Spikard
Goldziher/spikard
Scaffold Spikard projects and generate code from OpenAPI, AsyncAPI, OpenRPC, GraphQL, and Protobuf schemas using the Spikard CLI or its MCP server.
Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders.
Install Flutter MCP Boundary Audit
$ npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Arenukvern/mcp_flutter flutter-mcp-boundary-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Arenukvern/mcp_flutter.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugin/skills/flutter-mcp-boundary-audit .claude/skills/flutter-mcp-boundary-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "flutter-mcp-boundary-audit" agent skill from https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-audit into .claude/skills/flutter-mcp-boundary-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "flutter-mcp-boundary-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Arenukvern/mcp_flutter flutter-mcp-boundary-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Arenukvern/mcp_flutter.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugin/skills/flutter-mcp-boundary-audit .agents/skills/flutter-mcp-boundary-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "flutter-mcp-boundary-audit" agent skill from https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-audit into .agents/skills/flutter-mcp-boundary-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "flutter-mcp-boundary-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Arenukvern/mcp_flutter flutter-mcp-boundary-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Arenukvern/mcp_flutter.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugin/skills/flutter-mcp-boundary-audit .cursor/skills/flutter-mcp-boundary-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "flutter-mcp-boundary-audit" agent skill from https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-audit into .cursor/skills/flutter-mcp-boundary-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "flutter-mcp-boundary-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Arenukvern/mcp_flutter.git --path plugin/skills/flutter-mcp-boundary-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Arenukvern/mcp_flutter flutter-mcp-boundary-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Arenukvern/mcp_flutter.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugin/skills/flutter-mcp-boundary-audit .gemini/skills/flutter-mcp-boundary-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "flutter-mcp-boundary-audit" agent skill from https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-audit into .gemini/skills/flutter-mcp-boundary-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "flutter-mcp-boundary-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Arenukvern/mcp_flutter flutter-mcp-boundary-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Arenukvern/mcp_flutter.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugin/skills/flutter-mcp-boundary-audit .github/skills/flutter-mcp-boundary-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "flutter-mcp-boundary-audit" agent skill from https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-audit into .github/skills/flutter-mcp-boundary-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "flutter-mcp-boundary-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Arenukvern/mcp_flutter flutter-mcp-boundary-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Arenukvern/mcp_flutter.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugin/skills/flutter-mcp-boundary-audit .opencode/skills/flutter-mcp-boundary-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "flutter-mcp-boundary-audit" agent skill from https://github.com/Arenukvern/mcp_flutter/tree/main/plugin/skills/flutter-mcp-boundary-audit into .opencode/skills/flutter-mcp-boundary-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "flutter-mcp-boundary-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
flutter-mcp-boundary-audit- GitHub stars
- 387
- Token cost
- ~3k tokens
- SKILL.md length
- 1,141 words
- Files
- 2
- Skills in repo
- 23
- Repo updated
- First seen
- Licence
- MIT
At a glance
Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders.
- Works in 4 steps: List tools/resources (or OpenAPI GET)… → Invoke with missing required →… → Invoke with extra properties when schema… → …
- Changing tool registration
- SKILL.md covers When to run, Boundary checklist, Gateway divergence and Dual-path parity, plus 7 more sections
- Calls rg
What it does
Flutter MCP Boundary Audit is an agent skill from Arenukvern/mcp_flutter. Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders. Use when changing tool registration, RPC/plugin registries, dynamic tools, MCP or WebMCP surfaces, CLI exec aliases, OpenAPI or JSON Schema contracts, migrators/codegen, bridge argument encoding, or platform docs that describe API contracts.
Its SKILL.md is about 3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `reference.md`).
It sits in Mobile, covering Cross-platform mobile apps, MCP servers and Project scaffolding. It works with Model Context Protocol, Flutter and OpenAPI. The repository describes itself as: MCP Toolkit for Flutter AI Agent Driven Development (MCP/CLI + custom client side tools) - via closed feedback loop (visual & semantic snapshot) and high client side… The licence is MIT.
When your agent uses it
- Changing tool registration
- RPC/plugin registries
- WebMCP surfaces
- CLI exec aliases
Example prompts
- “/flutter-mcp-boundary-audit”
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- List tools/resources (or OpenAPI GET) shows required and strict additionalProperties where intended.
- Invoke with missing required → structured failure (ok: false, 4xx, or validation error)—before handler side effects.
