myco:mcp-response-redaction-governance

myco:mcp-response-redaction-governance is an Agent security & guardrails skill for AI agents, published by sirkirby in the unifi-mcp repository on GitHub. Skillspace rates myco:mcp-response-redaction-governance D (55/100) and it passed the safety scan; the rating is based on static analysis only.

Use this skill whenever you're adding, changing, or reviewing sensitive-field disclosure behavior on an MCP tool or API response — even if the user just asks to "expose this field" or "let callers opt into raw data." Covers: configuring per-surface redaction via redact_sensitive_fields and its env-var hierarchy (should_redact_sensitive_fields in unifi-core), the two real, separately-owned policy mechanisms in unifi-core (PolicyGateChecker for mutation gates, the redaction resolver for response disclosure) and how to extend either for a new domain, the two distinct enforcement points (per-tool/per-route redaction application vs. the StrictKwargFastMCP.call_tool write-back marker guard), and migrating legacy include_sensitive-style caller flags to server-owned policy. Trigger this any time a change would let a request argument control whether secrets/tokens/sensitive fields are disclosed in a response — that decision belongs to server/operator policy, never to the caller.

Grade
D
Quality
55 / 100
Safety
Passed
GitHub stars
816

Unproven: rated by static analysis only, not yet compared head-to-head.

Our two independent classifiers differ on this skill's category, so treat the placement as provisional.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHubsirkirby/unifi-mcp

Our review

Architecture
77 / 100
Maturity
Basic: a single SKILL.md
Security scan
No issues found
License
Not declared. Check the repository before reusing it.

Not checked yet

  • Category is a classifier prediction; no model has read this skill yet
  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Agent security & guardrails

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.