MCPskills

Name: MCPskills
Author: BeBraveBeKind

by BeBraveBeKind

Overview Schema Source Related Servers Discussions Admin

JavaScript

@mcpskillsio/server

Use the MCPSkills pre-install trust layer from inside Claude Code, Cursor, or any MCP client.

13 standard signals (15 in Skills Mode) across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks. Check install risk before an MCP server or AI skill reaches your agent.

Install

Claude Code

claude mcp add mcpskills -- npx @mcpskillsio/server

Cursor

Add to your .cursor/mcp.json:

{
  "mcpServers": {
    "mcpskills": {
      "command": "npx",
      "args": ["@mcpskillsio/server"]
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mcpskills": {
      "command": "npx",
      "args": ["@mcpskillsio/server"]
    }
  }
}

Related MCP server: mcp-security-audit

Tools

`check_trust_score`

Score any GitHub repo, npm package, or registry URL. Returns trust tier, composite score, and 4 dimension scores.

"Score anthropics/anthropic-sdk-typescript"

`scan_safety`

Focused safety scan for AI skills. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads.

"Is this MCP server safe? modelcontextprotocol/servers"

`list_packages`

Browse curated, pre-scored skill packages organized by use case.

"Show me safe AI skill packages for full-stack development"

`get_badge`

Generate an SVG trust badge URL for your README.

"Get a trust badge for my repo anthropics/anthropic-sdk-typescript"

`watch_repo`

Start monitoring a repo for trust score changes (requires API key).

"Watch modelcontextprotocol/servers for score changes"

`check_watched`

Re-scan all watched repos for score or tier changes (requires API key).

"Check my watched repos"

`batch_check`

Score up to 5 repos in a single call (Developer Pro or Team).

"Batch check these repos: anthropics/anthropic-sdk-typescript, langchain-ai/langchainjs"

`auto_gate`

Get a boolean go/no-go decision with reasoning.

"Should I install this MCP server? 21st-dev/magic-mcp"

`build_stack`

Recommend a vetted, pre-scored stack from MCP Skills' curated packages.

"Build me a stack: auth + payments + email"

Full Reports

Free tier returns trust tier + dimension scores (same as mcpskills.io free scans, 10/day).

For full reports (13 standard / 15 Skills Mode signals + safety findings) inside your IDE, set your API key:

export MCPSKILLS_API_KEY=your_key_here

Get your API key at mcpskills.io/api. Developer Pro is $19/mo or $149/yr. Team is $99/mo for org/security workflows.

How It Works

The server calls the mcpskills.io trust scoring API, which:

Fetches repo data from GitHub API and OpenSSF Scorecard
Scores 13 standard signals across 4 dimensions (Alive, Legit, Solid, Usable)
Detects AI skills/MCP servers and activates Skills Mode (+2 bonus signals — 15 total)
Runs 5 safety scans based on ClawHavoc and ToxicSkills attack patterns
Assigns a trust tier: Verified (>=7.0), Established (>=4.5), New, or Blocked

License

MIT — Built by Michael Browne at Rise Above Partners.

Available Tools

9 tools

auto_gateA

Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.

Inputs: repo (required).

batch_checkA

Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Developer Pro or Team API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).

Inputs: repos (required).

build_stackA

Recommend a vetted stack of trusted tools for a described task. Describe what you're building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.

Inputs: description (required).

check_trust_scoreA

Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.

Inputs: repo (required).

check_watchedA

Re-scan all watched repos and check for score changes. Returns any repos whose trust score changed significantly since last check.

Inputs: email (required).

get_badgeA

Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.

Inputs: repo (required).

list_packagesA

Browse curated, pre-scored AI skill packages organized by use case. Each package contains vetted skills with trust scores. Available packages: Claude Power User, Full-Stack Vibe Coder, Data & Research, DevOps & Infrastructure, Content & Marketing.

