chore: remove unused check-mcp.sh diagnostic script#63
Merged
lxcong merged 1 commit intoJun 26, 2026
Merged
Conversation
fullstackjam
force-pushed
the
chore/remove-unused-check-mcp-script
branch
from
June 25, 2026 16:18
6772fa0 to
8075fdd
Compare
check-mcp.sh has shipped since the initial public release but was never wired into the skill's runtime. `git log -S check-mcp -- '*SKILL.md'` is empty across all history, and the skill verifies MCP health via the native `list_tools` endpoint (SKILL.md -> "Status"), not a shell script. It is referenced by no runtime path: not SKILL.md, CI, the bats suite, dev-smoke.sh, or either installer. Removing it: - drops the skill's only python3 dependency (parsing ~/.claude.json) - shrinks the skill's on-disk read footprint to zero -- it no longer reads any agent config file or AGENTKEY_API_KEY value from disk - removes the credential-read pattern that required a SECURITY.md carve-out and a ClawScan false-positive note Also updates the now-dangling references: SECURITY.md (helper-script list, file table, scanner notes), the release-please ClawScan note, the PR-template checkbox, and the directory-tree comments in README / README_zh / CLAUDE.md. While restructuring SECURITY.md's scanner-notes list, also corrects a pre-existing self-contradiction in that block: item 1 claimed check-update.sh compares the release tag against skills/agentkey/version.txt, but the script compares against an embedded constant (LOCAL_VERSION) and reads no file -- now consistent with the same doc's line 35. Typed `chore:` so an internal cleanup does not trigger a user-facing plugin release.
fullstackjam
force-pushed
the
chore/remove-unused-check-mcp-script
branch
from
June 25, 2026 16:21
8075fdd to
3e09e87
Compare
Contributor
|
@claude review |
Contributor
|
🤖 Claude security review requested by @lxcong. Running against HEAD |
|
🤖 Claude security review — HEAD: 3e09e87 Scope: Deletion of ✅ No security or convention issues found.
Review triggered by @lxcong |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Deletes
skills/agentkey/scripts/check-mcp.sh(92 lines) and updates every doc that referenced it. The script has shipped since the initial public release but is dead code — nothing in the skill's runtime ever invokes it.Why it's safe to remove (the receipts)
check-mcp.shwas never wired into the skill:git log -S check-mcp -- '*SKILL.md'returns no commits across all history — the script has never been referenced by the skill's decision tree in any version.list_toolsendpoint directly (SKILL.md → "Status" / Step 0.C), not a shell script. Its three status codes (MCP_OK/MCP_NO_KEY/MCP_NOT_CONFIGURED) are consumed by nothing.scripts-test.yml), the bats suite,dev-smoke.sh,install.sh/install.ps1, oruninstall.sh/uninstall.ps1. The only mentions were prose: SECURITY.md, the ClawScan note, the PR template, and directory-tree comments.(The companion
@agentkey/cliis a separately-published npm package; it writes MCP config and has no reason to invoke a diagnostic bundled inside an already-installed skill.)What removing it buys
python3dependency.check-mcp.shshelled out topython3to parse~/.claude.json; on a host without python3 it silently returned a falseMCP_NO_KEY. The survivingcheck-update.shis pure shell.AGENTKEY_API_KEYvalue from disk — it only talks to the MCP transport. SECURITY.md's "Files the skill reads or writes" table is updated to match.*_API_KEY*) pattern in this script is precisely what required a dedicated SECURITY.md carve-out and a--clawscan-noteitem explaining "this is not credential exfiltration." Both are now unnecessary and removed.Doc updates (no dangling references left)
SECURITY.md— "two helper scripts" → "one"; removed the check-mcp.sh bullet and the*_API_KEY*scanner note; fixed the file table (the skill no longer reads~/.claude.json/~/.env.local;~/.claude.jsonre-characterized as CLI-written so the credential-handling reference stays accurate)..github/workflows/release-please.yml— dropped item (3) from the ClawScan note..github/PULL_REQUEST_TEMPLATE.md— removed the obsolete "check-mcp.sh still works" checkbox.README.md/docs/README_zh.md/.claude/CLAUDE.md— directory-tree comments.grep -rn check-mcpnow returns nothing.Verification
bats tests/— all 10 pass (they cover the untouchedcheck-update.sh).grep -rn 'check-mcp\|MCP_OK\|MCP_NO_KEY\|MCP_NOT_CONFIGURED\|env.local'→ zero hits.release-please.ymlstill parses as valid YAML.Why
chore:and notfix:Typed
chore:deliberately so release-please does not cut a version bump / GitHub Release for an internal cleanup — a release would push a no-op plugin update to every user. No end-user runtime behavior changes.🤖 Generated with Claude Code