# BeBraveBeKind/mcpskills-server [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/BeBraveBeKind/mcpskills-server  
**GitHub Stars:** 1  
**npm Downloads (last month):** 540  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/bebravebekind-mcpskills-server

## Description
Pre-install trust layer for MCP servers, AI skills, and npm packages. Scores any repo or package across 15 signals (incl. OSV/KEV/EPSS vulnerability intelligence) with safety scanning for prompt injection, credential theft, and supply-chain risk; the autogate tool returns a go/no-go install decision. Listed in the official MCP Registry as io.mcpskills/server. npm: @mcpskillsio/server. https://mcpskills.io

## Tools
Capabilities this server exposes over MCP:

- **check_trust_score** — Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.
- **scan_safety** — Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).
- **list_packages** — Browse curated, pre-scored AI skill packages organized by use case. Each package contains vetted skills with trust scores. Available packages: Claude Power User, Full-Stack Vibe Coder, Data & Research, DevOps & Infrastructure, Content & Marketing.
- **get_badge** — Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.
- **watch_repo** — Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.
- **check_watched** — Re-scan all watched repos and check for score changes. Returns any repos whose trust score changed significantly since last check.
- **batch_check** — Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Developer Pro or Team API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).
- **auto_gate** — Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.
- **build_stack** — Recommend a vetted stack of trusted tools for a described task. Describe what you're building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcpskills-server": {
    "command": "npx",
    "args": ["-y","@mcpskillsio/server"],
    "env": {
      "MCPSKILLS_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `MCPSKILLS_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What BeBraveBeKind/mcpskills-server MCP server does

BeBraveBeKind/mcpskills-server MCP server adds pre-install checks for MCP servers, AI skills, GitHub repositories, npm packages, and supported registry URLs. It returns a trust assessment built around four dimensions: Alive, Legit, Solid, and Usable. The service assigns tiers including Verified, Established, New, and Blocked based on the resulting score.

The server also separates general trust scoring from focused safety analysis. Safety checks look for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public binding on `0.0.0.0`, and risky npm lifecycle scripts. AI skills and MCP servers can receive the additional Skills Mode analysis described in the project documentation.

## How it works

BeBraveBeKind/mcpskills-server MCP server sends requests to the mcpskills.io trust-scoring API. The API gathers repository information from GitHub and OpenSSF Scorecard, evaluates 13 standard signals, and adds two more signals in Skills Mode for a total of 15. Safety analysis includes checks based on the ClawHavoc and ToxicSkills attack patterns.

Inputs can be supplied as `owner/repo`, a GitHub URL, an npm package such as `npm:@scope/name` or `@scope/name`, a Smithery URL, or an OpenClaw URL, depending on the tool. The `auto_gate` operation converts the assessment into a `proceed` boolean and a reason, which is useful for an agent deciding whether to continue with installation.

## Setup and configuration

Install the package as a local stdio MCP server with the `@mcpskillsio/server` npm package. The README provides configurations for Claude Code, Cursor, and Claude Desktop. Cursor and Claude Desktop configurations run the package through `npx`.

Set `MCPSKILLS_API_KEY` when full reports and safety findings are needed inside the client. The free tier returns a trust tier and dimension scores and is limited to 10 scans per day according to the README. The documented paid plans are Developer Pro at $19 per month or $149 per year, and Team at $99 per month.

## Tools and capabilities

BeBraveBeKind/mcpskills-server MCP server exposes these operations:

- `check_trust_score` scores a repository, package, or supported registry URL.
- `scan_safety` runs focused security checks on an AI skill or MCP server.
- `list_packages` displays curated, pre-scored packages for use cases such as full-stack development, research, DevOps, and content work.
- `get_badge` returns an SVG trust-badge URL for a repository or package.
- `watch_repo` starts score monitoring and requires a paid API key.
- `check_watched` re-scans monitored items and reports significant score or tier changes.
- `batch_check` evaluates up to five inputs and requires a Developer Pro or Team API key.
- `auto_gate` returns a go/no-go installation decision with reasoning.
- `build_stack` recommends a pre-scored tool set for a described development task.

## Limitations and notes

The server depends on the mcpskills.io API rather than performing all scoring locally. Full reports, safety findings, monitoring, and batch checks have credential or plan requirements. The free tier has a stated daily limit of 10 scans. The repository is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/bebravebekind-mcpskills-server/readme_