MCP.so
登录

Skillaudit

@megamind-0x

代码仓库主页

关于 Skillaudit

🛡️ Security scanner for AI agent skills — detect credential stealers, exfiltration, and malicious patterns before install

#security#scanning#ai-agents#mcp#vulnerability-detection

基本信息

分类

开发工具

运行时

node

传输方式

stdio

发布者

megamind-0x

提交者

megamind-0x

配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "skillaudit": {
      "command": "npx",
      "args": [
        "skillaudit"
      ]
    }
  }
}

工具

未检测到工具

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Skillaudit?

Skillaudit is a security layer for AI agent skills that scans, gates, and enforces policy before an agent installs anything. It covers MCP and A2A protocols with 43 detection rules and 401 patterns, and has zero dependencies.

How to use Skillaudit?

Use the CLI via npx skillaudit (requires Node.js 18+) or call the HTTP API. For a quick gate check, run npx skillaudit gate <url> or curl to the /gate endpoint. Full scans, bulk checks, policy evaluation, and MCP server mode are also supported.

Key features of Skillaudit

  • 43 detection rules across 16 security categories.
  • Pre-install gate check returning allow/deny decisions.
  • Bulk evaluation of multiple skills in one call.
  • Custom policy enforcement with risk thresholds.
  • MCP server mode for native tool integration.
  • Zero-dependency CLI, runs via npx.

Use cases of Skillaudit

  • Preventing credential theft from AI agent skills.
  • Scanning MCP manifests for schema poisoning.
  • Enforcing security policies in CI/CD pipelines.
  • Auditing npm/PyPI packages for malicious code.
  • Gate-checking skills before installation in agent workflows.

FAQ from Skillaudit

What runtime does Skillaudit require?

The CLI requires Node.js 18+; the hosted API needs no local runtime.

What is the rate limit for the API?

30 requests per minute per IP; you can bypass it with an API key.

How does Skillaudit avoid false positives?

Smart context suppression automatically filters out documentation examples and placeholder tokens.

Can I self-host Skillaudit?

Yes, clone the repository, run npm install && npm start, and it listens on http://localhost:3847.

What transports does Skillaudit support?

It supports CLI (stdio), HTTP API, and MCP protocol (stdio) via --mcp flag.

评论

开发工具 分类下的更多 MCP 服务器

Huoshan Test

volcengine

2.4K

test

cloudwego

The ultimate LLM/AI application development framework in Go.

12.2K

mcp-excalidraw

yctimlin

MCP server and Claude Code skill for Excalidraw — programmatic canvas toolkit to create, edit, and export diagrams via AI agents with real-time canvas sync.

2.1K

Golf

golf-mcp

Production-Ready MCP Server Framework • Build, deploy & scale secure AI agent infrastructure • Includes Auth, Observability, Debugger, Telemetry & Runtime • Run real-world MCPs powering AI Agents

834

test

harlanc

A simple,high performance and secure live media server in pure Rust (RTMP[cluster]/RTSP/WebRTC[whip/whep]/HTTP-FLV/HLS).🦀

2.3K