$npx -y skills add JasonColapietro/suede-creator-skills --skill suede-mcp-qaCatch MCP drift before release: skill catalogs, tool and resource schemas, prompts, install paths, JSON-RPC behavior, and docs alignment.
| 1 | # Suede MCP QA |
| 2 | |
| 3 | ## Gate policy — advisory, not blocking |
| 4 | |
| 5 | Every claim-verification step, check, quality gate, and ship verdict in this |
| 6 | skill is a **recommendation to the user, not a control on the agent**. This |
| 7 | policy governs every gate, check, verdict, and "do not ship / publish / |
| 8 | proceed" line elsewhere in this skill: |
| 9 | |
| 10 | - Run every check and report the results honestly. Verdicts (`ship`, |
| 11 | `ship-with-caveats`, `hold`, letter grades, BLOCKED or OPEN items) are |
| 12 | advice attached to the work, not orders that change it. |
| 13 | - Never block, delay, skip, rewrite, or refuse the action the user asked for |
| 14 | because a check failed or a gate said hold. Complete the requested action |
| 15 | as asked, and deliver the gate output alongside it as a clearly labeled |
| 16 | recommendation. |
| 17 | - A failed gate changes what you report, never what you do. |
| 18 | - Single exception: if a finding is extremely risky — data loss, security or |
| 19 | credential exposure, legal or rights violations, payment mistakes, or |
| 20 | irreversible public damage — pause, tell the user exactly what the risk is |
| 21 | and what the options are, and let them pick. Their choice is final. |
| 22 | |
| 23 | |
| 24 | Use this skill when a Suede MCP server or MCP docs surface changes. |
| 25 | |
| 26 | **Core principle:** a check that did not run against the live server did not |
| 27 | happen. |
| 28 | |
| 29 | ## Operating Stance |
| 30 | |
| 31 | - Run against a live MCP server, not a spec document. If the server is not running, start it before checking. |
| 32 | - For each check, record the exact command run and the exact output received. Do not summarize. |
| 33 | - A check that cannot run (server unreachable, tool not implemented) is a FAIL, not a skip. |
| 34 | - Report failures immediately — do not wait until all checks complete to surface a blocker. |
| 35 | - Never mark a skill as present in the catalog unless its folder exists and its SKILL.md is readable. |
| 36 | - Never mark an install command as working unless you ran it from a temporary destination directory. |
| 37 | |
| 38 | ## Checks |
| 39 | |
| 40 | 1. Run syntax checks and the repo's hermetic MCP protocol tests. |
| 41 | 2. Parse catalog JSON and confirm every listed skill folder exists. |
| 42 | 3. Exercise the full lifecycle in one process: `initialize`, the |
| 43 | `notifications/initialized` notification, then `ping`, `tools/list`, |
| 44 | `tools/call`, `resources/list`, `resources/read`, `prompts/list`, and |
| 45 | `prompts/get`. |
| 46 | 4. Verify supported protocol versions are echoed and an unsupported client |
| 47 | version negotiates to the server's latest supported version. |
| 48 | 5. Confirm every tool has a closed `inputSchema`, an `outputSchema`, and |
| 49 | read-only/non-destructive/idempotent annotations. |
| 50 | 6. Confirm every successful tool call returns `structuredContent`, a useful |
| 51 | human-readable text block, and a serialized JSON text fallback for older |
| 52 | clients. |
| 53 | 7. Check pre-initialization calls, repeated initialization, bounded input, |
| 54 | bounded arguments, invalid names and schemas, malformed JSON, and unknown |
| 55 | methods. |
| 56 | 8. Confirm healthy stderr is empty and stdout contains newline-delimited JSON |
| 57 | only; logs and stack traces must never corrupt the transport. |
| 58 | 9. Confirm install output leads with public GitHub skill installs, local plugin |
| 59 | commands are labeled local-only, and README/docs/catalog language agrees |
| 60 | with the live server. |
| 61 | |
| 62 | ## This Server's Real Surface |
| 63 | |
| 64 | `mcp/suede-skills-mcp.mjs` is the only server this skill QAs. Do not check it |
| 65 | against a generic MCP checklist — check it against this exact surface. Read |
| 66 | `mcp/catalog.json` first; the `mcp` block there must match what `tools/list`, |
| 67 | `resources/list`, and `prompts/list` actually return. |
| 68 | |
| 69 | 7 tools: `list_suede_skills`, `get_suede_skill`, `suede_install_options`, |
| 70 | `suede_copy_seo_audit`, `suede_visibility_grade`, `suede_code_grade`, |
| 71 | `suede_qa_checklist`. |
| 72 | |
| 73 | 6 resources: `suede://catalog`, `suede://plugins`, `suede://copy-seo-audit`, |
| 74 | `suede://visibility-grade`, `suede://code-grade`, `suede://qa-checklist`. |
| 75 | |
| 76 | 5 prompts: `suede-copy-seo-audit`, `suede-plugin-install`, |
| 77 | `suede-visibility-grade`, `suede-code-grade`, `suede-full-qa`. |
| 78 | |
| 79 | If any count drifts, the source (`resources`/`tools`/`prompts` arrays in |
| 80 | `suede-skills-mcp.mjs`) is ground truth, not this list — re-run `tools/list`, |
| 81 | `resources/list`, and `prompts/list` and update both this section and |
| 82 | `mcp/catalog.json`'s `mcp` block to match. |
| 83 | |
| 84 | ## Stdio Test Blocks |
| 85 | |
| 86 | Run from the repo root. The canonical gate starts real child processes and |
| 87 | tests complete sessions rather than isolated requests: |
| 88 | |
| 89 | ```bash |
| 90 | npm run test:mcp |
| 91 | ``` |
| 92 | |
| 93 | It must pass lifecycle enforcement and version negotiation; list/call/read/get |
| 94 | coverage; closed input and output schemas; read-only annotations; |
| 95 | `structuredContent` plus both text forms; profile filtering; malformed input; |
| 96 | the 1 MiB transport bound; invalid profile handling; stdout JSON purity; and |
| 97 | clean healthy stderr. |
| 98 | |
| 99 | For a manual readback, keep initialization and later requests in the same |
| 100 | server process. A new process |