{"name":"io.github.GoatInAHat/toolfactory","slug":"goatinahat-toolfactory","title":null,"description":"Build an agent tool once; ship it as Agent Skills, MCP servers, Agent Plugins / Claude / Codex","url":"https://mcp.market/server/goatinahat-toolfactory","rating":null,"grade":"C","score":66,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":31,"stars":0,"forks":0,"downloads_week":420,"last_push_at":"2026-09-16T21:24:48.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/GoatInAHat/toolfactory","website":"https://github.com/GoatInAHat/toolfactory","version":"0.3.1","remotes":[],"packages":[{"registryType":"npm","identifier":"toolfactory","version":"0.3.1","transport":{"type":"stdio"}},{"registryType":"oci","identifier":"ghcr.io/goatinahat/toolfactory:0.3.1","transport":{"type":"stdio"}}],"tools":[{"name":"adopt","description":"Stop regenerating one file; it becomes the author's (recorded as manual in the lock).","write_action":false,"price_micros":0,"input_schema":null},{"name":"bootstrap-repo","description":"Prepare the GitHub repository from the local .env: the `live-tests` environment with its required reviewers and the sensitive config keys inside it, the release registries' tokens at repository scope, GitHub Pages with source = Actions, and npm's trusted publisher. Values go to `gh` on stdin and are never returned.","write_action":false,"price_micros":0,"input_schema":null},{"name":"build","description":"Generate every selected surface in-tree from the identity file and the operation snapshot, and refresh the lock.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check","description":"Fail if the operation snapshot or any generated file drifted from the code (the CI drift gate).","write_action":false,"price_micros":0,"input_schema":null},{"name":"coverage","description":"The operation × surface verdict matrix: native, bridged, degraded, or excluded, with reasons.","write_action":false,"price_micros":0,"input_schema":null},{"name":"doctor","description":"Report which upstream CLIs this machine can delegate to (git, gh, npm, uv, claude, openclaw, clawhub, hermes, uvx, agentskills, MCP Inspector, docker).","write_action":false,"price_micros":0,"input_schema":null},{"name":"echo","description":"Return the text you pass in.","write_action":false,"price_micros":0,"input_schema":null},{"name":"eject","description":"Adopt every file a surface owns, so the author takes it over entirely.","write_action":false,"price_micros":0,"input_schema":null},{"name":"gate","description":"Run the gate here, in order: build, the drift check, every selected surface's upstream validator, the author's checks and tests, and the credential-free host end-to-end. The same step list the generated ci.yml renders, so a project with no CI has the identical gate.","write_action":true,"price_micros":0,"input_schema":null},{"name":"init","description":"Create a new tool: dev.toolfactory/tool.json, the authored identity file, the kernel scaffold for the chosen language, and the first build of every selected surface.","write_action":true,"price_micros":0,"input_schema":null},{"name":"introspect","description":"Spawn the kernel MCP server, list its tools, and snapshot them to dev.toolfactory/ops.json.","write_action":false,"price_micros":0,"input_schema":null},{"name":"notify","description":"Post a message into the live conversation.","write_action":true,"price_micros":0,"input_schema":null},{"name":"package","description":"Build every release asset into dist/release/ — npm tarball, Python distributions, OpenClaw plugin tarball, plugin bundle zip, web build, coverage — by the same steps the release workflow's package job runs. Publishing stays a CI concern.","write_action":false,"price_micros":0,"input_schema":null},{"name":"review-prompt","description":"Evaluate a prompt draft against the codex-prompt-standard rubric: anatomy sections, convention checks, and concrete directives. Draft, run this, fix what it flags, and re-run until it passes.","write_action":false,"price_micros":0,"input_schema":null},{"name":"screenshot","description":"Capture the current page.","write_action":false,"price_micros":0,"input_schema":null},{"name":"secrets-usage","description":"Every credential this project's surfaces need — the tool's own sensitive config keys and the release registries' tokens — with where each one is set, whether it is present locally and on GitHub, and (check) whether the registry accepts it. Never a value.","write_action":false,"price_micros":0,"input_schema":null},{"name":"shoot","description":"Take a screenshot of the current tab.","write_action":false,"price_micros":0,"input_schema":null},{"name":"unadopt","description":"Return an adopted file to toolfactory and regenerate it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"unpublish","description":"Retract what a deselected surface used to publish. Git is the ledger: the previous tag's dev.toolfactory/tool.json says what was selected then, and every registry row that lost its surface is checked for the version that tag published and then retracted with the registry's own CLI — or reported with the exact page, where there is no API.","write_action":false,"price_micros":0,"input_schema":null},{"name":"validate","description":"Run each selected surface's own upstream validator (agentskills, claude plugin validate, MCP Inspector, openclaw, hermes, npm pack, uv build).","write_action":true,"price_micros":0,"input_schema":null},{"name":"web","description":"Open the generated operations page.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":66,"grade":"C","scanned_at":"2026-09-19T19:43:03.302Z","report":{"scannerVersion":"0.1.5","scannedAt":"2026-09-19T19:43:03.229Z","components":{"code":{"score":8,"max":25,"notes":["259 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 3 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"net.raw-ip","severity":"medium","component":"code","title":"Network call to a raw IP address","evidence":"dist/surfaces/browser-extension.d.ts: …xport declare const DEFAULT_ENDPOINT = \"http://127.0.0.1:3000/mcp\"; /** The generated regions: everyth…"},{"id":"install.curl-pipe","severity":"high","component":"code","title":"curl | sh in a script","evidence":"dist/surfaces/hermes-native.js: … function hermesInstall() { return `curl -fsSL ${HERMES_PIN.installer} | bash -s -- --commit ${HERMES_PIN.commit} --s…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"toolfactory","version":"0.3.1","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":8,"publishedAt":"2026-09-16T21:34:35.575Z","repositoryUrl":"git+https://github.com/GoatInAHat/toolfactory.git","weeklyDownloads":420}],"repo":{"found":true,"owner":"GoatInAHat","repo":"toolfactory","archived":false,"pushedAt":"2026-09-16T21:24:48Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/55002508?v=4","ownerCreatedAt":"2019-09-06T20:21:02Z"},"icon":{"url":"https://avatars.githubusercontent.com/u/55002508?v=4&s=128","source":"registry"},"presence":{"stars":0,"forks":0,"downloadsWeek":420,"license":"MIT","lastPushAt":"2026-09-16T21:24:48.000Z","score":31}}}},"grade_history":[],"reviews":[]}