Aegis Security Skills is listed as active in the registry but did not answer our last check. 58 installs a week from npm. It exposes 3 tools. Last commit 15 Oct 2026.
Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.
What the code does
We read the source, 2 d ago · tools taken from the live server · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
return estimateTokens(fs.readFileSync(path.join(skillDir, phase.file), 'utf8'))
Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.
execFileSync(process.execPath, [path.join(__dirname, 'scripts', 'build-downloads.js')], {
execFileSync(process.execPath, [path.join(__dirname, 'scripts', 'build-downloads.js')], {
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 11 min ago.
claude mcp add aegis-skills --transport http https://aegis-skills.vercel.app/api/mcphttps://aegis-skills.vercel.app/api/mcp[mcp_servers.aegis-skills]
url = "https://aegis-skills.vercel.app/api/mcp"{
"mcpServers": {
"aegis-skills": {
"url": "https://aegis-skills.vercel.app/api/mcp"
}
}
}{
"servers": {
"aegis-skills": {
"type": "http",
"url": "https://aegis-skills.vercel.app/api/mcp"
}
}
}Available tools 3
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
get_skill
get_skill_phase
list_skills
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://aegis-skills.vercel.app/api/mcp | streamable-http | answering | 45 ms | 11 min ago |
Alternatives to Aegis Security Skills
same job, measured the same waySearch open defensive cybersecurity (blue team) jobs and salary data. Read-only, no sign-in.
Read-only Social Security COLA data, calculations, history, and official source links.
Check licences on 15 NSW public registers: trades, property, security, liquor, WHS and more.
Read-only access to your Angelcam security cameras: live snapshots, recordings and camera health.
Security scanning for websites, public repositories, and Open CLAW skills.
Read-only discovery of Framekeep capabilities, security boundaries, and public resources.
Grade a site's security headers with fixes and a badge; read logs or code for the defender.
Voyager's web-page sense: safe read-only observation of one live URL (structure, security, a11y).
Aegis Security Skills — questions
Answers built from our own checks of this server.