mcp-oauth-remote-gateway

Manual OAuth for remote MCP servers on headless gateways.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./optional-skills/mcp/mcp-oauth-remote-gateway/SKILL.md

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, deeply actionable skill body: executable commands, a numbered workflow with validation checkpoints, and clean one-level-deep references to real bundle files. The main weakness is conciseness — it runs long with conceptual and motivational sections that assume less of Claude than warranted.

Suggestions

Tighten or move the conceptual sections ('Why the built-in flow fails', 'Cheap First Fallbacks', 'Dashboard') into the references; the core skill is steps 3-11 and the body spends many tokens on context Claude can derive.

Consolidate the 17 pitfalls — several overlap (7/8 on the breaker, 9/10 on dead refresh vs revoked session) and could be folded into the diagnostic script's decision tree to cut length.

Reduce restated rationale within numbered steps (e.g. repeated Cloudflare-UA explanation in step 3 and pitfall 3) to a single canonical mention.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and dense with hard-won specifics, but it is long and includes conceptual preamble and restated rationale (e.g. the 'Why the built-in flow fails' + 'Cheap fallbacks' + 'Dashboard' sections) that could be tightened; some token cost does not assume Claude's competence.	2 / 3
Actionability	Concrete, executable shell + JSON + Python snippets throughout (DCR payload, PKCE generation, token-exchange form, MCP initialize smoke test), with a runnable diagnostic script in scripts/ that the body references.	3 / 3
Workflow Clarity	A clearly numbered 11-step sequence with explicit validation checkpoints (verify state in step 7, smoke-test token before reload in step 10) and a decision-tree script encoding the pitfall 7/9/10 recovery branches.	3 / 3
Progressive Disclosure	SKILL.md is an overview with well-signaled one-level-deep references to scripts/diagnose-oauth-mcp.py and references/stripe-mcp-oauth-revocation.md, both of which exist as real bundle files; navigation is easy and no nesting beyond one level.	3 / 3
	Total	11 / 12 Passed

Description

60%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, distinctive description with a clear niche, but it lacks an explicit 'Use when...' trigger clause and lists only a single capability, capping completeness and specificity. Adding a use-when trigger and naming concrete actions (e.g., 'register a client, run PKCE, write cached tokens') would raise it.

Suggestions

Add an explicit 'Use when ...' clause naming the trigger scenario (e.g., 'Use when adding an OAuth-gated remote MCP server to a headless Hermes gateway and the browser callback cannot reach it').

Enumerate the concrete actions performed so specificity can score 3 — e.g., 'register a dynamic OAuth client, run the PKCE flow, and write cached tokens so Hermes skips its browser flow'.

Broaden trigger terms to include natural user phrasings like 'MCP won't connect on remote/headless', 'OAuth callback fails', '127.0.0.1 redirect'.

Dimension	Reasoning	Score
Specificity	It names the domain (OAuth) and an action (manual OAuth), but does not list multiple concrete actions; there is only one capability stated.	2 / 3
Completeness	It answers 'what' (manual OAuth) but has no explicit 'Use when...' trigger clause; per the rubric a missing Use-when clause caps completeness at 2.	2 / 3
Trigger Term Quality	Includes natural terms a user might say ('OAuth', 'MCP servers', 'remote', 'headless'), but misses common phrasings like 'MCP', 'headless MCP' and the 'gateway' framing is jargony for a user.	2 / 3
Distinctiveness Conflict Risk	'Manual OAuth for remote MCP servers on headless gateways' is a clear, narrow niche unlikely to overlap with other skills.	3 / 3
	Total	9 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	13 / 16 Passed

Repository: NousResearch/hermes-agent
Path: optional-skills/mcp/mcp-oauth-remote-gateway/SKILL.md
Commit: 4c9628e

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.