Trust scoring for AI agents

Quick start

Every request is a single POST with a repo identifier. The API accepts owner/repo, GitHub URLs, npm packages, Smithery URLs, and OpenClaw URLs — it resolves all of them to a unified trust score.

Minimal request (no key required)

curl -X POST https://mcpskills.io/.netlify/functions/score \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"repo":"npm:@anthropic-ai/sdk"}'

Response (agent mode, free tier)

{
  "safe": true,
  "tier": "verified",
  "score": 8.4,
  "recommendation": "install",
  "certified": false,
  "flags": [],
  "reasoning": "15 signals, no disqualifiers, AI skill detected, no safety findings",
  "fullReportAvailable": true
}

safe is your go/no-go boolean. recommendation is one of install, caution, avoid, or blocked. flags surfaces disqualifiers and low-dimension warnings for anything that needs a human glance.

Authentication

Unauthenticated requests get the free agent response. Authenticated requests unlock the full 15-signal breakdown, safety findings, recommendations, and raise your rate limit.

Header format

X-API-Key: msk_{32-hex-char-key}

How the API decides response mode

• Browser User-Agent (no key) → human free response (tier, composite, dimensions)
• Accept: application/json or X-API-Key (no key) → agent free response (go/no-go, flags)
• Valid X-API-Key → full paid response (all 15 signals, safety findings, recommendations)

Keys are delivered by email immediately after purchase. Lose your key? Email hello@mcpskills.io with your order ID.

Endpoints

Everything runs on a single base URL. No SDK required — it's HTTP + JSON.

Response modes

Same endpoint, three response shapes. The API picks the right one based on your headers and auth status.

{
  "safe": true,
  "tier": "verified",
  "score": 8.4,
  "recommendation": "install",
  "certified": false,
  "flags": [],
  "reasoning": "15 signals..."
}

{
  "repo": "owner/repo",
  "composite": 8.4,
  "tier": "verified",
  "dimensions": { ... },
  "signals": { ...15 signals... },
  "safety": { "findings": [] },
  "recommendations": [ ... ]
}

Agent mode is optimized for tool-calling loops: compact, deterministic, easy to branch on. Paid mode is optimized for CI pipelines and dashboards that need the full picture.

Rate limits

All limits are per-IP for anonymous traffic and per-key for authenticated traffic. Exceeding a limit returns HTTP 429 with a resetAt timestamp.

Get an API key

Start free. Upgrade when you need the full report, batch checking, or monitoring. Keys are delivered by email seconds after checkout.

Use it from Claude Code or Cursor

The MCP server wraps the API as 9 tools your agent can call directly. One install, then your agent can check any skill before installing it.

Install

claude mcp add mcpskills -- npx @mcpskillsio/server

With an API key (for paid tools)

claude mcp add mcpskills -- npx @mcpskillsio/server \
  --env MCPSKILLS_API_KEY=msk_your_key

Tools exposed

• check_trust_score — Score any repo, package, or registry URL
• auto_gate — Boolean "should I install this?" with reason
• scan_safety — Safety-only scan (prompt injection, shell exec, credentials, exfiltration, obfuscation)
• batch_check — Check up to 5 repos in one call (Developer Pro or Team)
• build_stack — Stack recommendations from live trust data
• list_packages — Browse curated skill packages
• watch_repo — Start monitoring a repo
• check_watched — Re-scan all watched repos
• get_badge — SVG badge URL for READMEs

FAQ