- Invoke with extra properties when schema is strict → same failure mode.
- If dual paths exist, repeat on both catalog and runtime registration names.
What it can do on your machine
Read from SKILL.md and the folder at commit 62f3ee1. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
rg
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Flutter MCP Boundary Audit loads about 3k tokens when it runs. Until then it costs about 117 tokens; SKILL.md has 1,141 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from Arenukvern/mcp_flutter at commit 62f3ee1, republished under its MIT licence (© Arenukvern). 1,141 words, ~3,022 tokens.
Download SKILL.mdSave it as
.claude/skills/flutter-mcp-boundary-audit/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- flutter-mcp-boundary-audit
- description
- Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders. Use when changing tool registration, RPC/plugin registries, dynamic tools, MCP or WebMCP surfaces, CLI exec aliases, OpenAPI or JSON Schema contracts, migrators/codegen, bridge argument encoding, or platform docs that describe API contracts.
<!-- @FMT_MODE_PRELUDE -->Contract boundary audit
Skill ID:
flutter-mcp-boundary-audit— name is historical; content is repository-neutral. Same workflow applies to MCP stacks, RPC gateways, plugin registries, and OpenAPI-style contracts.
For mcp_flutter, use this skill to audit Flutter adapter parity:
fmt_* catalog schemas, CLI exec, VM-service extension gateways, dynamic
discovery, migrators, and consumer platform docs. Change app discovery or the
Flutter bridge here; change canonical IntentCall registry/session semantics,
schema policy, platform projection, or publish behavior upstream.
Find split-brain bugs: what clients see in listings, catalogs, or docs ≠ what runtime enforces on invoke—or validation exists on one gateway only.
Typical symptoms:
- Advertised
requiredfields differ from what invoke accepts (empty payload succeeds, wrong keys ignored) - Host/catalog path validates; in-process or extension path does not (or the reverse)
- Migrator or codegen rewrites entries with empty or permissive schema placeholders
- Same logical capability registered twice with different schemas (listing vs invoke, or path A vs path B)
- Stale docs claim “always permissive” or “no validation” while code is fail-closed
When to run
| Trigger (generic) | Audit focus |
|---|---|
| Tool/handler authoring, schema attachment at registration | Authoring → discovery payload |
| Dynamic or plugin registration on the app/runtime side | Runtime validate-before-handler |
Server registry, forward/dispatch, catalog *_client_tool helpers | Registry listing + invoke |
| Host gateway (VM extension, IPC, HTTP proxy) before delegating to runtime | Host validate-before-delegate; fail-closed missing schema |
In-process invoke (invokeDirect, browser hook, embedded bridge) | Same schema as listing; validate before execute |
| Entry migrator / codegen from annotated sources | Schema preservation, not permissive fallbacks |
| Shared schema module vs duplicate definitions | Dual-path parity |
| Bridge handlers, non-scalar arguments | Encoding (JSON, protobuf, etc.) vs handler expectations |
| Platform / ADR / registration docs | Stale claims vs code |
Also run after changes to JSON Schema, OpenAPI request bodies, protobuf RPC messages, or plugin manifest input shapes when multiple gateways consume the same logical tool.
