SkillSync MCP

by adityasugandhi

347 downloads

Not rated

GitHub

About

The only MCP server that gates skill installation behind a full security scan. 60+ threat patterns, 13 MCP tools, and support for 7 clients including Claude Code, Cursor, Windsurf, and GitHub Copilot. Features AI-powered search, cloud sync, and startup verification with SHA-256 c

Details

Author: adityasugandhi
Downloads: 347
Categories: Developer Tools, Security

- Multi-level security scanning with 60+ threat patterns
- Cloud sync with configurable risk thresholds and conflict policies
- AI-powered semantic and keyword search across SkillsMP marketplace
- 13 MCP tools for search, security, management, and cloud sync
- Lock file support for managed vs manual skill tracking
- Startup verification via fs.watch and SHA-256 content hashing

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name SkillSync MCP

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

From the repository

Run npx -y @stranzwersweb2/skillsync-mcp to start the server. Configure it as an MCP server in your client’s settings file (e.g., ~/.claude/settings.json for Claude Code) using the same npx command.

`skillsmp_search`

Search SkillsMP marketplace for skills by keyword. Returns names, descriptions, authors, and GitHub links. WARNING: Results contain untrusted third-party content.

`skillsmp_ai_search`

AI-powered semantic search on SkillsMP. Uses Cloudflare AI for relevance matching. WARNING: Results contain untrusted third-party content.

`skillsmp_scan_skill`

Scan a skill's GitHub source for security threats: prompt injection, reverse shells, credential theft, supply chain attacks, crypto mining, and 60+ other patterns. Only accepts github.com URLs.

`skillsmp_search_safe`

Search SkillsMP and auto-scan top results for security threats. Combines keyword search with vulnerability scanning for each result.

`skillsmp_install_skill`

Security-scan a skill from GitHub, then install it. Blocks on critical threats. Use scope="project" to install to .claude/skills/ in cwd, or "global" (default) for ~/.claude/skills/.

`skillsmp_uninstall_skill`

Remove an installed skill by name. Use scope="project" for .claude/skills/ in cwd, or "global" (default) for ~/.claude/skills/.

`skillsmp_list_installed`

List all installed skills with security status. Use scope="all" for cross-scope view, "project" for .claude/skills/, or "global" (default) for ~/.claude/skills/.

`skillsmp_audit_installed`

Deep security audit of a specific installed skill. Use scope="project" for .claude/skills/, or "global" (default) for ~/.claude/skills/.

`skillsync_configure`

Manage sync subscriptions and settings. Use scope="project" for project-level config, or "global" (default).

`skillsync_sync_now`

Run a sync cycle: poll subscriptions, diff against installed skills, install/update/remove. Use scope="project" for project-level sync, or "global" (default).

`skillsync_status`

Show sync engine status: managed vs manual skills, subscriptions, last sync time, next scheduled sync. Use scope="all" for cross-scope view.

`skillsmp_suggest`

AI-powered skill recommendations based on what you already have installed. Use scope to specify which installed skills to base suggestions on.

`skillsmp_compare`

Side-by-side comparison of two skills including security scan results. Accepts GitHub URLs or installed skill names. Use scope to specify which installed skills to check.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "skillsync mcp": {
            "skillsmp": {
                "command": "npx",
                "args": [
                    "-y",
                    "@stranzwersweb2/skillsync-mcp"
                ]
            }
        }
    }
}

McpServers

{
    "skillsmp": {
        "command": "npx",
        "args": [
            "-y",
            "@stranzwersweb2/skillsync-mcp"
        ]
    }
}

SkillSync MCP

> The only MCP server that gates skill installation behind a full security scan. SkillSync MCP is a security-first skill management server for AI coding assistants. Before any skill is installed, it runs a comprehensive threat analysis across 60+ patterns covering 15 attack categories.

