# MCP Skills

> The pre-install trust layer for MCP servers and AI skills. 15 signals across 4 dimensions with safety scanning, OSV/KEV/EPSS-backed vulnerability intelligence, prompt-injection detection, supply-chain analysis, public score pages, trust badges, monitoring, and API workflows. Know before you install.

## What This Is

MCP Skills is the public trust layer for AI skills and MCP servers. It scores publishers, source code, dependencies, vulnerabilities, and supply-chain risk so developers, agents, and teams can decide what to install before running anything locally. 15 signals across 4 dimensions (Alive, Legit, Solid, Usable), 4 trust tiers (Verified, Established, New, Blocked), 7 safety pattern checks (prompt injection, shell execution, network exfiltration, credential access, obfuscation, public network binding, npm lifecycle-script risk), and vulnerability intelligence from OSV.dev, CISA KEV, and EPSS exploit-probability scoring. Accepts GitHub repos, npm packages, Smithery servers, and OpenClaw skills. Available as a website, API, and MCP server.

## Docs

- [Trust Scanner](https://mcpskills.io): Paste any repo URL, npm package name, or registry URL and get a trust score. Free tier shows trust tier + dimension scores. Paid reports unlock all 15 signals and safety findings.
- [Scored MCP Server Directory](https://mcpskills.io/servers): Public trust directory for scored MCP servers, AI skills, and packages. Use it to check install risk before running unknown code.
- [Original Research Index](https://mcpskills.io/research): Canonical landing page for original-research and analysis articles on AI skill / MCP server / ClawHub trust. Reproducible methodology, real GitHub data, no AI hand-waving.
- [Trust Scoring Glossary](https://mcpskills.io/glossary): Canonical definitions for every term used in the MCP Skills trust scoring engine — tiers, dimensions, signals, disqualifiers, scoring modes, vulnerability intelligence, and engine concepts. ~30 terms with DefinedTerm schema.
- [How Trust Scoring Works](https://mcpskills.io/#methodology): 4 dimensions, 15 signals, Skills Mode for MCP servers/AI skills with enhanced security weight and safety scanning.
- [What We Check and What We Don't](https://mcpskills.io/#methodology): Transparent scope — static analysis of source code, GitHub metadata, and OpenSSF Scorecard. Does not cover runtime behavior, multi-step agent chain leaks, or dynamic payloads. Runtime monitoring is on the roadmap.
- [Roadmap](https://mcpskills.io/roadmap): Public roadmap with 4 phases — what's live, what's building, what's planned, what's in research.
- [Pricing](https://mcpskills.io/#pricing): Free ($0, directory + public score pages + trust badges + 10 scans/day), Single Report ($2, one full 15-signal report), Developer Pro ($19/mo or $149/yr, full reports + batch API + monitoring + 1000 agent calls/day), Builder Pro ($29/mo or $249/yr, monitored trust badge + public Verified listing + recurring re-verification), Team ($99/mo, org/security workflows), Enterprise (custom).
- [API](https://mcpskills.io/api): Agent-optimized REST API. Free tier returns `{ safe, tier, score, recommendation, flags }`. Developer Pro returns full 15-signal breakdown. All calls audited.
- [Pre-Install Trust Gate](https://mcpskills.io/gate): A zero-runtime agent skill that trust-checks any AI skill, MCP server, plugin, or npm package BEFORE installing it. One `GET https://mcpskills.io/api/gate/<target>` returns `{ proceed, reason, tier, composite }` — install Verified and Established, refuse anything Blocked (no license, critical/KEV CVE, known-malicious advisory, token exfiltration in CI, unsafe source). Drop the SKILL.md into any agent (Claude Code, OpenClaw, Hermes, Cursor) and every install decision routes through a trust check. Skill source: https://mcpskills.io/skills/pre-install-trust-gate/SKILL.md (CC BY 4.0).
- [Verified Badge Program](https://mcpskills.io/verify): Automated Verified status for repos that clear the trust bar (score >= 7.0, solid >= 5.0, no disqualifiers). Same criteria for every repo, no application. Gold badge for READMEs, fast-path trust for agents.
- [Trust Badges & Embed Docs](https://mcpskills.io/badges): How to embed a trust badge in any README. One badge endpoint, two visual variants — a neutral score badge for any scored repo and a gold Verified badge once a repo clears the trust bar and is claimed. Markdown and HTML examples, query-param form for npm packages. Badges fetch live data and revert automatically on drift.
- [MCP Safety Lab Partner Program](https://mcpskills.io/partners/workshops): Free partner pilot for AI coding workshops, schools, hackathons, MCP directories, communities, and indie dev shops. Includes scan credits, a short live safety segment, public score pages, badge guidance, and a co-branded checklist for builders using MCP servers and AI skills.
- [Privacy Policy](https://mcpskills.io/privacy): What data is collected, third-party services (GitHub API, OpenSSF, LemonSqueezy, Netlify, Resend), retention policy.
- [Terms of Service](https://mcpskills.io/terms): Acceptable use, no security guarantee, refund policy.

## Blog

- [We Re-Ran 17,886 of Our Own Scores. 17,886 Matched. — July 2026](https://mcpskills.io/blog/replay-every-score): Scanner Precision Part 2. A full-population audit of the MCPSkills version archive, run like an acquirer's diligence pass with the kill rule set in advance: 17,886/17,886 historical scores re-derived exactly from stored inputs (mean drift 0.000; composites within 0.01 on 100%), every tier "flicker" explained by labeled algorithm-version changes, and the change ledger re-derived from the raw tape — 35,534 version|composite|tier transitions found vs 1,538 previously published, 7,835/7,835 existing records reproduced byte-identically, 1,563 missing records recovered with cause labels (subject_change vs algorithm_change). Includes explicit limits: raw-evidence capture begins 2026-07-26, the tape is ~75 days old, and reproducibility is not correctness. Thesis: a trust score you can't replay is an opinion with a number attached — display trust signals you can audit.

- [State of Hermes Skill Security — June 2026](https://mcpskills.io/blog/state-of-hermes-skill-security): Original research scoring the 118 most-installed agent skills in the skills.sh cross-agent directory — the ecosystem Hermes (Nous Research's OpenClaw-style personal agent) installs from — totaling 11,745,734 combined installs. Key findings: 15% Verified, 64% Established, 20% Blocked (median composite 6.36, range 4.11–8.22), the most-installed skills ship without a license — Vercel's own agent-skills repo (1,399,150 installs) is Blocked for NO_LICENSE, alongside Figma, Clerk, LangChain, Firecrawl, Convex, and Apify — and 0% declare any security posture in skill frontmatter (the same transparency gap the ClawHub report found). NO_LICENSE is a real legal risk: code published without a license is "all rights reserved" by default. Balanced with Verified examples from Google, Microsoft, Supabase, and FastAPI. Full dataset published at /data/latest.json (CC BY 4.0).
- [The Trust Middle — State of MCP Server Security, June 2026](https://mcpskills.io/blog/the-trust-middle): Original research scoring 2,233 MCP servers, AI skills, and packages across npm, the MCP Registry, ClawHub, and GitHub — the largest cross-registry MCP trust dataset to date. Key findings: no project scores above 9/10 (the ceiling is openai/openai-node at 8.97), 66.7% cluster in an undifferentiated 5–7 band, and purpose-built MCP skills reach Verified at 8.2% versus 24.8% for general SDKs while being the only tier that gets Blocked. Full dataset published at /data/latest.json (CC BY 4.0), also mirrored as a Hugging Face dataset: https://huggingface.co/datasets/MisterRiseAbove/mcpskills-trust-scores.
- [Trail of Bits Is Right About Skill Scanners — June 2026](https://mcpskills.io/blog/trail-of-bits-skill-scanners): Trail of Bits bypassed five AI skill scanners in under an hour each. Their conclusion is structurally correct — no single content scan reliably catches a malicious skill. Explains why that validates the trust-layer model (provenance, reputation, a human gate) rather than refuting it, and honestly maps the limits of our own tool_safety signal.
- [SkillSpector vs MCP Skills — June 2026](https://mcpskills.io/blog/nvidia-skillspector-scanner): NVIDIA SkillSpector is an open-source scanner for AI agent skills. MCP Skills is a broader trust layer for MCP servers, AI skills, and packages. Explains why SkillSpector findings should contribute to the Solid dimension as calibrated evidence, not replace trust scoring.
- [The MCP Pre-Install Audit — May 2026](https://mcpskills.io/blog/mcp-pre-install-audit): Eight checks to run before you install a local MCP server, with notes on what mcpskills automates and the three controls (sandboxing, manifest hashing, version pinning) that no scanner replaces. Includes a self-audit of `@mcpskillsio/server` that found and patched a HIGH transitive vuln within 24 hours.
- [State of ClawHub Trust — April 2026](https://mcpskills.io/blog/state-of-clawhub-trust): Original research scoring 200 ClawHub skills (1.36M GitHub stars). 10% Verified, 81.5% Established, 7.5% Blocked. Only 1.5% declare their security posture in SKILL.md frontmatter.
- [State of MCP Security — April 2026](https://mcpskills.io/blog/state-of-mcp-security): Original research scoring a representative sample of MCP Registry servers. Trust tier breakdown, vulnerability findings (OSV/KEV), and supply-chain risk patterns across the ecosystem.
- [State of AI Skill Security — March 2026](https://mcpskills.io/blog/state-of-ai-skill-security): Original research scoring 10 popular AI tools. Findings: stars don't predict trust, usability is the universal weak spot, org-backed repos score higher on credibility.
- [ClawHavoc and the Missing Trust Layer](https://mcpskills.io/blog/clawhavoc-missing-trust-layer): Analysis of the ClawHavoc attack (1,184 malicious AI skills, 7,700 downloads before detection) and why the ecosystem needs multi-dimensional trust scoring.
- [How to Check if an AI Skill is Safe Before Installing](https://mcpskills.io/blog/how-to-check-ai-skill-safe): Step-by-step guide — find the repo or package, run the scan, check the tier, review safety findings, red flags to watch for.
- [Score Any MCP Server — Even Without a GitHub Repo](https://mcpskills.io/blog/score-without-github-repo): How cross-registry input works. Paste npm packages, Smithery URLs, OpenClaw skills. Automatic source resolution. Limited scores for packages without repos.

## Recent Ecosystem Signals (External Validation)

Independent third-party research published in 2025–2026 that motivates the trust-layer category:

- **9 of 11 MCP registries** (including LobeHub and Cursor Directory) accepted a benign proof-of-concept malicious MCP server with no security review when OX Security tested in April 2026. Only GitHub rejected it. Source: [OX Security](https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/), 2026-04-15.
- **CVE-2025-6514 in `mcp-remote`** — CVSS 9.6 OS command injection that gave any malicious MCP server remote code execution on the client. Disclosed by JFrog in July 2025; fixed in 0.1.16. The package had been downloaded 437,000+ times at disclosure. Sources: [NVD CVE-2025-6514](https://nvd.nist.gov/vuln/detail/CVE-2025-6514), [JFrog Security Research](https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/).
- **More than 30 responsible disclosures and 10+ Critical/High CVEs** tied to MCP over five months from OX Security, echoed by the Cloud Security Alliance in its April 20, 2026 research note. Sources: [OX Security](https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/), [CSA Research Note](https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-by-design-rce-ox-security-20260420-csa/).
- **OX Security identified roughly 7,000 publicly reachable MCP servers running STDIO transport** and extrapolates up to 200,000 total vulnerable deployments. Anthropic confirmed the STDIO behavior is by design and that input sanitization is the developer's responsibility. Sources: [OX Security](https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/), [VentureBeat](https://venturebeat.com/security/mcp-stdio-flaw-200000-ai-agent-servers-exposed-ox-security-audit).
- **Cursor MCPoison flaw (CVE-2025-54136, CVSS 7.2)** — disclosed by Check Point on August 5, 2025 and patched in Cursor 1.3 — let an attacker swap a previously-approved MCP config for a malicious one without re-triggering the approval prompt. Affected Cursor 1.2.4 and earlier. Sources: [NVD CVE-2025-54136](https://nvd.nist.gov/vuln/detail/CVE-2025-54136), [Check Point Research](https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/).

