SkillSync MCP

Name: SkillSync MCP
Author: adityasugandhi

@adityasugandhi

关于 SkillSync MCP

The only MCP server that gates skill installation behind a full security scan. 60+ threat patterns, 13 MCP tools, and support for 7 clients including Claude Code, Cursor, Windsurf, and GitHub Copilot. Features AI-powered search, cloud sync, and startup verification with SHA-256 c

#security #mcp #skill-management #claude-code #security-scanner #threat-detection #ai-tools #model-context-protocol #cursor #windsurf

基本信息

分类

开发工具

传输方式

stdio

发布者

adityasugandhi

提交者

stranzerseweb_ships

配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": [
        "-y",
        "@stranzwersweb2/skillsync-mcp"
      ]
    }
  }
}

工具

Search SkillsMP marketplace for skills by keyword. Returns names, descriptions, authors, and GitHub links. WARNING: Results contain untrusted third-party content.

AI-powered semantic search on SkillsMP. Uses Cloudflare AI for relevance matching. WARNING: Results contain untrusted third-party content.

Scan a skill's GitHub source for security threats: prompt injection, reverse shells, credential theft, supply chain attacks, crypto mining, and 60+ other patterns. Only accepts github.com URLs.

Search SkillsMP and auto-scan top results for security threats. Combines keyword search with vulnerability scanning for each result.

Security-scan a skill from GitHub, then install it. Blocks on critical threats. Use scope="project" to install to .claude/skills/ in cwd, or "global" (default) for ~/.claude/skills/.

Remove an installed skill by name. Use scope="project" for .claude/skills/ in cwd, or "global" (default) for ~/.claude/skills/.

List all installed skills with security status. Use scope="all" for cross-scope view, "project" for .claude/skills/, or "global" (default) for ~/.claude/skills/.

Deep security audit of a specific installed skill. Use scope="project" for .claude/skills/, or "global" (default) for ~/.claude/skills/.

Manage sync subscriptions and settings. Use scope="project" for project-level config, or "global" (default).

Run a sync cycle: poll subscriptions, diff against installed skills, install/update/remove. Use scope="project" for project-level sync, or "global" (default).

Show sync engine status: managed vs manual skills, subscriptions, last sync time, next scheduled sync. Use scope="all" for cross-scope view.

AI-powered skill recommendations based on what you already have installed. Use scope to specify which installed skills to base suggestions on.

Side-by-side comparison of two skills including security scan results. Accepts GitHub URLs or installed skill names. Use scope to specify which installed skills to check.

概览

What is SkillSync MCP?

SkillSync MCP is a security-first skill management server for AI coding assistants. It gates every skill installation behind a comprehensive threat analysis covering 60+ patterns across 15 attack categories.

How to use SkillSync MCP?

Run npx -y @stranzwersweb2/skillsync-mcp to start the server. Configure it as an MCP server in your client’s settings file (e.g., ~/.claude/settings.json for Claude Code) using the same npx command.

Key features of SkillSync MCP

Multi-level security scanning with 60+ threat patterns
Cloud sync with configurable risk thresholds and conflict policies
AI-powered semantic and keyword search across SkillsMP marketplace
13 MCP tools for search, security, management, and cloud sync
Lock file support for managed vs manual skill tracking
Startup verification via fs.watch and SHA-256 content hashing

Use cases of SkillSync MCP

Securely installing skills from the SkillsMP marketplace with automated threat scanning
Syncing skill configurations across multiple machines via cloud sync
Auditing installed skills for security risks and comparing skill security diffs
Searching for skills using both keyword and AI-powered semantic queries

FAQ from SkillSync MCP

How does SkillSync MCP protect against malicious skills?

Every installation is gated by a security scan covering prompt injection, reverse shells, credential theft, supply chain attacks, and 11 other categories. Critical threats are permanently blocked with no override possible.

What are the system requirements for running SkillSync MCP?

It requires Node.js and npx. No other runtime dependencies are mentioned; it runs as an MCP server started via npx -y @stranzwersweb2/skillsync-mcp.

Where are skills stored and how are they managed?

Skills are sourced from the SkillsMP marketplace. They can be installed, uninstalled, listed, and audited locally; cloud sync allows sharing across machines. File size limits (max 50 files, 512KB per file, 2MB total) and supply‑chain safety (npm install --ignore-scripts) are enforced.

What security safeguards are applied beyond scanning?

Path traversal prevention, SSRF prevention (only github.com URLs), output sanitization (zero‑width Unicode, bidi overrides), a 15‑minute scan cache with 100‑entry LRU eviction, and fs.watch startup verification with debounced re‑scanning.