Log inSubmit server
Skillssafe MCP logo

Skillssafe MCP

by GUCCI-atlasv

Scans AI skill files, MCP configurations, and system prompts for security threats before installation.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Skillssafe MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "gucci-atlasv-skillssafe-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "skillssafe-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y skillssafe-mcp

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 23d ago.

Overview

GUCCI-atlasv/skillssafe-mcp MCP server connects MCP clients to SkillsSafe scanning for AI agent security threats. Its scan_skill tool accepts a URL or raw text and returns an installation decision, risk score, detected threats, and a scan ID; get_report retrieves the full report later. Use it before installing skills or reviewing MCP configurations and system prompts. It runs locally through npx or remotely over an SSE endpoint, with no API key or signup required.

Use cases

  • Scan a SKILL.md file before installation
  • Review an MCP configuration for malicious behavior
  • Check a system prompt for injection or hidden characters
  • Retrieve a previously generated security report

Key features

  • Scans URLs or raw skill content
  • Returns INSTALL, REVIEW, or BLOCK decisions
  • Assigns a 0–100 risk score
  • Detects credential theft and prompt injection
  • Finds zero-width, shell injection, and ClawHavoc indicators
  • Supports English, Chinese, and Japanese responses

Tools2

What Skillssafe MCP lets your agent do. Expand a tool for its parameters.

Self-reported~33 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

7/7 checks healthy over the last 90d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 7d ago via OSV.dev · skillssafe-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads189Package downloads in the last 30 days.
Last commit8mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed2Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Skillssafe MCP works

What GUCCI-atlasv/skillssafe-mcp does

GUCCI-atlasv/skillssafe-mcp MCP server exposes SkillsSafe security scanning to AI agent clients. It is designed for reviewing SKILL.md files, MCP configurations, and system prompts before they are used or installed. The scanner looks for credential theft, data exfiltration, prompt injection, hidden zero-width characters, ClawHavoc malware indicators, shell injection, reverse shells, excessive scope, and memory poisoning.

The primary workflow starts with scan_skill. You can provide either a URL, such as a GitHub raw or ClawHub URL, or the skill text directly. The result includes an INSTALL, REVIEW, or BLOCK decision, a risk score from 0 to 100, and detected threats with severity information. Each scan also returns a scan ID for later retrieval.

How it works

A client calls scan_skill with the material to assess. The lang parameter controls the response language and accepts en, zh, or ja; English is the default. The server passes the supplied URL or content to SkillsSafe and returns the structured scan result.

Use get_report with the scan ID from a completed scan when the client needs the previously generated report. This separates the initial scan decision from access to the full report and avoids resubmitting the same material.

GUCCI-atlasv/skillssafe-mcp MCP server can be started as a local stdio process with npx -y skillssafe-mcp. For clients that support Server-Sent Events, the documented remote endpoint is https://mcp.skillssafe.com/sse.

Setup and configuration

Claude Desktop can register the server in its MCP configuration by invoking npx with the package name and the -y argument. Cursor uses the same command and arguments in .cursor/mcp.json. These configurations run the package through Node's package runner rather than requiring a separate local installation step.

The server does not require an API key, account, or signup according to the project documentation. No environment variables are listed as required. Remote use is available through the documented SSE URL for compatible clients.

The project is listed in the official MCP Registry as com.skillssafe/scanner. It is also referenced in Smithery and Glama, but those listings are directory or registry references rather than additional configuration methods described here.

Tools and capabilities

  • scan_skill: examines a skill URL or raw skill content and returns a decision, numeric risk score, threat details, and scan ID.
  • get_report: retrieves a report using a scan ID returned by scan_skill.
  • Threat coverage includes credential theft, exfiltration, prompt injection, zero-width attacks, ClawHavoc indicators, shell and reverse-shell behavior, scope creep, and memory poisoning.
  • Response language selection is available for English, Chinese, and Japanese.

Limitations and notes

A scan can return REVIEW, so users still need to assess findings that are not an automatic block.

It also does not list configurable environment variables, authentication settings, rate limits, or retention behavior for reports. The remote endpoint should therefore be used only by clients that support the documented SSE transport.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Skillssafe MCP

GUCCI-atlasv/skillssafe-mcp is an MCP server that connects MCP clients to SkillsSafe for scanning SKILL.md files, MCP configurations, and system prompts. Its main tools are scan_skill, which returns security findings and a decision, and get_report, which retrieves a completed scan report by ID.

Install it by configuring your MCP client to run `npx -y skillssafe-mcp`. Claude Desktop and Cursor examples use this command. Clients that support SSE can instead connect to `https://mcp.skillssafe.com/sse`.

No, it does not require an API key, signup, or account according to the project documentation. Local clients can launch it with npx, while compatible SSE clients can use the documented remote endpoint.

It can scan SKILL.md files, MCP configurations, and system prompts supplied as a URL or raw text. Reported checks include credential theft, data exfiltration, prompt injection, zero-width characters, ClawHavoc indicators, shell injection, reverse shells, scope creep, and memory poisoning.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewSkillssafe MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/gucci-atlasv-skillssafe-mcp?style=directory)](https://allmcps.com/mcp/gucci-atlasv-skillssafe-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/gucci-atlasv-skillssafe-mcp"><img src="https://allmcps.com/api/badge/gucci-atlasv-skillssafe-mcp?style=directory" alt="Skillssafe MCP on AllMCPs" /></a>