Skylos

What duriantaco/skylos MCP server does

The duriantaco/skylos MCP server packages a code-analysis workflow built around Skylos, an open-source static analysis tool. Its documented capabilities cover dead code, unused files, security issues, dangerous data flows, exposed secrets, dependency CVEs, deployment configuration, and code-quality regressions. It also checks several classes of AI-generated code mistakes, including invented package APIs, missing guards, fake helpers, unfinished code, and impossible dependency versions.

Skylos is intended for local repository checks and can also act as a CI/CD pull-request gate. The README lists support for Python, TypeScript, JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment configuration. The default scan concentrates on dead-code detection; broader analysis is enabled with the -a option.

How it works

The tool analyzes source and configuration statically rather than executing the target code for its normal checks. A repository can be scanned with skylos ., while skylos . -a enables security, secret, dependency, quality, and AI-defect analysis. Findings can be rendered as readable terminal output, concise machine-oriented lines, JSON for verification workflows, or an interactive terminal interface.

Changed work can be narrowed with a diff, file, or line range. The verify command returns pass, fail, or incomplete; incomplete results indicate that the requested proof could not be established. Verification can use a repository-specific .skylos/ai-contract.yml file to check generated code against local symbols, dependencies, APIs, route guards, and test requirements.

Setup and configuration

Install the duriantaco/skylos MCP server's underlying CLI from PyPI:

pip install skylos
skylos .

Use skylos init to create project configuration containing thresholds, ignore settings, template hooks, and dictionary extensions. skylos rules init creates a starter local rule pack, and skylos rules validate checks a rule file. The project can also generate a GitHub Actions workflow with skylos cicd init.

Optional Python linting is available through the skylos[lint] extra and delegates to Ruff while preserving its native configuration, output, fixes, and exit behavior. The README does not identify required API keys, hosted services, or environment variables.

Tools and capabilities

Documented command areas include:

• Dead-code detection for unused functions, classes, imports, files, and framework entry-point mistakes.
• Security, secret, dependency, deployment, quality, and AI-defect analysis.
• Deterministic cleanup previews for selected imports and functions, with an optional apply mode.
• AI-code verification, hallucination contracts, and tests against deterministic agent response and tool-use scenarios.
• Runtime-assisted scanning with --trace to reduce false positives from dynamic code.
• Custom YAML rules, formatted reports, threshold-based gates, and scanner comparison using SARIF.
• Kubernetes exposure checks and GPU release compatibility checks when their documented contracts are present.

Limitations and notes

Coverage differs by language and check type. Local API verification currently covers Python, TypeScript/JavaScript, Go, and Java without executing target code. PHP, Rust, Dart, C#, Kotlin, and Shell retain static-analysis coverage, but their local API proof is reported as unsupported and can produce an incomplete verification result.

The README states that third-party TypeScript or JavaScript imports, computed namespace members, unsupported language-local API checks, and unprovable parser surfaces may also lead to incomplete verification. The supplied material does not document the MCP transport, exposed MCP tool schema, or compatibility with specific MCP clients, so those details should be confirmed before integration.