Agent Readiness

io.github.alipajandPublished by GitHub account alipajandv0.1.2Updated Oct 24, 2026

Deterministic, read-only audits of repo readiness for AI coding agents and of agent context files.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs deterministic, read-only audits that score a repository's readiness for AI coding agents and check agent context files.

What you can do
It bundles two deterministic engines. The readiness engine gives a 0-100 score across 13 categories such as instructions, architecture, workflow, testing and safety for Node.js, Python, Go and Rust projects. The context engine reports quality and safety issues in AGENTS.md, CLAUDE.md, Cursor and Copilot rules, and agent MCP or settings files. Tools include audit_repository, audit_agent_context and get_audit_report for paging through a session's report.
When to use it
Use it when you want a repeatable, offline check of how well a codebase is set up for AI coding agents, or when you want to review agent instruction and settings files for quality and safety problems before relying on them.
Requirements
Runs locally over stdio as an npm package, installed globally or via npx. Requires Node.js 22.13 or later (23.5 or later on Node.js 23); older releases are refused. Configure one --root per directory the client may audit; with none it uses its startup directory. Optional flags: --timeout and --max-concurrency. No API key, account or network access is needed.
Before you install
The audit is read-only, offline, uses no LLM and no API key, sends no telemetry and does not run the audited repository's scripts. Paths are resolved through symlinks and must stay inside a configured root. Text in results comes from the audited repository and should be treated as data. The server itself is offline, but the MCP host reads the results and may send them, or files it reads, to its model provider; credential masking covers only the server's results.

Installation

In SourceWeft

  1. Open Agent Readiness in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@alipajand/agent-readiness-mcp

A local Model Context Protocol server that audits repositories for AI coding agents with two deterministic engines:

  • agent-readiness-kit: a 0–100 readiness score across 13 categories (instructions, architecture, workflow, testing, safety, and more) for Node.js, Python, Go, and Rust projects.
  • agent-context-doctor: quality and safety issues in AGENTS.md, CLAUDE.md, Cursor and Copilot rules, and agent MCP/settings files. Credentials quoted in any finding are redacted.

The audit is read-only and offline. It uses no LLM and no API key, sends no telemetry, and never runs the audited repository's scripts. Both engines are compiled into the package from pinned commits, so it has no runtime dependencies.

Tools

ToolReturns
audit_repositoryReadiness score, categories, checks that did not pass (fail before warn), recommendations
audit_agent_contextContext score and grade, files checked, issues ordered high → low
get_audit_reportFurther pages of a report from this session, optionally with the engine's complete JSON

audit_repository and audit_agent_context take an optional path (default: the first root). All three tools are annotated read-only.

Install

Requires Node.js 22.13 or later (23.5 or later on Node.js 23). Older releases have no stable permission model for the audit sandbox described below, and the server refuses to start on them.

bash
npm install -g @alipajand/[email protected]

Configure a client

The server only audits directories inside its roots. Give one --root per directory the client may audit; with none, it uses the directory it was started in.

Claude Code:

bash
claude mcp add agent-readiness -- agent-readiness-mcp --root /path/to/projects

Cursor (.cursor/mcp.json) and other clients that use the mcpServers format:

json
{  "mcpServers": {    "agent-readiness": {      "command": "agent-readiness-mcp",      "args": ["--root", "/path/to/projects"]    }  }}

Without a global install, use "command": "npx" with "args": ["-y", "@alipajand/[email protected]", "--root", "/path/to/projects"]. Keep the version pinned.

Options: --root <dir> (repeatable), --timeout <seconds> (default 120), --max-concurrency <n> (default 2).

Security

  • Paths are resolved through symlinks and must stay inside a root.
  • Each audit runs in a separate Node.js process started without a shell, with an empty environment, a time limit, and an output limit. That process runs under Node's permission model: it can read only the audited directory and its own script, and cannot write files or start processes. Node lets a granted read follow a symlink, so the engines' own symlink checks still contain reads; the sandbox is a second layer.
  • Stdout carries only MCP messages; diagnostics go to stderr.
  • Reports are kept in memory for the session (the 20 most recent) and never written to disk.
  • Text in results comes from the audited repository and should be treated as data.
  • The server is offline, but the MCP host is not part of it: the host's model reads the results and the host may send them, or files it reads itself, to its model provider. Credential masking covers the server's results only.

Listings

Listed on MCPRush.

License

MIT. Bundled third-party licenses are in dist/THIRD-PARTY-LICENSES.txt and dist/audit-worker.THIRD-PARTY-LICENSES.txt.

Source: integrations/mcp-package/README.md at commit 010b2f1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestOct 13, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts