Mcpskills

io.mcpskillsPublished by mcpskills.iov2.5.3Updated Nov 3, 2026

Trust scoring for MCP servers, AI skills & npm packages — 15 signals + safety scanning.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Scores the trust and safety of MCP servers, AI skills, npm packages and GitHub repos so an assistant can vet them before install.

What you can do
  • Score a GitHub repo, npm package or registry URL and get a trust tier, composite score and four dimension scores
  • Run a focused safety scan for prompt injection, shell execution, network exfiltration, credential theft and obfuscated payloads
  • Get a go/no-go install decision with reasoning, or batch-score up to five repos in one call
  • Browse curated pre-scored skill packages and get recommended vetted stacks by use case
  • Generate an SVG trust badge URL, and with an API key watch repos and re-scan them for score or tier changes
When to use it
Useful when an assistant is about to add an MCP server, AI skill or npm dependency and you want a quick risk check first, or when you maintain a curated list of packages and want ongoing score monitoring.
Requirements
Runs locally via npx from the npm package @mcpskillsio/server, so Node.js is needed. It calls the mcpskills.io scoring API, so network access is required. An optional MCPSKILLS_API_KEY unlocks full reports, watch and batch features; the free tier is limited to 10 scans per day.
Before you install
The optional MCPSKILLS_API_KEY is a secret and should be supplied through the environment, not committed. Paid tiers are advertised (Developer Pro and Team subscriptions), so watch and batch features may require a paid plan. Queries and repo identifiers are sent to the mcpskills.io API, and scores are third-party judgments rather than guarantees.

Installation

In SourceWeft

  1. Open Mcpskills in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[MCP Skills — the pre-install trust layer for MCP servers and AI skills]

@mcpskillsio/server

Use the MCPSkills pre-install trust layer from inside Claude Code, Cursor, or any MCP client.

13 standard signals (15 in Skills Mode) across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks. Check install risk before an MCP server or AI skill reaches your agent.

[npm version] [MCP Registry] [License: MIT]

[Add to Cursor] [Install in VS Code]

Install

Claude Code

bash
claude mcp add mcpskills -- npx @mcpskillsio/server

Cursor

Add to your .cursor/mcp.json:

json
{  "mcpServers": {    "mcpskills": {      "command": "npx",      "args": ["@mcpskillsio/server"]    }  }}

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "mcpskills": {      "command": "npx",      "args": ["@mcpskillsio/server"]    }  }}

Tools

check_trust_score

Score any GitHub repo, npm package, or registry URL. Returns trust tier, composite score, and 4 dimension scores.

"Score anthropics/anthropic-sdk-typescript"

scan_safety

Focused safety scan for AI skills. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads.

"Is this MCP server safe? modelcontextprotocol/servers"

list_packages

Browse curated, pre-scored skill packages organized by use case.

"Show me safe AI skill packages for full-stack development"

get_badge

Generate an SVG trust badge URL for your README.

"Get a trust badge for my repo anthropics/anthropic-sdk-typescript"

watch_repo

Start monitoring a repo for trust score changes (requires API key).

"Watch modelcontextprotocol/servers for score changes"

check_watched

Re-scan all watched repos for score or tier changes (requires API key).

"Check my watched repos"

batch_check

Score up to 5 repos in a single call (Developer Pro or Team).

"Batch check these repos: anthropics/anthropic-sdk-typescript, langchain-ai/langchainjs"

auto_gate

Get a boolean go/no-go decision with reasoning.

"Should I install this MCP server? 21st-dev/magic-mcp"

build_stack

Recommend a vetted, pre-scored stack from MCP Skills' curated packages.

"Build me a stack: auth + payments + email"

Full Reports

Free tier returns trust tier + dimension scores (same as mcpskills.io free scans, 10/day).

For full reports (13 standard / 15 Skills Mode signals + safety findings) inside your IDE, set your API key:

bash
export MCPSKILLS_API_KEY=your_key_here

Get your API key at mcpskills.io/api. Developer Pro is $19/mo or $149/yr. Team is $99/mo for org/security workflows.

How It Works

The server calls the mcpskills.io trust scoring API, which:

  1. Fetches repo data from GitHub API and OpenSSF Scorecard
  2. Scores 13 standard signals across 4 dimensions (Alive, Legit, Solid, Usable)
  3. Detects AI skills/MCP servers and activates Skills Mode (+2 bonus signals — 15 total)
  4. Runs 5 safety scans based on ClawHavoc and ToxicSkills attack patterns
  5. Assigns a trust tier: Verified (>=7.0), Established (>=4.5), New, or Blocked

License

MIT — Built by Michael Browne at Rise Above Partners.

Source: README.md at commit 677561f

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v2.5.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts