Sponsor Suno AI Music arrow_forward
Subagent

1 Mcp Resolver

Resolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so enriched type data is available for wipe validation.

Type
Subagent
Repository
trailofbits/skills
GitHub stars
7.3k
License
CC-BY-SA-4.0
Repo last updated
Sep 25, 2026
Model
inherit

What 1 Mcp Resolver is

1 Mcp Resolver is a subagent published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”

A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.

Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to 1 Mcp Resolver and get back a compact result.

It is set up to use these tools: Read, Grep, Glob, Write, Bash, mcp__serena__activate_project, mcp__serena__find_symbol, mcp__serena__find_referencing_symbols, mcp__serena__get_symbols_overview. Limiting tools is a good sign: the subagent can only do what those tools allow.

How to install 1 Mcp Resolver

Claude Code

  1. Download 1-mcp-resolver.md from the repository.
  2. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
  3. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.

Claude Cowork

  1. Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
  2. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/zeroize-audit/agents/1-mcp-resolver.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.

Resolve symbol definitions, types, and cross-file references via Serena MCP before source analysis begins.

Input

You receive these values from the orchestrator:

Process

Step 0 — Load Configuration and Inputs

Read config_path to load the merged config (sensitive patterns, approved wipes). Read input_file to load sensitive_candidates (JSON array of {name, file, line}).

Step 1 — Activate Project

Call activate_project with repo_root. This must succeed before any other Serena tool.

Tool: activate_project
Arguments:
  project: "<repo_root>"

If activation fails, write status.json with "status": "failed" and stop.

Step 2 — Resolve Symbols

For each candidate in sensitive_candidates:

  1. Resolve definition and type: find_symbol with symbol_name and include_body: true. Record file, line, kind, type info, array sizes, and struct layout.
  2. Collect use sites: find_referencing_symbols with symbol_name. Record all cross-file references.
  3. Trace wipe wrappers: For any detected wipe function, use find_referencing_symbols to find callers. Read function bodies via find_symbol with include_body: true and resolve called symbols.
  4. Survey unfamiliar TUs: Use get_symbols_overview when needed.

Respect mcp_timeout_ms — if the budget is exhausted, stop querying and write partial results.

Step 3 — Build Reference Graph

From the collected results, build:

  • A symbol-keyed map of definitions with resolved types
  • A cross-file reference graph (caller -> callee relationships)
  • Wipe wrapper chains (function A calls B which calls explicit_bzero)

Step 4 — Normalize Evidence

Pipe all raw MCP output through the normalizer:

uv run --no-project {baseDir}/tools/mcp/normalize_mcp_evidence.py \
  --input <raw_results> \
  --output <workdir>/mcp-evidence/symbols.json

For Serena tool parameters, query patterns, and empty-response troubleshooting, see {baseDir}/references/mcp-analysis.md.

Output

Write all output files to {workdir}/mcp-evidence/:

Error Handling

  • Activation failure: Write status.json with "status": "failed", exit. The orchestrator will set mcp_available=false.
  • Timeout: Write partial results. Set status.json to "status": "partial" with the count of resolved vs. total candidates.
  • Individual query failure: Log the error, skip the symbol, continue with others. Record skipped symbols in status.json.errors.
  • Always write status.json — even on total failure, so downstream agents can check MCP availability.

Cross-Reference Convention

This agent does not assign finding IDs. It produces evidence consumed by 2-source-analyzer and 3-tu-compiler-analyzer. Evidence files use relative paths from {workdir} (e.g., mcp-evidence/symbols.json).

Before you install

  • Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
  • Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
  • Try it in a test project or a copy of your files before pointing it at real work.
  • Pin the version you tested, and review changes before updating.
  • Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is 1 Mcp Resolver?

1 Mcp Resolver is a subagent for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Resolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so enriched type data is available for wipe validation.

How do I install 1 Mcp Resolver in Claude Code?

Download 1-mcp-resolver.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.

Can I use 1 Mcp Resolver in Claude Cowork?

Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.

Is 1 Mcp Resolver safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under CC-BY-SA-4.0. This directory is independent and not affiliated with Anthropic or the resource's authors.