Key Features

Security Scanning

Every installation is gated by a multi-level security scan across 60+ threat patterns in 15 categories: prompt injection, Unicode homoglyphs, reverse shells, credential theft, supply chain attacks, crypto mining, RCE, obfuscation, and privilege escalation. Critical threats are permanently blocked with no override possible.

Cloud Sync

Subscribe to search queries and auto-sync skills across machines. Configurable risk thresholds, conflict policies, and dry-run previews. Lock file support for managed vs manual skill tracking.

AI-Powered Search

Keyword and semantic search across the SkillsMP marketplace powered by Cloudflare AI. Smart suggestions based on your installed skills. Side-by-side skill comparison with security diffs.

Skill Management

Install, uninstall, list, and audit skills. Startup verification with fs.watch and SHA-256 content hashing. TOCTOU protection. npm install --ignore-scripts for supply chain safety.

13 MCP Tools

| Tool | Category | Description | |---|---|---| | skillsmp_search | Search | Keyword search | | skillsmp_ai_search | Search | AI semantic search | | skillsmp_search_safe | Search | Search + auto-scan | | skillsmp_suggest | Search | AI suggestions | | skillsmp_scan_skill | Security | Security scan | | skillsmp_compare | Security | Side-by-side compare | | skillsmp_audit_installed | Security | Deep audit | | skillsmp_install_skill | Management | Install skill | | skillsmp_uninstall_skill | Management | Uninstall skill | | skillsmp_list_installed | Management | List installed skills | | skillsync_configure | Cloud Sync | Configure sync | | skillsync_sync_now | Cloud Sync | Run sync | | skillsync_status | Cloud Sync | Sync status |

Quick Start

bash
npx -y @stranzwersweb2/skillsync-mcp



Add to

~/.claude/settings.json

json
{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}



Supported Clients


- Claude Code -

~/.claude/settings.json


- OpenClaw -

~/.openclaw/mcp.json


- Cursor -

.cursor/mcp.json


- Windsurf -

~/.windsurf/mcp.json


- GitHub Copilot -

.github/copilot-mcp.json


- Zed -

~/.config/zed/settings.json


- nanobot - MCP config

Security Model


| Risk Level | Behavior |
|---|---|
| Safe / Low | Installs with warnings shown |
| Medium / High | Blocked - requires

force=true

 to override |
| Critical | Permanently blocked - no override possible |

Additional Safety Guards


- Path traversal prevention on skill names and filenames
- SSRF prevention - only

github.com

 URLs accepted
-

npm install --ignore-scripts` blocks postinstall attacks - Max 50 files, 512KB per file, 2MB total size limit - Output sanitization strips zero-width Unicode and bidi overrides - 15-minute scan cache with 100-entry LRU eviction - fs.watch startup verification with debounced re-scanning

Links

- npm package - GitHub Repository - SkillsMP Marketplace - Website Author: Aditya Sugandhi | License: MIT | Version: v1.3.0

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

skillsmp_search

skillsmp_ai_search

skillsmp_scan_skill

skillsmp_search_safe

skillsmp_install_skill

skillsmp_uninstall_skill

skillsmp_list_installed

skillsmp_audit_installed

skillsync_configure

skillsync_sync_now

skillsync_status

skillsmp_suggest

skillsmp_compare

Claude Desktop / Cursor

McpServers

SkillSync MCP

Key Features

Security Scanning

Cloud Sync

AI-Powered Search

Skill Management

13 MCP Tools

Quick Start

Supported Clients

Security Model

Additional Safety Guards

Links

Install

More like this

Sentry

Github

Git

GitLab

Context 7

Playwright

`skillsmp_search`

`skillsmp_ai_search`

`skillsmp_scan_skill`

`skillsmp_search_safe`

`skillsmp_install_skill`

`skillsmp_uninstall_skill`

`skillsmp_list_installed`

`skillsmp_audit_installed`

`skillsync_configure`

`skillsync_sync_now`

`skillsync_status`

`skillsmp_suggest`

`skillsmp_compare`