MCP Skills — the pre-install trust layer for MCP servers and AI skills

@mcpskillsio/server

Use the MCPSkills pre-install trust layer from inside Claude Code, Cursor, or any MCP client.

13 standard signals (15 in Skills Mode) across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks. Check install risk before an MCP server or AI skill reaches your agent.

Install

Claude Code

Terminal

claude mcp add mcpskills -- npx @mcpskillsio/server

Cursor

Add to your .cursor/mcp.json:

config.json

{
  "mcpServers": {
    "mcpskills": {
      "command": "npx",
      "args": ["@mcpskillsio/server"]
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json:

config.json

{
  "mcpServers": {
    "mcpskills": {
      "command": "npx",
      "args": ["@mcpskillsio/server"]
    }
  }
}

Tools

`check_trust_score`

Score any GitHub repo, npm package, or registry URL. Returns trust tier, composite score, and 4 dimension scores.

Code

"Score anthropics/anthropic-sdk-typescript"

`scan_safety`

Focused safety scan for AI skills. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads.

Code

"Is this MCP server safe? modelcontextprotocol/servers"

`list_packages`

Browse curated, pre-scored skill packages organized by use case.

Code

"Show me safe AI skill packages for full-stack development"

`get_badge`

Generate an SVG trust badge URL for your README.

Code

"Get a trust badge for my repo anthropics/anthropic-sdk-typescript"

`watch_repo`

Start monitoring a repo for trust score changes (requires API key).

Code

"Watch modelcontextprotocol/servers for score changes"

`check_watched`

Re-scan all watched repos for score or tier changes (requires API key).

Code

"Check my watched repos"

`batch_check`

Score up to 5 repos in a single call (Developer Pro or Team).

Code

"Batch check these repos: anthropics/anthropic-sdk-typescript, langchain-ai/langchainjs"

`auto_gate`

Get a boolean go/no-go decision with reasoning.

Code

"Should I install this MCP server? 21st-dev/magic-mcp"

`build_stack`

Recommend a vetted, pre-scored stack from MCP Skills' curated packages.

Code

"Build me a stack: auth + payments + email"

Full Reports

Free tier returns trust tier + dimension scores (same as mcpskills.io free scans, 10/day).

For full reports (13 standard / 15 Skills Mode signals + safety findings) inside your IDE, set your API key:

server.ts

export MCPSKILLS_API_KEY=your_key_here

Get your API key at mcpskills.io/api. Developer Pro is $19/mo or $149/yr. Team is $99/mo for org/security workflows.

How It Works

The server calls the mcpskills.io trust scoring API, which:

Fetches repo data from GitHub API and OpenSSF Scorecard
Scores 13 standard signals across 4 dimensions (Alive, Legit, Solid, Usable)
Detects AI skills/MCP servers and activates Skills Mode (+2 bonus signals — 15 total)
Runs 5 safety scans based on ClawHavoc and ToxicSkills attack patterns
Assigns a trust tier: Verified (>=7.0), Established (>=4.5), New, or Blocked

License

MIT — Built by Michael Browne at Rise Above Partners.