Inputs: package_name.

scan_safetyA

Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).

Inputs: repo (required).

watch_repoA

Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.

Inputs: repo (required), email (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

TDQS

A4.2/5.0

Scored 2026-06-07 18:05 across 9 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: auto_gate gives a simple go/no-go decision, check_trust_score provides detailed scoring, batch_check handles multiples, scan_safety focuses on safety, list_packages curates packages, build_stack recommends stacks, get_badge generates badges, check_watched and watch_repo monitor changes. No two tools have overlapping functionality that would cause confusion.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., auto_gate, batch_check, check_trust_score, watch_repo). The naming is predictable and easy to parse, with no mixing of conventions.

Tool Count5/5

With 9 tools, the set is well-scoped for a trust and safety assessment server. Each tool serves a necessary function without being redundant or excessive, fitting comfortably within the ideal 3-15 range.

Completeness5/5

The tool surface covers the full lifecycle of trust assessment: single and batch scoring, safety scanning, recommendation (build_stack), curated packages (list_packages), monitoring (watch_repo, check_watched), and a badge output (get_badge). There are no obvious gaps for the stated purpose.

Maintenance

ActivityInactive

ResponsivenessLimited data

Resources

Related MCP Connectors

pkgxrayA
io.github.adamsjack711-ux
Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
Penetration Testing Security Developer Tools
2111
https://mcp.pkgxray.ca/mcp
mcpcheckB
io.github.joeyough
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Penetration Testing Security
21
https://mcpcheck.netlify.app/mcp
SkillTriageA
dev.moorai
Scan AI agent skills, MCP server packages and MCP configs before you install them. Static analysis.
Code Analysis Security Developer Tools
41
https://skilltriage.moorai.dev/mcp
LazarettoA
io.github.jamesdfinance-dev
Supply chain security: free npm lockfile malware check, paid scan of packages, skills, MCP servers.
Security Penetration Testing
1021
https://lazaretto.dev/mcp

Related MCP Servers

tooltrust-mcp
AI & Machine Learning Security Testing & QA Tools
AgentSafe-AI
A
license
Not graded
quality
B
maintenance
Scans MCP servers for prompt injection, supply chain attacks, excessive permissions, and code execution risks. Includes an offline blacklist that catches known-compromised packages like LiteLLM 1.82.7/1.82.8 and Trivy with zero latency.
Updated 2 days ago (2026-11-09 20:40 UTC)
19
MIT
mcp-security-audit
Penetration Testing CI/CD & DevOps
eltociear
A
license
Not graded
quality
C
maintenance
Scans MCP servers, AI agent skills, and plugins for 68+ malicious patterns including credential exfiltration, prompt injection, and code execution.
Updated a month ago (2026-09-30 04:21 UTC)
38 npm
5
MIT
AIShield
Security Code Analysis Penetration Testing
lm203688
A
license
Not graded
quality
B
maintenance
Scans MCP servers and AI tools for security risks, providing 4-dimensional scoring and badges, with optional guardrail MCP for auto-protection.
Updated 9 days ago (2026-11-02 18:18 UTC)
2
MIT
mcp-fortress
Security Penetration Testing
mcp-fortress
A
license
Not graded
quality
D
maintenance
Scans MCP servers for security vulnerabilities, prompt injection, and tool poisoning, providing risk scores and protection.
Updated 7 months ago (2026-04-20 13:24 UTC)
4
MIT

@mcpskillsio/server

Install

Claude Code

Cursor

Claude Desktop

Tools

check_trust_score

scan_safety

list_packages

get_badge

watch_repo

check_watched

batch_check

auto_gate

build_stack

Full Reports

How It Works

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

tooltrust-mcp

mcp-security-audit

AIShield

mcp-fortress

`check_trust_score`

`scan_safety`

`list_packages`

`get_badge`

`watch_repo`

`check_watched`

`batch_check`

`auto_gate`

`build_stack`