Claude MarketplacesSubmit
eltociear avatar

Skill Audit Mcp

eltociear/skill-audit-mcp

A static security scanner that checks MCP servers, agent skills, and plugins for 68 attack patterns across four severity levels. Runs as a CLI via npx, GitHub Action with SARIF output for Code Scanning, Docker container, or MCP server you can ask Claude to invoke directly. Detects critical issues like download-and-execute chains, credential exfiltration, and seed phrase harvesting, plus high-severity patterns including arbitrary code execution and auth bypass. Ships with risk scoring from 0-100 and can fail CI builds on configurable thresholds. Also available as a hosted x402 API that charges $0.01 per scan. Pair it with the sister project secrets-audit-mcp to cover both behavioral patterns and leaked credentials.

GitHub stars
5
tools
11
transport
STDIO, HTTP
last updated
Sep 30, 2026
View on GitHub

Install

From registry metadata
$ npx add-mcp https://eltociear-skill-audit.hf.space/mcp --name skill-audit-mcp

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 11 tools

Verified live against the running server on Nov 6, 2026.

paid_catalogueList the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, live DEX prices, wallet intel, supply-chain scans). Payment is x402 over USDC on...

List the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, live DEX prices, wallet intel, supply-chain scans). Payment is x402 over USDC on...

No parameters. Call it with no arguments.

air_qualityCurrent air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and p...1 params

Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and p...

Parameters* required
location*string
Place name, e.g. 'Tokyo'
geocodeResolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)2 params

Resolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
countinteger
1-20 candidates (default 5)
name*string
Place name to resolve
earthquakesRecent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)5 params

Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
daysinteger
1-30 days back (default 1)
limitinteger
1-100 events (default 20)
locationstring
Centre on a place name
min_magnitudenumber
Lower bound (default 4.5)
radius_kmnumber
Radius around location (default 500)
public_holidaysPublic holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)2 params

Public holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
country*string
ISO 2-letter country code, e.g. JP
yearinteger
Calendar year (defaults to current)
country_indicatorWorld Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)3 params

World Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
country*string
ISO 2- or 3-letter country code
indicatorstring
Alias above, or a World Bank code
yearsinteger
1-60 most recent years (default 5)
elevationGround elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)1 params

Ground elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
location*string
Place name
web_searchSearch the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)2 params

Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
max_resultsinteger
1-25 (default 10)
query*string
Search query
read_urlFetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)1 params

Fetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Parameters* required
url*string
Page to fetch
audit_skill_textScan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting...1 params

Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting...

Parameters* required
content*string
File or snippet to scan
audit_skill_urlFetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.1 params

Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

Parameters* required
url*string
Raw file URL to fetch and scan

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Readme

skill-audit-mcp

smithery badge MCP Registry

Static security scanner for MCP servers, AI agent skills, and plugins. 17 attack patterns (65 regex signatures) across 4 severity levels. SARIF output → GitHub Code Scanning. Ships as a CLI, GitHub Action, multi-arch Docker image, MCP server, and hosted x402 API.

View the full README on GitHub

Details

Repository
github.com/eltociear/skill-audit-mcp
Categories
AI & LLM Tools, Security & Pentesting
Package
ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0
Transport
STDIO, HTTP
Registry
MCP registry, active
Tools verified
Nov 6, 2026

More from eltociear

Related AI & LLM Tools MCP servers

View all
1bamchi avatarScrapibamchi/scrapi-mcp-serverWeb scraping for AI agents. Converts URLs to clean, LLM-ready Markdown with anti-bot bypass.5stars
2eidetic-works avatarNucleuseidetic-works/nucleus-mcpPersistent memory for AI agents — shared .brain across Claude Code, Cursor & Codex5stars
3kokogo100 avatarRagalgokokogo100/ragalgo-mcp-serverDynamic RAG Engine preventing AI hallucinations in Korean Finance and Crypto markets.5stars
4lumabyteco avatarClarifypromptlumabyteco/clarifyprompt-mcpAI prompt optimization for 58+ platforms across 7 categories with custom platforms5stars
5mcp-s-ai avatarImage Recognition Mcpmcp-s-ai/image-recognition-mcpMCP server for AI-powered image recognition and description using OpenAI vision models.5stars
6mcp-s-ai avatarImage Recongnition Mcpmcp-s-ai/image-recongnition-mcpMCP server for AI-powered image recognition and description using OpenAI vision models.5stars