Log inSubmit server
Yotta Verify MCP logo

Yotta Verify MCP

Scans skills and MCP packages locally for security issues before installation, with reports, badges, and CI gating.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Yotta Verify MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "yotta-verify-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@yottameta/yotta-verify-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command started, but didn't respond the way we expected when we tried to talk to it.

npx -y @yottameta/yotta-verify-mcp

initialize succeeded but no response to tools/list.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 5d ago.

Overview

The yotta-verify-mcp MCP server provides an offline, deterministic pre-install scan for agent skills, plugins, and MCP packages. It runs as a local stdio server and examines directories, archives, or npm packages without executing their code. Four tools return findings and severity counts, create audit badges, enforce severity thresholds, and produce Markdown or JSON reports. Use it before installation or in CI when static trust checks are needed.

Use cases

  • Scan a skill directory before installation
  • Gate package installation in CI by severity
  • Generate an audit badge for a verified target
  • Export verification results as Markdown or JSON

Key features

  • Offline static scanning
  • Prompt-injection and malicious-pattern detection
  • SKILL.md integrity and permission checks
  • Severity-based CI gating
  • Markdown and JSON reports
  • Local SVG and shields.io badge generation

Tools4

What Yotta Verify MCP lets your agent do. Expand a tool for its parameters.

Self-reported~92 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

13/13 checks healthy over the last 62d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 13h ago via OSV.dev · @yottameta/yotta-verify-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads901Package downloads in the last 30 days.
Last commit2d agoMost recent push to the default branch.
Install checkInconclusiveStarted but did not complete the MCP handshake in our test.
Tools exposed4Callable tools this server registers over MCP.

How Yotta Verify MCP works

What yotta-verify-mcp MCP server does

The yotta-verify-mcp MCP server exposes the same scanning engine as the yotta-verify CLI through MCP. It is intended for checking an agent skill, plugin, or MCP server before installation. The scan looks for prompt-injection indicators, malicious patterns, SKILL.md integrity issues, and permissions-related findings, then returns a verdict with severity totals and individual findings.

The scanner is local and static. It reads files and produces results, but it does not execute the target, monitor it at runtime, repair detected issues, or make the final installation decision. Directory contents remain on the local machine. When the target is a public npm package, the package is downloaded to a temporary directory for scanning and then removed.

How it works

The server uses the standard stdio MCP transport, so an MCP client starts it as a local process and discovers its four tools. scan_skill accepts a directory, .tgz or .tar.gz archive, or npm package name. For an npm package name, the scanner uses npm pack to obtain a temporary local copy before analysis.

gate_check applies a maximum permitted severity. Its default threshold is medium; the result includes whether the check passed, the observed worst severity, the configured limit, and an exit code. This makes it suitable for a pre-install or CI decision point, while still leaving the final decision to the user or workflow owner.

Setup and configuration

The package can be installed with npx -y @yottameta/yotta-verify-mcp, which also starts the MCP server when no installer arguments are supplied. The repository also documents installation through git clone, a GitHub ZIP download, or install.sh. The installer can target an agent’s default skills directory with --agent, use an explicit location with --dir, or list known agent directories with --list.

Configuration in an MCP client is optional. An agent can present the proposed mcpServers entry and wait for explicit consent before changing a configuration file. If configuration is declined, the bundled CLI scanner can be used instead; the scan result is unchanged. The implementation requires Python 3.8 or newer and uses the standard library, with support stated for Windows, Linux, and macOS.

Tools and capabilities

The yotta-verify-mcp MCP server provides these tools:

  • scan_skill scans a local directory, archive, or npm package and returns a verdict, severity counts, and findings.
  • generate_badge creates a local SVG badge and a shields.io URL. It can derive a verdict from a target or accept one directly, and can combine validation, vetter, audit, version, and test information.
  • gate_check evaluates a target against info, low, medium, high, or critical as the maximum severity.
  • get_report writes or returns the verification result as Markdown or JSON. Markdown is the default, and an output path is optional.

Badge version information normally refers to the bundled yotta-verify scanning engine, not necessarily the MCP package version. A custom version can be supplied when needed.

Limitations and notes

The yotta-verify-mcp MCP server performs static analysis only. It does not provide sandboxing, dynamic analysis, runtime monitoring, remediation, or a definitive install recommendation. A clean or acceptable verdict should therefore be treated as evidence for review rather than a substitute for authorization and human judgment.

Directory scans are fully offline. Scanning an npm package requires retrieving the public package, but the target is not uploaded and its code is not run. Only evaluate targets you are authorized to inspect. The repository includes validation commands for the MCP engine and documentation consent behavior. It is released under the MIT license.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Yotta Verify MCP

yotta-verify-mcp is an MCP server that connects an MCP client to local skill directories, archives, and npm packages for pre-install security checks. Its main tools are scan_skill for findings, generate_badge for audit badges, gate_check for severity thresholds, and get_report for Markdown or JSON verification reports.

Install it with npx -y @yottameta/yotta-verify-mcp, or use the documented git clone, GitHub ZIP, or install.sh methods. Running the npx package without installer arguments starts the MCP server; --agent and --dir select an installation location.

Yes, the README names Cursor as an MCP client supported by the standard stdio server. Configure the server in Cursor, or have an agent show the proposed configuration and wait for explicit consent before writing it.

Yes, it accepts an npm package name and uses npm pack to place the public package in a temporary directory for scanning. It does not execute the package code or upload the scanned content, although retrieving an npm package requires network access.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewYotta Verify MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/yotta-verify-mcp?style=directory)](https://allmcps.com/mcp/yotta-verify-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/yotta-verify-mcp"><img src="https://allmcps.com/api/badge/yotta-verify-mcp?style=directory" alt="Yotta Verify MCP on AllMCPs" /></a>