Boundary checklist
Trace authoring → discovery → validation → execute for every touched tool or RPC:
| Step | Question | Where to look (your repo) |
|---|---|---|
| Authoring | Does the canonical input schema reach the registration/descriptor type (not dropped at a toolkit/bridge wrapper)? | Authoring layer / entry model / code generator output |
| Authoring | Do bridge tools encode non-scalar args consistently for legacy handlers? | Bridge helpers, adapter layers |
| Discovery | Does dynamic registration send the full inputSchema (not {} or implicit-any)? | App registration API, manifest emitter |
| Discovery | Does the host list/catalog tool expose the same schemas as the runtime registry? | List-tools handler vs app registration |
| Server registry | Does registry intent/metadata use real schema, not a permissive placeholder? | Registry builder, MCP tool → intent mapping |
| Validate (registry) | Does forward/dispatch call validate before execute? | Registry forward path |
| Validate (host gateway) | Does the host gateway validate before delegating? Fail-closed if schema missing? | Gateway implementation |
| Validate (runtime) | Does the runtime callback validate before handler? | Service extension / in-process hook |
| Validate (wire) | If wire args are strings/maps, is coercion applied before strict validation on paths that see wire shape? | Coercion module vs host-only typed JSON |
| Validate (in-process) | Does direct invoke validate before execute? | In-process entry invoke |
| Validate (CLI) | Do CLI exec / catalog commands use the same schema as MCP listing? | CLI dispatch vs server tools |
| Execute | Any .execute( / handler dispatch without prior validate in production code? | Grep (below) |
| Migrator | Does migration preserve primitive/required/additionalProperties from source schema? | Migrator, codegen |
| Docs | Do platform/registration docs match actual fail-closed behavior? | Platform doc, ADRs |
Gateway divergence
Same logical tool may flow through different gateways—each must agree on schema and validation order:
Authoring (entry / descriptor)
├─► Runtime registration ──► extension/callback ──► handler
├─► In-process register (WebMCP / embedded) ──► invokeDirect
└─► Host list/catalog ──► catalog invoke ──► host gateway ──► runtime| Gateway role | Must validate before | Fail if schema missing? |
|---|---|---|
| Runtime callback (extension, plugin hook) | handler | yes (production tools) |
| Registry forward | execute / handler | yes |
| Host gateway (proxy to runtime) | delegate call | yes |
| In-process invoke | execute | yes |
| Catalog / fmt_* / CLI wrapper | forward to runtime | yes (same as listing) |
CLI exec | command dispatch | yes |
Red flag: validation only in tests, only on the catalog path, or only on listing—not on the path your change actually uses.
Wire coercion (when applicable)
Some stacks deliver string-key maps on the wire (VM service extensions, JSON-RPC with loose typing). Separate concerns:
| Mechanism | Role |
|---|---|
| Coerce-for-schema | Property-type coercion from wire strings before strict schema validation |
| Handler-side wire parsers | Optional when handlers still read raw wire maps |
| Outbound wire encoding | Handler args → wire-safe representation |
Re-audit host gateway vs runtime callback if you add coercion on one side only—hosts that expect typed JSON must not assume runtime already coerced (and vice versa).
Show full SKILL.md (443 more words)Show less
Dual-path parity
One logical capability often exists twice:
| Path | Typical role | Listing / invoke |
|---|---|---|
| Runtime / app dynamic | Registered in the running app or plugin host | Extension name, dynamic registry |
| Host catalog | Server-side MCP tools, CLI aliases, OpenAPI routes | Prefixed or bare names on wire |
For each shared tool, compare:
requiredkeysadditionalProperties: false(or equivalent strictness)- Host-only fields (e.g.
connection) present on one path only - Property types / enums
- Default values and coercion behavior
Document intentional deltas in your platform contract doc (not only in tests).
Red-flag grep
Run from your repository root. Adjust globs to your languages and package layout.
# Empty or permissive advertised schemas (JSON Schema style)
rg "inputSchema:\s*const\s*\{\s*'type':\s*'object'" --glob "*.dart" -g '!test/fixtures/**' -g '!**/after_*.dart'
rg '"type"\s*:\s*"object"\s*,\s*\}' --glob "*.{dart,ts,js,json,yaml}"
rg "_emptyObjectSchema|additionalProperties:\s*true" --glob "*.{dart,ts,js}"
# OpenAPI / generic permissive bodies
rg "additionalProperties:\s*true" --glob "*.{yaml,yml,json}"
rg "schema:\s*\{\s*\}" --glob "*.{yaml,yml}"
# Execute without validate (review each hit; exclude tests/fixtures)
rg "\.execute\(" --glob "*.{dart,ts,js}" | rg -v "validate|test/|_test\.|\.test\."
# Direct invoke bypass
rg "invokeDirect|invoke_direct|directInvoke" --glob "*.{dart,ts,js}"
# Manual review: validate appears before execute on each path
# Permissive registry placeholders
rg "emptyObjectSchema|empty_object_schema|placeholder.*schema|inputSchemaFrom" --glob "*.{dart,ts,js}"
# Migrator stripping schemas
rg "inputSchema|input_schema" --glob "*migrate*"
# Duplicate registration (e.g. JS + native)
rg "registerTool|register_tool" --glob "*.{dart,ts,js}"
# Stale “always permissive” docs
rg -i "permissive|additionalProperties:\s*true|no validation|accepts anything" --glob "*.md"
# Bridge / JSON args
rg "jsonEncode|JSON\.encode|serialize.*argument" --glob "*{bridge,entry,adapter}*"Add project-specific patterns after completing Adapting to your repo.
