Skip to content

v0.3.0 — Subagents, safe MCP config, --diff mode, PR comments

Choose a tag to compare

View all tags
@paladini paladini released this 12 Jul 02:24
· 81 commits to main since this release
v0.3.0
38990d8

Highlights

New checks: subagents and safe MCP config. The scanner now recognizes .cursor/agents/*.md custom subagents (AGT-01, AGT-02) and rewards a .cursor/mcp.json that uses ${ENV_VAR} interpolation for credential-shaped fields instead of hardcoding them (HYG-08) — the positive complement to the existing HYG-04 leak check. The rubric grows from 100 to 108 points across the same six dimensions (Skills & Commands 12→17, Hygiene & Safety 20→23); level thresholds are unchanged, since they're percentage-based per dimension.

Track your score over time. harness-score --diff <baseline.json> compares a scan against a previously saved report — level, score, and per-dimension deltas, plus exactly which checks flipped pass/fail. Works with --json and --md output too.

PR comments from the GitHub Action. Set comment: 'true' on a pull_request workflow and the action posts (and updates) a sticky comment showing your harness score move — "L2 → L3" — right on the PR, instead of a job-summary-only snapshot. Requires the workflow to grant pull-requests: write.

Also in this release

  • A dedicated bug-hunting pass (run before anything shipped) fixed a real security blind spot: the new HYG-08 check previously missed literal secrets stored inside JSON arrays (e.g. "apiKeys": ["sk-...", ...]) and silently accepted numeric/boolean credential values. Both are now caught.
  • --diff now validates that a baseline file actually looks like a harness-score report before comparing, instead of crashing on malformed input — and flags when a baseline comes from a different rubric version, so score deltas aren't misread as regressions.
  • The Action's PR-comment feature now works correctly for monorepo consumers using working-directory, and no longer risks duplicate comments on long-running PRs.
  • Fixed a live CI failure unrelated to any of the above (a Biome false-positive on Vue single-file components, plus a real formatting issue) — main is green again.
  • 66 tests (up from 45); this repository still dogfoods its own scanner at L4 · Self-correcting, 108/108 (100%).

Upgrading

No breaking changes. If you pin harness-score in CI, no action is needed beyond bumping the version — the two new checks only add points, they never remove them.

npx harness-score@latest

Full changelog: v0.1.2...v0.3.0

Assets 2
Loading