mirror of
https://github.com/chainbase-labs/Agentkey.git
synced 2026-09-20 14:20:23 +08:00
fullstackjam
e7dbae688a
## What Deletes `skills/agentkey/scripts/check-mcp.sh` (92 lines) and updates every doc that referenced it. The script has shipped since the initial public release but is **dead code** — nothing in the skill's runtime ever invokes it. ## Why it's safe to remove (the receipts) `check-mcp.sh` was never wired into the skill: - **Never in SKILL.md, ever.** `git log -S check-mcp -- '*SKILL.md'` returns no commits across all history — the script has never been referenced by the skill's decision tree in any version. - **Superseded by a native check.** The skill verifies MCP health by calling the MCP `list_tools` endpoint directly (SKILL.md → "Status" / Step 0.C), not a shell script. Its three status codes (`MCP_OK` / `MCP_NO_KEY` / `MCP_NOT_CONFIGURED`) are consumed by nothing. - **Not in any runtime path.** No reference in CI (`scripts-test.yml`), the bats suite, `dev-smoke.sh`, `install.sh`/`install.ps1`, or `uninstall.sh`/`uninstall.ps1`. The only mentions were prose: SECURITY.md, the ClawScan note, the PR template, and directory-tree comments. (The companion `@agentkey/cli` is a separately-published npm package; it *writes* MCP config and has no reason to invoke a diagnostic bundled inside an already-installed skill.) ## What removing it buys - **Drops the skill's only `python3` dependency.** `check-mcp.sh` shelled out to `python3` to parse `~/.claude.json`; on a host without python3 it silently returned a false `MCP_NO_KEY`. The surviving `check-update.sh` is pure shell. - **Shrinks the on-disk read footprint to zero.** Post-removal the skill reads **no** agent config file and **no** `AGENTKEY_API_KEY` value from disk — it only talks to the MCP transport. SECURITY.md's "Files the skill reads or writes" table is updated to match. - **Removes a security-scanner false-positive surface.** The credential-read (`*_API_KEY*`) pattern in this script is precisely what required a dedicated SECURITY.md carve-out *and* a `--clawscan-note` item explaining "this is not credential exfiltration." Both are now unnecessary and removed. ## Doc updates (no dangling references left) - `SECURITY.md` — "two helper scripts" → "one"; removed the check-mcp.sh bullet and the `*_API_KEY*` scanner note; fixed the file table (the skill no longer reads `~/.claude.json` / `~/.env.local`; `~/.claude.json` re-characterized as CLI-written so the credential-handling reference stays accurate). - `.github/workflows/release-please.yml` — dropped item (3) from the ClawScan note. - `.github/PULL_REQUEST_TEMPLATE.md` — removed the obsolete "check-mcp.sh still works" checkbox. - `README.md` / `docs/README_zh.md` / `.claude/CLAUDE.md` — directory-tree comments. `grep -rn check-mcp` now returns nothing. ## Verification - ✅ `bats tests/` — all 10 pass (they cover the untouched `check-update.sh`). - ✅ `grep -rn 'check-mcp\|MCP_OK\|MCP_NO_KEY\|MCP_NOT_CONFIGURED\|env.local'` → zero hits. - ✅ `release-please.yml` still parses as valid YAML. ## Why `chore:` and not `fix:` Typed `chore:` deliberately so release-please does **not** cut a version bump / GitHub Release for an internal cleanup — a release would push a no-op plugin update to every user. No end-user runtime behavior changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)