Skill Audit MCP Server

by eltociear Your server? Claim it

answering

Skill Audit MCP is answering right now. Last checked 4 min ago. It exposes 11 tools. Last commit 19 Aug 2026.

Scan agent skills and MCP servers for malicious patterns before you load them

Uptime history 47 days of history · worst day 98%

47 days agonow

100.0%

Uptime 24h

92 of 92 checks

Tools

read from the server

320 ms

Response time

average over 24h

Stars

last commit 19 Aug 2026

What changed 11

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 10 August 2026. No other catalogue keeps this.

18 Aug 2 tool descriptions were rewritten audit_skill_text, audit_skill_url

10 Aug 8 tool descriptions were rewritten air_quality, country_indicator, earthquakes and 5 more

10 Aug a tool appeared paid_catalogue

Skill Audit MCP missed 2 checks this week

Everything else answered, so this is steady rather than shaky. We check every 15 minutes, which is how a one-off gets told apart from the start of a pattern, and how you hear about the next one within the hour instead of from your users.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 4 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add skill-audit-mcp --transport http https://eltociear-skill-audit.hf.space/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "skill-audit-mcp": {
      "url": "https://eltociear-skill-audit.hf.space/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.skill-audit-mcp]
url = "https://eltociear-skill-audit.hf.space/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "skill-audit-mcp": {
      "url": "https://eltociear-skill-audit.hf.space/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "skill-audit-mcp": {
      "url": "https://eltociear-skill-audit.hf.space/mcp"
    }
  }
}

Available tools 11

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

audit

audit_skill_text

Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 59 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

audit_skill_url

Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 59 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

air

air_quality

Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

country

country_indicator

World Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

earthquakes

earthquakes

Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

elevation

elevation

Ground elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

geocode

geocode

Resolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

paid

paid_catalogue

List the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, live DEX prices, wallet intel, supply-chain scans). Payment is x402 over USDC on Base — no account or API key. Takes no arguments.

public

public_holidays

Public holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

url

read_url

Fetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

web

web_search

Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Endpoints

URL	Transport	State	Latency	Checked
https://eltociear-skill-audit.hf.space/mcp	streamable-http	answering	325 ms	4 min ago

Alternatives to Skill Audit MCP

same job, measured the same way

Aguara MCP

by garagon

Security scanner for AI agent skills and MCP servers

local only

Veragent

by lixiaowww

Check the trust/security score of MCP servers, agents, skills & CLIs before you install them.

61 installs/wk local only

TrustScan

by entradox

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

4 tools answering

Kadent Scan

by kadent

Free, read-only security scanner for remote MCP servers, before you connect them.

1 tools answering

Prism Scanner

by aidongise-cell

Security scanner for AI Agent skills, plugins, and MCP servers with A-F grading.

108 installs/wk local only

Vigile MCP

by vigile-ai

Query trust scores for MCP servers and agent skills. Check if a tool is safe.

44 installs/wk local only

Zihin

by zihin

Chat with your Zihin.ai agents, list them and load platform skills from any MCP client.

94 installs/wk answering

Aso Score MCP

by forgemeshlabs

ASO Score MCP — the free ASO Score scanner as an MCP server. Measures your ASO Score (Agent.

48 installs/wk local only

Skill Audit MCP — questions

Answers built from our own checks of this server.

What can Skill Audit MCP do?

It exposes 11 tools, read directly from the server on our last check. Among them: air_quality, audit_skill_text, audit_skill_url, country_indicator, earthquakes, elevation and 5 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Skill Audit MCP working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 320 ms. The bar chart above shows every period we have measured.

How do I connect Skill Audit MCP?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Skill Audit MCP need an API key?

No. Skill Audit MCP completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 11 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Skill Audit MCP?

It answers our handshake in 320 ms on average, which is faster than 48% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is Skill Audit MCP open source?

We cannot say either way: written in Python, 6 stars on GitHub and 2 open issues, but we could not determine the licence, and without one the code is not open source by default.