skillssafe-mcp
MCP server for SkillsSafe — the security layer for AI agents.
Scan SKILL.md files, MCP configs, and system prompts for:
- 🔐 Credential theft & data exfiltration
- 💉 Prompt injection attacks
- 👻 Zero-width character attacks
- 🦠 ClawHavoc malware indicators
- 🐚 Shell injection & reverse shells
- 🔍 Scope creep & memory poisoning
Free. No API key. No signup.
Quick Start
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"skillssafe": {
"command": "npx",
"args": ["-y", "skillssafe-mcp"]
}
}
}Cursor
Add to .cursor/mcp.json:
{
"mcpServers": {
"skillssafe": {
"command": "npx",
"args": ["-y", "skillssafe-mcp"]
}
}
}Direct SSE (Remote)
For clients that support SSE transport:
https://mcp.skillssafe.com/sseTools
scan_skill
Scan an AI agent skill file for security threats before installation.
Parameters:
url - URL of skill to scan (GitHub raw URL, ClawHub URL, etc.)
content - Raw text content of skill to scan (alternative to url)
lang - Response language: "en" | "zh" | "ja" (default: "en")
Returns:
decision - INSTALL / REVIEW / BLOCK
risk_score - 0–100
threats - List of detected threats with severity
scan_id - ID for retrieving full report