E2E proof
Run your integration tests that cover listing + invalid invoke (not a specific app path).
Checklist:
- List tools/resources (or OpenAPI GET) shows
requiredand strictadditionalPropertieswhere intended. - Invoke with missing
required→ structured failure (ok: false, 4xx, or validation error)—before handler side effects. - Invoke with extra properties when schema is strict → same failure mode.
- If dual paths exist, repeat on both catalog and runtime registration names.
Optional: schema parity unit tests comparing shared module vs duplicate definitions (no device required).
Report template
## Finding: [title]
- **Severity**: P0 | P1 | P2
- **Boundary**: authoring | discovery | validation | execute
- **Gateway**: runtime-callback | registry | in-process | host-gateway | cli | migrator | docs
- **Files**: ...
- **Symptom**: clients/docs see X; runtime does Y
- **Fix**: ...
- **Proof**: test name or grep commandTracker (optional)
If your repo uses a superpowers/tracker or hardening program, record new findings there or as issues—do not reopen completed items unless regression.
Adapting to your repo
Before auditing, fill this map (keep in audit notes or PR description):
| Role | Your location | Notes |
|---|---|---|
| Authoring | e.g. entry model, OpenAPI spec, @Tool annotations | Where canonical schema is defined |
| Discovery | e.g. registerDynamics, plugin manifest, MCP tools/list | What clients read |
| Registry / catalog | e.g. dynamic registry, server tool table | Listing vs invoke entry points |
| Host gateway | e.g. VM extension proxy, API gateway, sidecar | Validates before delegate? |
| Runtime callback | e.g. service extension, plugin host RPC | Validates before handler? |
| In-process invoke | e.g. WebMCP, embedded JS bridge | Same as tools/list? |
| CLI | e.g. exec, bare vs prefixed aliases | Same schema as MCP? |
| Shared schema module | e.g. interaction_input_schemas, OpenAPI components | Single source of truth? |
| Migrator / codegen | e.g. migrate agent-entries | Preserves required/properties? |
| Platform doc | e.g. INTENTCALL_PLATFORM.md, README contract section | Matches fail-closed code? |
Checklist
- Map tool registration path (authoring → discovery).
- Map listing gateway vs invoke gateway(s); list every hop.
- Map schema representation (JSON Schema maps, OpenAPI, protobuf, Dart
ObjectSchema, etc.). - Add 2–3 repo-specific red-flag greps (permissive placeholder, your invoke helper name).
- Identify dual-path tools; note shared module or document intentional split.
- Run integration test or manual proof for one strict tool on every gateway you touched.
Deep reference
Worked example (mcp_flutter), file map, and regression patterns: reference.md
Related skills (mcp_flutter)
When working in this monorepo only:
flutter-mcp-toolkit-custom-tools— authoring entriesflutter-mcp-toolkit-intentcall-migration— migrate agent-entriesflutter-mcp-toolkit-maintain-web— WebMCP / in-process invokeflutter-mcp-cli-runtime-validation— runtime validate-runtime
© Arenukvern, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file in plugin/skills/flutter-mcp-boundary-audit of Arenukvern/mcp_flutter.
- SKILL.md
- reference.md
Open the folder on GitHubat commit 62f3ee1
Compare with similar skills
Flutter MCP Boundary Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Flutter MCP Boundary Audit this skillArenukvern/mcp_flutter | 387 | — | ~3k | Automated safety check: Pass | MIT | |
| SpikardGoldziher/spikard | 124 | — | ~799 | Automated safety check: Pass | MIT | |
| MCP Server Builderalirezarezvani/claude-skills | 28k | — | ~985 | Automated safety check: Pass | MIT | |
| Retrieving Developer Knowledgegoogle/skills | 21k | — | ~2k | Automated safety check: Pass | Apache-2.0 | |
| Create ProjectVeryGoodOpenSource/vgv-ai-flutter-plugin | 170 | — | ~1.2k | Automated safety check: Pass | MIT | |
| OpenAPI to MCP Servermcp-use/mcp-use | 11k | — | ~5.2k | Automated safety check: Pass | Apache-2.0 |
Similar skills
MCP Server Builder
alirezarezvani/claude-skills
Design and ship production-ready MCP (Model Context Protocol) servers from OpenAPI contracts instead of hand-written tool wrappers.
- Official
Retrieving Developer Knowledge
google/skills
Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI/Gemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms.
