository6 other files it gives its agents.
- .cursor/rules/mcp-family.mdcCursor rule
- .cursor/rules/mcp-privacy-security.mdcCursor rule
- .cursor/rules/mcp-tool-server.mdcCursor rule
- mcp-add-toolSkill
- mcp-control-plane-integrateSkill
- mcp-family-architectureSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.