mcpbeat

Skill Audit MCP Server

io.github.eltociear/skill-audit-mcp
answering

Skill Audit MCP is answering right now. Last checked 4 min ago. It exposes 10 tools. Last commit 2 Aug 2026.

Scan agent skills and MCP servers for malicious patterns before you load them

Uptime history 41 hours of history · worst hour 75%
41 hours agonow
98.9%
Uptime 24h
90 of 91 checks
10
Tools
read from the server
358 ms
Response time
average over 24h
5
Stars
last commit 2 Aug 2026

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 4 min ago.

run in your terminal
claude mcp add skill-audit-mcp --transport http https://eltociear-skill-audit.hf.space/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "skill-audit-mcp": {
      "url": "https://eltociear-skill-audit.hf.space/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.skill-audit-mcp]
url = "https://eltociear-skill-audit.hf.space/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "skill-audit-mcp": {
      "url": "https://eltociear-skill-audit.hf.space/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "skill-audit-mcp": {
      "url": "https://eltociear-skill-audit.hf.space/mcp"
    }
  }
}

Available tools 10

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

audit
audit_skill_text
Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 60 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.
audit_skill_url
Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 60 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.
air
air_quality
Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed.
country
country_indicator
World Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users.
earthquakes
earthquakes
Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports.
elevation
elevation
Ground elevation in metres for a place name.
geocode
geocode
Resolve a place name to coordinates, country, admin region, timezone, elevation and population.
public
public_holidays
Public holidays for a country and year, with local names and a past/upcoming flag.
url
read_url
Fetch a URL and return its main content as clean Markdown, boilerplate stripped.
web
web_search
Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain.

Endpoints

URLTransportStateLatencyChecked
https://eltociear-skill-audit.hf.space/mcp streamable-http answering 375 ms 4 min ago

Skill Audit MCP — questions

Answers built from our own checks of this server.

What can Skill Audit MCP do?
It exposes 10 tools, read directly from the server on our last check. Among them: air_quality, audit_skill_text, audit_skill_url, country_indicator, earthquakes, elevation and 4 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Skill Audit MCP working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 90 of 91 checks got a reply (98.9%), average response time 358 ms. The bar chart above shows every period we have measured.
How do I connect Skill Audit MCP?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Skill Audit MCP need an API key?
No. Skill Audit MCP completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 10 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Skill Audit MCP?
It answers our handshake in 358 ms on average, which is faster than 39% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
Is Skill Audit MCP open source?
Yes — written in Python, 5 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.