Create Project
VeryGoodOpenSource/vgv-ai-flutter-plugin
Scaffold a new Dart or Flutter project from a Very Good CLI template, covering the flutterapp, dartpackage, flutterpackage, flutterplugin, dartcli, flamegame, and docssite templates, inferring the…
OpenAPI to MCP Server
mcp-use/mcp-use
Turns an OpenAPI or Swagger spec into an MCP server with the mcp-use TypeScript SDK, mapping each operation to a tool, wiring auth, testing and deploying.
API Endpoint Contract
trycompai/comp
The contract every new or modified API endpoint must follow so it is correct for the public OpenAPI spec, the MCP server (npm @trycompai/mcp-server), the ValidationPipe, and the docs.
More from Arenukvern/mcp_flutter
All 23 skills in this repoHarness Engineering Lifecycle
Arenukvern/mcp_flutter
Design, implement, and integrate generalized validation harnesses across a producer-consumer boundary after a local harness contract exists.
Mixture Of Experts
Arenukvern/mcp_flutter
Run a Mixture of Experts (MoE) audit on any topic, plan, codebase, evidence archive, or process.
Multi Agent Handoff
Arenukvern/mcp_flutter
Plan and document handoffs, parent lane contracts, and parallel batch contracts between specialized AI agents (foreman, workers, reviewers).
Plugin Marketplace Setup
Arenukvern/mcp_flutter
Designs public or private Agent Skill and plugin marketplaces for Cursor, Claude Code, Codex, Zed, Open Plugin, and npx skills—manifest layout, install matrix, and Skill Steward vs product boundaries.
Release Changelog Harness
Arenukvern/mcp_flutter
Chooses ecosystem-native release and changelog tooling (Changesets, Melos, release-plz) plus binary distribution (GitHub Release tarballs, install.sh) when the product is an executable.
Repository Governance Lifecycle
Arenukvern/mcp_flutter
Master orchestration for repository governance, North Star impact, sub-Star boundaries, and repair-first or evidence-first drift checks.
Related
Works with
Categories
Questions about Flutter MCP Boundary Audit
What does Flutter MCP Boundary Audit do?
Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders. Flutter MCP Boundary Audit is an agent skill from Arenukvern/mcp_flutter. Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders.
When should I use Flutter MCP Boundary Audit?
Flutter MCP Boundary Audit fits situations like: changing tool registration; RPC/plugin registries; webMCP surfaces; CLI exec aliases.
How do I install Flutter MCP Boundary Audit in Claude Code?
Run `npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a claude-code`. Or copy the skill folder (plugin/skills/flutter-mcp-boundary-audit in Arenukvern/mcp_flutter) into .claude/skills/flutter-mcp-boundary-audit in your project. Claude Code loads it when a task matches its description.
How do I install Flutter MCP Boundary Audit in Codex?
Run `npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a codex`. Or copy the skill folder (plugin/skills/flutter-mcp-boundary-audit in Arenukvern/mcp_flutter) into .agents/skills/flutter-mcp-boundary-audit in your project. Codex loads it when a task matches its description.
Can I use Flutter MCP Boundary Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Arenukvern/mcp_flutter --skill flutter-mcp-boundary-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/flutter-mcp-boundary-audit, .gemini/skills/flutter-mcp-boundary-audit, .github/skills/flutter-mcp-boundary-audit and .opencode/skills/flutter-mcp-boundary-audit in your project.
What does Flutter MCP Boundary Audit need to run?
Going by SKILL.md and its folder, Flutter MCP Boundary Audit needs the command-line tools its instructions call (rg).
Does Flutter MCP Boundary Audit access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Flutter MCP Boundary Audit safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Flutter MCP Boundary Audit use?
Flutter MCP Boundary Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Flutter MCP Boundary Audit use?
About 3k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Flutter MCP Boundary Audit?
Skills that share tags, products or a category with Flutter MCP Boundary Audit: Spikard (Goldziher/spikard, 124 stars), MCP Server Builder (alirezarezvani/claude-skills, 28k stars), Retrieving Developer Knowledge (google/skills, 21k stars) and Create Project (VeryGoodOpenSource/vgv-ai-flutter-plugin, 170 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Flutter MCP Boundary Audit?
Arenukvern (a GitHub user) maintains it in Arenukvern/mcp_flutter, which has 387 GitHub stars. The repository holds 23 skills in this directory. The repository was last updated on October 3, 2026.
Source: Arenukvern/mcp_flutter on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.