Mcpskills Server

What BeBraveBeKind/mcpskills-server MCP server does

BeBraveBeKind/mcpskills-server MCP server adds pre-install checks for MCP servers, AI skills, GitHub repositories, npm packages, and supported registry URLs. It returns a trust assessment built around four dimensions: Alive, Legit, Solid, and Usable. The service assigns tiers including Verified, Established, New, and Blocked based on the resulting score.

The server also separates general trust scoring from focused safety analysis. Safety checks look for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public binding on 0.0.0.0, and risky npm lifecycle scripts. AI skills and MCP servers can receive the additional Skills Mode analysis described in the project documentation.

How it works

BeBraveBeKind/mcpskills-server MCP server sends requests to the mcpskills.io trust-scoring API. The API gathers repository information from GitHub and OpenSSF Scorecard, evaluates 13 standard signals, and adds two more signals in Skills Mode for a total of 15. Safety analysis includes checks based on the ClawHavoc and ToxicSkills attack patterns.

Inputs can be supplied as owner/repo, a GitHub URL, an npm package such as npm:@scope/name or @scope/name, a Smithery URL, or an OpenClaw URL, depending on the tool. The auto_gate operation converts the assessment into a proceed boolean and a reason, which is useful for an agent deciding whether to continue with installation.

Setup and configuration

Install the package as a local stdio MCP server with the @mcpskillsio/server npm package. The README provides configurations for Claude Code, Cursor, and Claude Desktop. Cursor and Claude Desktop configurations run the package through npx.

Set MCPSKILLS_API_KEY when full reports and safety findings are needed inside the client. The free tier returns a trust tier and dimension scores and is limited to 10 scans per day according to the README. The documented paid plans are Developer Pro at $19 per month or $149 per year, and Team at $99 per month.

Tools and capabilities

BeBraveBeKind/mcpskills-server MCP server exposes these operations:

• check_trust_score scores a repository, package, or supported registry URL.
• scan_safety runs focused security checks on an AI skill or MCP server.
• list_packages displays curated, pre-scored packages for use cases such as full-stack development, research, DevOps, and content work.
• get_badge returns an SVG trust-badge URL for a repository or package.
• watch_repo starts score monitoring and requires a paid API key.
• check_watched re-scans monitored items and reports significant score or tier changes.
• batch_check evaluates up to five inputs and requires a Developer Pro or Team API key.
• auto_gate returns a go/no-go installation decision with reasoning.
• build_stack recommends a pre-scored tool set for a described development task.

Limitations and notes

The server depends on the mcpskills.io API rather than performing all scoring locally. Full reports, safety findings, monitoring, and batch checks have credential or plan requirements. The free tier has a stated daily limit of 10 scans. The repository is licensed under MIT.