# duriantaco/skylos [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/duriantaco/skylos  
**GitHub Stars:** 700  
**Views:** 6  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/duriantaco-skylos

## Description
Dead code detection, security scanning, and code quality analysis for Python, TypeScript, and Go. 98% recall with fewer false positives than Vulture. Includes AI-powered remediation.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "skylos": {
    "command": "uvx",
    "args": ["skylos"]
  }
}
```

## Documentation

## What duriantaco/skylos MCP server does

The duriantaco/skylos MCP server packages a code-analysis workflow built around Skylos, an open-source static analysis tool. Its documented capabilities cover dead code, unused files, security issues, dangerous data flows, exposed secrets, dependency CVEs, deployment configuration, and code-quality regressions. It also checks several classes of AI-generated code mistakes, including invented package APIs, missing guards, fake helpers, unfinished code, and impossible dependency versions.

Skylos is intended for local repository checks and can also act as a CI/CD pull-request gate. The README lists support for Python, TypeScript, JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment configuration. The default scan concentrates on dead-code detection; broader analysis is enabled with the `-a` option.

## How it works

The tool analyzes source and configuration statically rather than executing the target code for its normal checks. A repository can be scanned with `skylos .`, while `skylos . -a` enables security, secret, dependency, quality, and AI-defect analysis. Findings can be rendered as readable terminal output, concise machine-oriented lines, JSON for verification workflows, or an interactive terminal interface.

Changed work can be narrowed with a diff, file, or line range. The `verify` command returns `pass`, `fail`, or `incomplete`; incomplete results indicate that the requested proof could not be established. Verification can use a repository-specific `.skylos/ai-contract.yml` file to check generated code against local symbols, dependencies, APIs, route guards, and test requirements.

## Setup and configuration

Install the duriantaco/skylos MCP server's underlying CLI from PyPI:

```bash
pip install skylos
skylos .
```

Use `skylos init` to create project configuration containing thresholds, ignore settings, template hooks, and dictionary extensions. `skylos rules init` creates a starter local rule pack, and `skylos rules validate` checks a rule file. The project can also generate a GitHub Actions workflow with `skylos cicd init`.

Optional Python linting is available through the `skylos[lint]` extra and delegates to Ruff while preserving its native configuration, output, fixes, and exit behavior. The README does not identify required API keys, hosted services, or environment variables.

## Tools and capabilities

Documented command areas include:

- Dead-code detection for unused functions, classes, imports, files, and framework entry-point mistakes.
- Security, secret, dependency, deployment, quality, and AI-defect analysis.
- Deterministic cleanup previews for selected imports and functions, with an optional apply mode.
- AI-code verification, hallucination contracts, and tests against deterministic agent response and tool-use scenarios.
- Runtime-assisted scanning with `--trace` to reduce false positives from dynamic code.
- Custom YAML rules, formatted reports, threshold-based gates, and scanner comparison using SARIF.
- Kubernetes exposure checks and GPU release compatibility checks when their documented contracts are present.

## Limitations and notes

Coverage differs by language and check type. Local API verification currently covers Python, TypeScript/JavaScript, Go, and Java without executing target code. PHP, Rust, Dart, C#, Kotlin, and Shell retain static-analysis coverage, but their local API proof is reported as unsupported and can produce an `incomplete` verification result.

The README states that third-party TypeScript or JavaScript imports, computed namespace members, unsupported language-local API checks, and unprovable parser surfaces may also lead to incomplete verification. The supplied material does not document the MCP transport, exposed MCP tool schema, or compatibility with specific MCP clients, so those details should be confirmed before integration.

_Full upstream README: https://allmcps.com/mcp/duriantaco-skylos/readme_