Skill Audit MCP is answering right now. Last checked 7 min ago. It exposes 11 tools. Last commit 30 Sep 2026.
MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.
What changed 13
Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 10 August 2026. No other catalogue keeps this.
What the code does
We read the source, 5 d ago · tools taken from the live server · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
r"(?:curl|wget)\b[^\r\n]{0,200}?(?:-d|--data(?:-binary|-raw|-urlencode)?|-F|--form|-T|--upload-file|--post-file)(?:\s+|=)[^\r\n]{0,40}?(?:\$\(\s*cat\s+|@|<\s*)[^\s)'\"]{0,60}?(?:\.ssh/(?![\w./-]*\.pub\b)|\bid_(?:rsa|ed25519|ecdsa)\b(?!\.pub)|\.aws/credentials|\.gn…
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 7 min ago.
claude mcp add skill-audit-mcp --transport http https://eltociear-skill-audit.hf.space/mcphttps://eltociear-skill-audit.hf.space/mcp[mcp_servers.skill-audit-mcp]
url = "https://eltociear-skill-audit.hf.space/mcp"{
"mcpServers": {
"skill-audit-mcp": {
"url": "https://eltociear-skill-audit.hf.space/mcp"
}
}
}{
"servers": {
"skill-audit-mcp": {
"type": "http",
"url": "https://eltociear-skill-audit.hf.space/mcp"
}
}
}Available tools 11
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
audit_skill_text
audit_skill_url
air_quality
country_indicator
earthquakes
elevation
geocode
paid_catalogue
public_holidays
read_url
web_search
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://eltociear-skill-audit.hf.space/mcp | streamable-http | answering | 321 ms | 7 min ago |
Alternatives to Skill Audit MCP
same job, measured the same waySecurity scanner for AI Agent skills, plugins, and MCP servers with A-F grading.
Security scanner for AI agent skills and MCP servers
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload.
Multi-layer security scanner for MCP servers and agent skills (injection, exfiltration)
Security scanner and runtime proxy for MCP servers.
Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.
Security scanner for third-party AI agent-skill files (SKILL.md, hooks, scripts) via MCP.
Skill Audit MCP — questions
Answers built from our own checks of this server.