MCP.Market

Skylos MCP server

by duriantaco·io.github.duriantaco/skylos·v3.5.10·936 stars
No reviews yet

Dead code, security, secrets detection and code quality for Python, TypeScript, Go.

C68/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C68/100

full report

Adoption
Established

936 stars18k downloads/wk

Reviews

Write one

Nobody has reviewed Skylos yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Skylos tools (6)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • _has_typed_args

    Check if function arguments have type annotations.

  • analyze
  • quality_check
  • remediate
  • secrets_scan
  • security_scan

Public scan report

scanner v0.1.10 · 2026-11-12 · same rubric, same numbers if you re-run it

2 medium
  • Code scan153 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (2)

  • mediumeval / new Function usedexec.eval
    skylos-3.5.10/skylos/cicd/review.py: …str, str] = { "SKY-D201": "Replace `eval()` with `json.loads()`, `ast.literal_eva…
  • mediumsubprocess with shell=Trueexec.shell-true
    skylos-3.5.10/skylos/cli.py: …SKY-D209": "Shell execution (subprocess shell=True)", "SKY-D210": "TLS verific…
Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Skylos compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
68/100
higher than 30% of 917 Security servers
Tools
6
the typical Security server has 10
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
936
more than 100% of 589 Security servers
Downloads a week
18,490
more than 95% of 386 Security servers with a package

What its tools let an agent do: 6 read

Install Skylos in Claude Code, Cursor or VS Code

claude mcp add skylos -- uvx skylos
Add to Cursor

What the publisher says

From the Skylos repository's README, as published. We do not edit it. Read it on GitHub

Skylos Open-source, local-first checks for dead code, security issues, secrets, quality regressions, and AI-code mistakes before merge.

Website | Docs | Repo Map | Quick Start | GitHub Action | VS Code Extension | Real-World Results | Benchmarks | Roadmap | Contributing

English | Deutsch | 简体中文 | Translations

What Is Skylos?

Skylos is an open-source static analysis CLI for Python, TypeScript, JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, C++, Shell, and deployment config. It runs locally by default and can also be used as a CI/CD PR gate.

Use Skylos when you want one command to check a repo or pull request for:

invented package APIs, and impossible dependency versions

  • dead code and unused files
  • security flaws and dangerous data flows
  • secrets and dependency CVEs
  • CI/CD and edge-device deployment misconfigurations
  • quality regressions such as complexity, duplicate branches, and deep nesting
  • common AI-generated code mistakes, including missing guards, fake helpers,
  • LLM app risks such as unsafe tool use and missing output validation

Choose the Right Command

Each command answers a different question. The source scan requires PATH. Bracketed paths on verify, suite, defend, and clean default to the current directory. suite and defend require a directory; verify and clean also accept a file.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Skylos: common questions

Is Skylos MCP server safe?
With care: it is graded C, so read the findings first (68/100). Read the Skylos safety report
How do I install Skylos?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Skylos need an API key?
Yes. The registry entry asks for SKYLOS_API_KEY.
Is Skylos maintained?
The last commit was 3 days ago (2026-11-12). The latest release is v3.5.10.
What can I use instead of Skylos?
Servers from other publishers that do the same job: Wireshark MCP server, SonarQube MCP Server and SafeWeave MCP server.
How does Skylos compare with other Security MCP servers?
safety score 68/100 (higher than 30% of 917 Security servers); tools 6 (the typical Security server has 10); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Skylos

Same job from other publishers: the closest match first, then the best rated.

  • Wireshark
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
    A
  • SonarQube MCP Server
    Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.
    B
  • SafeWeave
    Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
    C
  • Snyk
    Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
    B
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
Skylos vs Wireshark