mcpbeat Sign in

Skylos MCP Server

by duriantaco Your server? Claim it
local only

Skylos runs on your own machine — the client starts it, so there is no endpoint to ping. 18 479 installs a week from pypi. Last commit 18 Sep 2026.

Dead code, security, secrets detection and code quality for Python, TypeScript, Go.

Installs per day peak 5 877 · avg 2 606 · +32% w/w
a month agotoday
18 479
Installs / week
pypi · skylos
816
Stars
0 open issues
18 Sep 2026
Last commit
0 releases in 90 days
Apache-2.0
License
Python

What the code does

We read the source, 19 h ago · rules 3dff92dd89df

A tool parameter reaches a dangerous call

A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.

A tool parameter reaches a dangerous call analyze.path → skylos/cli.py:2719, provenance_scan.diff_base → skylos/cli.py:2763, analyze.path → skylos/cli.py:2732 и ещё 13
        fixture_result = subprocess.run(
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

      const proc = spawn(bin, fullArgs, { cwd: root });
    return path.isAbsolute(configured) ? configured : path.join(root, configured);
    return dict(os.environ if environ is None else environ)

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

A tool parameter here reaches a dangerous call

That is not a flaw by itself — but it is where things go wrong when it is not the job. We re-read this code on every release. Watch it and you hear from us the day another one appears.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add skylos -- uvx skylos
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "skylos": {
      "args": [
        "skylos"
      ],
      "command": "uvx"
    }
  }
}
~/.codex/config.toml
[mcp_servers.skylos]
command = "uvx"
args = ["skylos"]
.cursor/mcp.json
{
  "mcpServers": {
    "skylos": {
      "args": [
        "skylos"
      ],
      "command": "uvx"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "skylos": {
      "args": [
        "skylos"
      ],
      "command": "uvx"
    }
  }
}

This one needs environment variables set before it will start: SKYLOS_API_KEY (Skylos API key for cloud features and MCP authentication). The author declared them in the registry entry; get the values from the project itself.

Alternatives to Skylos

same job, measured the same way
GuardianShield
by sparkvibe-io

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

82 installs/wk local only
CGIS Code Graph
by zaebee

Code graph for AI agents: impact analysis and call tracing for Python and TypeScript.

local only
MCP Server Analyzer
by anselmoo

MCP server for Python, JavaScript, and TypeScript code analysis with Ruff, ty, Vulture, and Biome

590 installs/wk local only
Flutter Structure MCP
by nilesh9783

Audit architecture, security, memory, and code quality in Flutter, Laravel, Node, Python, & Vue.

local only
Bug Detector
by madhavi-opsera

Analyzes code for bugs, security vulnerabilities, and code smells

local only
Sonde
by anishmoncivarghese

Local code graph for TypeScript, Python and Swift: who calls this, what breaks if I change it.

70 installs/wk local only
Code Guard MCP
by mlawsonking

Security scan for AI-generated code: injection, SSRF, secrets, weak crypto, unsafe deserialization.

44 installs/wk local only
Diffpilot
by bkalafat

MCP server for PR code review, commit messages, changelogs, and secret detection.

local only

Skylos — questions

Answers built from our own checks of this server.

Why is there no uptime for Skylos?
Skylos runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the pypi package skylos was installed 18 479 times last week.
How do I connect Skylos?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls skylos straight from pypi; nothing to host, nothing to sign up for.
How many people use Skylos?
The pypi package skylos was installed 18 479 times in the last week. Week over week that is +32%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Skylos open source?
Yes — it is published under the Apache-2.0 licence, written in Python and 816 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.