Mcp Skills

by BeBraveBeKind

458 downloads Not rated yet

GitHub Website

Other

About

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

Explore

- Pre-install trust scoring for MCP servers, AI skills, npm packages
- Safety scanning using 15 distinct signals
- Includes OSV/KEV/EPSS vulnerability intelligence
- Auto-gate go/no-go decision mechanism

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Mcp Skills

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

From the repository

—

`check_trust_score`

Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.

`scan_safety`

Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).

`list_packages`

Browse curated, pre-scored AI skill packages organized by use case. Each package contains vetted skills with trust scores. Available packages: Claude Power User, Full-Stack Vibe Coder, Data & Research, DevOps & Infrastructure, Content & Marketing.

`get_badge`

Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.

`watch_repo`

Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.

`check_watched`

Re-scan all watched repos and check for score changes. Returns any repos whose trust score changed significantly since last check.

`batch_check`

Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Developer Pro or Team API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).

`auto_gate`

Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.

`build_stack`

Recommend a vetted stack of trusted tools for a described task. Describe what you're building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.

- check_trust_score: Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.
- scan_safety: Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).
- list_packages: Browse curated, pre-scored AI skill packages organized by use case. Each package contains vetted skills with trust scores. Available packages: Claude Power User, Full-Stack Vibe Coder, Data & Research, DevOps & Infrastructure, Content & Marketing.
- get_badge: Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.
- watch_repo: Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.
- check_watched: Re-scan all watched repos and check for score changes. Returns any repos whose trust score changed significantly since last check.
- batch_check: Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Developer Pro or Team API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).
- auto_gate: Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.
- build_stack: Recommend a vetted stack of trusted tools for a described task. Describe what you're building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "mcp skills": {
            "mcpskills": {
                "command": "npx",
                "args": [
                    "-y",
                    "@mcpskillsio/server"
                ]
            }
        }
    }
}

McpServers

{
    "mcpskills": {
        "command": "npx",
        "args": [
            "-y",
            "@mcpskillsio/server"
        ]
    }
}

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Explore

Setting up with Highlight

From the repository

check_trust_score

scan_safety

list_packages

get_badge

watch_repo

check_watched

batch_check

auto_gate

build_stack

Claude Desktop / Cursor

McpServers

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

`check_trust_score`

`scan_safety`

`list_packages`

`get_badge`

`watch_repo`

`check_watched`

`batch_check`

`auto_gate`

`build_stack`