Log inSubmit server
Skills MCP Server logo

Skills MCP Server

by @illicomedia

Audits local projects, manages QA skills, and applies safety-gated security, accessibility, performance, GDPR, and DevOps checks.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Skills MCP Server

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "illicomedia-skills-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@illicomedia/skills-mcp-server"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 9 tools correctly (Today).

Overview

@illicomedia/skills-mcp-server connects MCP-compatible coding assistants to Fredo QA Skills and a local preflight audit engine over standard input/output. It provides read-only skill and license queries, a confirmed project scan, and confirmed skill installation, synchronization, and archiving. Reach for it when an agent needs repository QA guidance across supported language stacks without executing arbitrary project code. Filesystem inspection and changes use previews, explicit confirmation, and workspace containment checks.

Use cases

  • Audit a repository before development work
  • Browse QA skills for a project technology
  • Install skills matched to a workspace stack
  • Archive obsolete agent skills without deleting them
  • Verify a signed skill license offline

Key features

  • MCP stdio transport with JSON-RPC 2.0
  • Preflight audits across five QA domains and nine language stacks
  • Confirmation-gated filesystem inspection and writes
  • Ed25519 license verification
  • Workspace skill installation, synchronization, and archiving
  • Path, system-root, credential-store, and symlink containment

Tools9

What Skills MCP Server lets your agent do. Expand a tool for its parameters.

Verified live~1.4k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

What it can do

From the 9 tools this server returned when we ran it.

Writes files · 2Handles credentials · 1Read-only tools · 7
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age20 days
Maintainers1

Observed 2026-11-11 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9h ago via OSV.dev · @illicomedia/skills-mcp-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads4.7kPackage downloads in the last 30 days.
Last commit1d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed9Callable tools this server registers over MCP.

How Skills MCP Server works

What @illicomedia/skills-mcp-server does

@illicomedia/skills-mcp-server exposes Fredo QA Skills through the Model Context Protocol. It combines a catalog of QA rules with a local preflight sensor that reviews project structure and selected files for engineering concerns such as governance, security, quality gates, supply chain, and DevOps. The audit covers nine language stacks and is designed for intake checks rather than arbitrary code execution.

The package also manages skills in a project workspace. Skills can be read when already installed, added individually, synchronized from detected project technologies, or archived when they are no longer needed. Open-source MIT skills are available without a license lock; paid tiers use signed license verification.

How it works

The server implements MCP revision 2024-11-05 over JSON-RPC 2.0 using stdio, so an MCP host launches it as a local process and exchanges tool calls through standard input and output. It has no runtime package dependencies and uses Node.js built-in modules. The package works offline for its server behavior and license checks.

Read-only operations include listing available skills, returning an installed skill’s SKILL.md, checking the active Ed25519 license, reading protocol and engine metadata, and setting a signed license for the current session. Skill files are loaded from project locations such as skills/<id>/SKILL.md, tiered skill directories, or .agents/skills/<id>/SKILL.md.

Operations that inspect or change a workspace require explicit approval. Without confirm: true, quick_check, install_skill, and sync_workspace_skills return a preview rather than traversing or writing files. Confirmed operations remain bounded to the workspace and reject path traversal, system roots, credential directories, and symlinks that escape the project.

Setup and configuration

Configure an MCP client to launch the package as a stdio server. The repository identifies Claude Desktop, Cursor, Windsurf, and VS Code as compatible coding assistants. Skill content is not bundled with the package: obtain the desired skill from https://www.illicomedia.com/qa-skills/skills/<id> and extract it into one of the supported project skill paths before requesting its rules.

License state can be inspected with verify_license or supplied for the active session with set_license_key. Installation and workspace synchronization also accept a license key as a tool argument. The server keeps that session configuration in memory.

Tools and capabilities

  • list_skills shows accessible skills, tiers, tags, and summaries, with optional category filtering.
  • get_skill_rules returns the complete rules for an installed skill and reports an explicit failure when the file is absent.
  • quick_check previews or performs a project preflight audit across five domains and nine language stacks.
  • install_skill previews or places a selected skill’s SKILL.md and LICENSE under .agents/skills/.
  • sync_workspace_skills detects project technology and installs matching skills after confirmation.
  • prune_skills moves unneeded skills to .agents/.archive/ instead of deleting them.
  • verify_license, get_version, and set_license_key handle license, protocol, capability, and session configuration checks.

Limitations and notes

Skill rule files must be installed separately; the npm package contains catalog metadata, license checks, and the audit engine, not the SKILL.md files themselves. Filesystem traversal and all workspace writes are confirmation-gated. prune_skills is non-destructive because archived files remain recoverable, but it still changes the project directory and requires confirmation. License verification uses Ed25519 signatures, and skill rules may contain provenance watermark headers.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Skills MCP Server

@illicomedia/skills-mcp-server is an MCP server that connects AI coding assistants to Fredo QA Skills and a local project audit engine. Its main tools list and read QA skills, inspect licenses and runtime metadata, run confirmed preflight checks, install or synchronize skills, and archive unused skills safely.

Configure your MCP client to launch the npm package as a standard stdio server. The server uses MCP revision 2024-11-05 over JSON-RPC 2.0 and has no runtime package dependencies. Skill files are separate and must be downloaded and extracted into a supported project skill directory.

Yes, Cursor is named as a compatible coding assistant. It can connect to the server over stdio and use its skill catalog, license tools, preflight audit, and confirmation-gated workspace operations.

It requires `confirm: true` before `quick_check` traverses project files. Without confirmation, the tool returns a preview and performs no scan. Confirmed access is limited to the workspace and rejects traversal paths, system roots, credential stores, and escaping symlinks.

Use `install_skill` for a named skill or `sync_workspace_skills` to detect the project stack and select matching skills. Both require `confirm: true` to write files; otherwise they return a dry-run preview. Skill content must be obtained separately and is placed under the project’s `.agents/skills/` directory.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewSkills MCP Server AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/illicomedia-skills-mcp-server?style=directory)](https://allmcps.com/mcp/illicomedia-skills-mcp-server)
HTML Embed
<a href="https://allmcps.com/mcp/illicomedia-skills-mcp-server"><img src="https://allmcps.com/api/badge/illicomedia-skills-mcp-server?style=directory" alt="Skills MCP Server on AllMCPs" /></a>