Skip to content
Back to skills

Adr

ASecurity

A client that only speaks MCP never sees a checkout path. The routing skill already lived in docs. The `jev` skill teaches the Jev API, which is a different job. Both have to travel inside the installed package, and initialize has to say which is which.

  • 84 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 29, 2026
ai-agentsgitapi

Works with

  • cli
  • api
  • mcp

Security analysis

A100/100

Pro scans all 21 files and shows the line behind each finding

Scanned September 29, 2026

npx -y skills add PyModel/jev-judge-mcp --skill adr --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Adr?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Adr
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/pymodel-adr/badge)](https://www.skillsdirectory.com/skills/pymodel-adr)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
status: accepted
---
# The connecting agent can read the jev skill

A client that only speaks MCP never sees a checkout path. The routing skill already lived in docs. The `jev` skill teaches the Jev API, which is a different job. Both have to travel inside the installed package, and initialize has to say which is which.

## Decision

- `src/jev_judge_mcp/skills/jev/` is the owner's skill, packaged from https://github.com/PyModel/jev-skill at `a596996`. The allowlist is `SKILL.md`, `api-reference.md`, `patterns.md`, `prior-art/*.md`, and `LICENSE` (Copyright (c) 2026 elkaix). Nothing else under `src/jev_judge_mcp/skills/` ships or is served, except `jev-mcp/SKILL.md` and this package's `__init__.py`. `docs/reference/jev-skill/` stays gitignored.
- `docs/skills/jev-mcp/SKILL.md` is a symlink to the packaged routing skill. There is no `docs/skills/jev` symlink: a directory symlink makes Hatch record those bytes under `docs/` and drop them from the wheel.
- The server reads skill files only through `importlib.resources`. There is no checkout fallback.
- `initialize.instructions` names both skills and their resource URIs, and carries `ON_DEMAND` from this module's sibling `instructions.py`. No threshold numbers, no secrets, no harness names.
- The on-demand rule is: Jev is invoked when an unresolved judgment earns a model decision. Deterministic evidence takes precedence; Jev is not a mandatory ceremony. The same text names `jev_gate`, `jev_screen`, and `jev_verify`, and the skip cases. `docs/agent-rules.md` is the doc copy. Other docs point at it.
- This amends ADR-0061. `jev_gate` is the recommended final judgment before claiming done, not a required consult. Skip it when tests, type checks, build, lint, or another explicit acceptance criterion already settle completion.
- Pi's installer entry uses an allow-list (`directTools`) of the published tools plus `get_jev_mcp_skill_md`, so the rest of the packaged skill stays resources rather than tools (ADR-0036, amended here).
- `resources/list` and `prompts/list` serve the allowlist. Tool schemas, tool behavior, and policy are unchanged.
- The reference never captured initialize, and it served no skill resources. This is divergence `packaged-jev-skill`.

## Consequences

- `tests/contract/test_skill_resources.py` pins the stdio fetch and the exact on-demand sentence. `tests/integration/test_uvx_smoke.py` pins that a wheel built by `uvx --from .` still serves `jev` when the process cwd is not the checkout.
- Cookbook numbers on the official docs site are not this server's action defaults.

Files in this skill

  • 0001-behavior-compatible-rewrite-against-frozen-ts-reference.md1.1 KB
  • 0002-model-judges-policy-decides.md3 KB
  • 0003-uniform-envelope-validation-across-providers.md937 B
  • 0004-extract-regex-dialect-and-isolation.md5.1 KB
  • 0005-lengths-measured-in-utf16-code-units.md1 KB
  • 0006-js-compatible-result-serialization.md2 KB
  • 0007-vercel-provider-reserved-not-emulated.md1 KB
  • 0008-provider-endpoints-and-credentials-are-process-config-only.md1.9 KB
  • 0009-distribution-name-jev-mcp-python.md836 B
  • 0010-python-312-and-mcp-sdk-v2.md1.3 KB
  • 0011-propagate-mcp-cancellation-to-providers.md925 B
  • 0012-keep-reference-validation-quirks.md2.2 KB
  • 0013-one-registry-one-execution-kernel-ten-tool-definitions.md7.5 KB
  • 0014-cap-values-measurement-and-enforcement-are-separate.md4.2 KB
  • 0015-one-python-parity-fixture-loader.md2.1 KB
  • 0016-extract-dialect-translates-executors-execute.md4.7 KB
  • 0017-redaction-secret-set-derives-from-settings-schema.md1.8 KB
  • 0018-extract-runs-on-stdlib-re-with-a-narrower-subset.md2.2 KB
  • 0019-parsed-json-value-shape-primitives-live-in-domain.md1.8 KB
  • 0020-divergence-registry-single-source-of-truth.md2.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.