Mcpskills MCP server

by mcpskills.io·io.mcpskills/server·v2.5.3·1 stars

No reviews yet

Trust scoring for MCP servers, AI skills & npm packages — 15 signals + safety scanning.

B71/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B71/100

full report

Adoption

Growing

1 stars124 downloads/wk

Reviews

Write one

Nobody has reviewed Mcpskills yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Mcpskills tools (9, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

auto_gate
Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.
batch_check
Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Developer Pro or Team API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).
build_stack
Recommend a vetted stack of trusted tools for a described task. Describe what you're building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion i
check_trust_score
Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.
check_watched
Re-scan all watched repos and check for score changes. Returns any repos whose trust score changed significantly since last check.
get_badge
Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.
list_packages
Browse curated, pre-scored AI skill packages organized by use case. Each package contains vetted skills with trust scores. Available packages: Claude Power User, Full-Stack Vibe Coder, Data & Research, DevOps & Infrastructure, Content & Marketing.
scan_safetywrite action
Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).
watch_repo
Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan2 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 110 days ago8/15
Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10

Overall 71/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Mcpskills compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 71/100; higher than 36% of 48,255 servers
Tools: 9; the typical server has 7
Tools that change things: 11%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 1; more than 65% of 28,688 servers
Downloads a week: 124; more than 67% of 12,191 servers with a package

What its tools let an agent do: 8 read · 1 change

Install Mcpskills in Claude Code, Cursor or VS Code

Runs npx -y @mcpskillsio/server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add server -- npx -y @mcpskillsio/server

Add to Cursor

What the publisher says

From the Mcpskills repository's README, as published. We do not edit it. Read it on GitHub

@mcpskillsio/server

Use the MCPSkills pre-install trust layer from inside Claude Code, Cursor, or any MCP client.

13 standard signals (15 in Skills Mode) across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks. Check install risk before an MCP server or AI skill reaches your agent.

Install

Claude Code

claude mcp add mcpskills -- npx @mcpskillsio/server

Cursor

Add to your .cursor/mcp.json:

{
  "mcpServers": {
    "mcpskills": {
      "command": "npx",
      "args": ["@mcpskillsio/server"]
    }
  }
}

Claude Desktop

Add to claudedesktopconfig.json:

{
  "mcpServers": {
    "mcpskills": {
      "command": "npx",
      "args": ["@mcpskillsio/server"]
    }
  }
}

Tools

checktrustscore

Score any GitHub repo, npm package, or registry URL. Returns trust tier, composite score, and 4 dimension scores.

"Score anthropics/anthropic-sdk-typescript"

scan_safety

Focused safety scan for AI skills. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads.

"Is this MCP server safe? modelcontextprotocol/servers"

list_packages

Browse curated, pre-scored skill packages organized by use case.

"Show me safe AI skill packages for full-stack development"

get_badge

Generate an SVG trust badge URL for your README.

"Get a trust badge for my repo anthropics/anthropic-sdk-typescript"

watch_repo

Start monitoring a repo for trust score changes (requires API key).

"Watch modelcontextprotocol/servers for score changes"

check_watched

Re-scan all watched repos for score or tier changes (requires API key).

"Check my watched repos"

batch_check

Score up to 5 repos in a single call (Developer Pro or Team).

"Batch check these repos: anthropics/anthropic-sdk-typescript, langchain-ai/langchainjs"

auto_gate

Get a boolean go/no-go decision with reasoning.

"Should I install this MCP server? 21st-dev/magic-mcp"

build_stack

Recommend a vetted, pre-scored stack from MCP Skills' curated packages.

"Build me a stack: auth + payments + email"

Full Reports

Free tier returns trust tier + dimension scores (same as mcpskills.io free scans, 10/day).

For full reports (13 standard / 15 Skills Mode signals + safety findings) inside your IDE, set your API key:

export MCPSKILLS_API_KEY=your_key_here

Get your API key at mcpskills.io/api. Developer Pro is $19/mo or $149/yr. Team is $99/mo for org/security workflows.

How It Works

The server calls the mcpskills.io trust scoring API, which:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Mcpskills: common questions

Is Mcpskills MCP server safe?: Mostly: it is graded B (71/100). Read the Mcpskills safety report
How do I install Mcpskills?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Mcpskills need an API key?: Yes. The registry entry asks for MCPSKILLS_API_KEY.
Is Mcpskills maintained?: The last commit was 148 days ago (2026-06-09). The latest release is v2.5.3.
How does Mcpskills compare with other MCP servers?: safety score 71/100 (higher than 36% of 48,255 servers); tools 9 (the typical server has 7); tools that change things 11% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.