# @illicomedia/skills-mcp-server [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/illicomedia/skills-mcp-server  
**GitHub Stars:** 1  
**npm Downloads (last month):** 4656  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/illicomedia-skills-mcp-server

## Description
MCP server that gives AI coding agents QA skills and a local code audit: security, accessibility, performance, GDPR, DevOps and more.

## Tools
Capabilities this server exposes over MCP:

- **list_skills** — List all Fredo QA Skills available under the current license tier (Free, Pro, Enterprise), with rule summaries and categories.
- **get_skill_rules** — Return the SKILL.md of a Fredo QA skill installed in the working directory (skills/<id>/ or .agents/skills/<id>/). This server ships no skill files: if the skill is not installed, the call fails with installation instructions; do not invent rules for it.
- **install_skill** — Install a Fredo QA skill into .agents/skills/<skill_id>/ with SKILL.md and LICENSE, copying SKILL.md from a skill source already present in the project (skills/<id>/ or .agents/skills/<id>/); fails if none exists. Requires user agreement: set confirm: true to write files to disk; when false (default), returns a safe preview without modifying the filesystem.
- **sync_workspace_skills** — Auto-detects project stack and provisions matching QA skills and licenses into .agents/skills/. Requires user agreement: set confirm: true to write files; when false (default), returns a dry-run preview.
- **prune_skills** — Safely prunes unneeded QA skills from .agents/skills/ by archiving them to .agents/.archive/ based on detected project tech stacks. Non-destructive: files are moved rather than permanently deleted, keeping them fully recoverable while removing noise from the AI agent context. Requires user agreement: set confirm: true to archive skills; when false (default), returns a safe preview listing candidate skills without moving files.
- **set_license_key** — Set the signed Fredo QA Skills license file for the active session to unlock Pro or Enterprise skills.
- **verify_license** — Inspect the current Fredo QA license: signature validity, tier, licensee, last covered release date (updates_until), and fallback status.
- **quick_check** — Sub-second preflight check for AI agents to discover repository stack, governance policies, and baseline scaffolding before modifying code. Returns detected stack, summary.ok (passing checks), summary.attention (failing checks), full results, and remediation recommendations. Verifies AGENTS.md, licensing, secret hygiene (.gitignore), dependency lockfile, and test runner declaration. Requires user agreement: set confirm: true to traverse project files; when false (default), returns a preview without scanning.
- **get_version** — Retrieve the active package version, protocol specification, and runtime metadata of the Fredo QA MCP Server.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "skills-mcp-server": {
    "command": "npx",
    "args": ["-y","@illicomedia/skills-mcp-server"]
  }
}
```

## Documentation

## What @illicomedia/skills-mcp-server does

@illicomedia/skills-mcp-server exposes Fredo QA Skills through the Model Context Protocol. It combines a catalog of QA rules with a local preflight sensor that reviews project structure and selected files for engineering concerns such as governance, security, quality gates, supply chain, and DevOps. The audit covers nine language stacks and is designed for intake checks rather than arbitrary code execution.

The package also manages skills in a project workspace. Skills can be read when already installed, added individually, synchronized from detected project technologies, or archived when they are no longer needed. Open-source MIT skills are available without a license lock; paid tiers use signed license verification.

## How it works

The server implements MCP revision 2024-11-05 over JSON-RPC 2.0 using stdio, so an MCP host launches it as a local process and exchanges tool calls through standard input and output. It has no runtime package dependencies and uses Node.js built-in modules. The package works offline for its server behavior and license checks.

Read-only operations include listing available skills, returning an installed skill’s `SKILL.md`, checking the active Ed25519 license, reading protocol and engine metadata, and setting a signed license for the current session. Skill files are loaded from project locations such as `skills/<id>/SKILL.md`, tiered skill directories, or `.agents/skills/<id>/SKILL.md`.

Operations that inspect or change a workspace require explicit approval. Without `confirm: true`, `quick_check`, `install_skill`, and `sync_workspace_skills` return a preview rather than traversing or writing files. Confirmed operations remain bounded to the workspace and reject path traversal, system roots, credential directories, and symlinks that escape the project.

## Setup and configuration

Configure an MCP client to launch the package as a stdio server. The repository identifies Claude Desktop, Cursor, Windsurf, and VS Code as compatible coding assistants. Skill content is not bundled with the package: obtain the desired skill from `https://www.illicomedia.com/qa-skills/skills/<id>` and extract it into one of the supported project skill paths before requesting its rules.

License state can be inspected with `verify_license` or supplied for the active session with `set_license_key`. Installation and workspace synchronization also accept a license key as a tool argument. The server keeps that session configuration in memory.

## Tools and capabilities

- `list_skills` shows accessible skills, tiers, tags, and summaries, with optional category filtering.
- `get_skill_rules` returns the complete rules for an installed skill and reports an explicit failure when the file is absent.
- `quick_check` previews or performs a project preflight audit across five domains and nine language stacks.
- `install_skill` previews or places a selected skill’s `SKILL.md` and `LICENSE` under `.agents/skills/`.
- `sync_workspace_skills` detects project technology and installs matching skills after confirmation.
- `prune_skills` moves unneeded skills to `.agents/.archive/` instead of deleting them.
- `verify_license`, `get_version`, and `set_license_key` handle license, protocol, capability, and session configuration checks.

## Limitations and notes

Skill rule files must be installed separately; the npm package contains catalog metadata, license checks, and the audit engine, not the `SKILL.md` files themselves. Filesystem traversal and all workspace writes are confirmation-gated. `prune_skills` is non-destructive because archived files remain recoverable, but it still changes the project directory and requires confirmation. License verification uses Ed25519 signatures, and skill rules may contain provenance watermark headers.

_Full upstream README: https://allmcps.com/mcp/illicomedia-skills-mcp-server/readme_