SkillTriage MCP Server

by moorai Your server? Claim it

answering

SkillTriage is answering right now. Last checked 15 min ago. It exposes 4 tools.

Scan AI agent skills, MCP server packages and MCP configs before you install them. Static analysis.

Uptime history 15 hours of history

15 hours agonow

100.0%

Uptime 24h

53 of 53 checks

Tools

read from the server

408 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check SkillTriage every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 15 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add skilltriage --transport http https://skilltriage.moorai.dev/mcp

Settings → Connectors → Add custom connector, then paste this address

https://skilltriage.moorai.dev/mcp

~/.codex/config.toml

[mcp_servers.skilltriage]
url = "https://skilltriage.moorai.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "skilltriage": {
      "url": "https://skilltriage.moorai.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "skilltriage": {
      "type": "http",
      "url": "https://skilltriage.moorai.dev/mcp"
    }
  }
}

Available tools 4

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

scan

scan_mcp_config

Check a pasted MCP client config (.mcp.json, claude_desktop_config.json, mcp.json, Codex config.toml). Reports each npm or PyPI launch by its position and how its version is pinned (exact, @latest, a tag or range, none), flags releases on the known-compromised list, and runs static analysis over the text. Server names, package names, arguments, env and header values are never returned or stored; remove secrets before sending anyway. Static analysis only; nothing is run or fetched. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the pinning advice and a permalink.

scan_package

Download one published package and run static analysis on its code with MoorAI's open-source engine. npm and PyPI packages also get ten MCP pre-install checks on their registry metadata, a reputation score and a known-compromised release check. Static analysis only: the package is never installed and the server is never run. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), content-free findings (threat ids, categories, file paths, hashes; never file contents) and a permalink. The package name and version are sent to its registry. A completed analysis is reused for 24 hours; a new one can take a minute and runs one at a time.

scan_skill

Scan one agent skill or instruction file (SKILL.md, AGENTS.md, a tool.json, any text file) with MoorAI's open-source engine. Static analysis only; nothing is run. The text is written to a temporary directory, scanned and deleted; only its hash, the verdict and content-free findings are kept. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the findings and a permalink.

lookup

lookup_verdict

Look up the verdict the public catalogue has published for an MCP server package on npm or PyPI. Returns found:false when the catalogue has no published verdict for that name; that is not a clean result. Nothing is downloaded or scanned. This request names the package to the server; to match without naming it, download /api/reputation-feed.json and match on your side.

Endpoints

URL	Transport	State	Latency	Checked
https://skilltriage.moorai.dev/mcp	streamable-http	answering	407 ms	15 min ago

Alternatives to SkillTriage

same job, measured the same way

Veragent

by lixiaowww

Check the trust/security score of MCP servers, agents, skills & CLIs before you install them.

81 installs/wk local only

KillerSkills

by cyligence-karim

Security verdicts for agent skills and MCP servers, from sandbox runs, before you install them.

1 626 installs/wk local only

Vdb

by ai-vdb

Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.

880 installs/wk 7 tools answering

Calllint

by calllint

Static preflight safety gate for MCP servers — scan configs before you run them. Never executes.

317 installs/wk local only

The Agent Forge

by theagentforge

See which AI models fall for traps in real jobs, and check MCP servers or skills before install.

6 tools answering

AgentBuffs

by agentbuffs

Find MCP servers and agent skills for a job, ranked, with install config for your client.

4 tools answering

Presend MCP Server

by presendapp

Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.

40 tools answering

skillkit

by furkan708

Toolbox for AI agent skills: scaffold, lint, pack, install, and serve SKILL.md skills

53 installs/wk local only

SkillTriage — questions

Answers built from our own checks of this server.

What can SkillTriage do?

It exposes 4 tools, read directly from the server on our last check. Among them: lookup_verdict, scan_mcp_config, scan_package, scan_skill. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is SkillTriage working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 53 of 53 checks got a reply (100.0%), average response time 408 ms. The bar chart above shows every period we have measured.

How do I connect SkillTriage?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does SkillTriage need an API key?

No. SkillTriage completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 4 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is SkillTriage?

It answers our handshake in 408 ms on average, which is faster than 31% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.