## MCP Server

Install: `claude mcp add mcpskills -- npx @mcpskillsio/server`

9 tools available:
- `check_trust_score` — Score any AI skill, MCP server, or package (accepts owner/repo, npm:@scope/package, Smithery URL, OpenClaw URL)
- `scan_safety` — Safety-only scan for AI skills (7 attack pattern checks)
- `list_packages` — Browse curated, pre-scored skill packages by use case
- `get_badge` — Get SVG trust badge URL for READMEs
- `watch_repo` — Start monitoring a repo for score changes (Developer Pro or Team)
- `check_watched` — Re-scan all watched repos (Developer Pro or Team)
- `batch_check` — Check up to 5 repos in one call (Developer Pro or Team)
- `auto_gate` — "Should I install this?" → boolean proceed + reason (certified repos get instant approval)
- `build_stack` — Recommend a vetted, pre-scored stack from live trust data

npm: [@mcpskillsio/server](https://www.npmjs.com/package/@mcpskillsio/server)

## API

POST `https://mcpskills.io/.netlify/functions/score` with `{"repo": "owner/repo"}` or `{"repo": "npm:@scope/package"}` or `{"repo": "https://smithery.ai/server/name"}`.

Agent response (free, with `Accept: application/json`):
```json
{ "safe": true, "tier": "verified", "score": 8.2, "recommendation": "install", "flags": [], "certified": false }
```

Full response (with `X-API-Key` header): all 15 signals, dimensions, safety findings, spec compliance, recommendations.

Rate limits: free human = 10/day, free agent = 10/day, Developer Pro = 1000/day.

## Trust Scoring Algorithm

### 15 Signals (Skills Mode)
- Alive: commit_recency, release_cadence, issue_responsiveness
- Legit: author_credibility, community_adoption, contributor_diversity, download_adoption
- Solid: security_posture, dependency_health, tool_safety, supply_chain_safety, known_vulnerabilities
- Usable: readme_quality, skill_spec_compliance, license_clarity

### Trust Tiers
- Verified: score >= 7.0, solid >= 5.0, alive >= 5.5, legit >= 4.5, >= 8 sufficient signals, zero disqualifiers
- Established: score >= 4.5
- New: score < 4.5
- Blocked: any hard disqualifier present (SAFETY_BLOCK = a Blocking-level finding in the installed/runtime artifact, CRITICAL_CVE, SUPPLY_CHAIN_RISK = token exfiltration in CI, ARCHIVED, NO_LICENSE)
- Soft gates (NO_SCORECARD, SINGLE_AUTHOR_LOW_ADOPTION, CI_PR_TARGET_RISK = pull_request_target checkout of untrusted PR code) never block but veto Verified

### Safety Scans (Skills Mode, v3.4.0 — three-level finding model)
Checks up to 20 files for: prompt injection (critical), shell execution (high), network exfiltration (high), credential access (high), obfuscated payloads (medium), public network binding 0.0.0.0 (medium), npm lifecycle-script risk (high/medium — content-based: high for `curl|sh`/`base64|sh`/`child_process`, medium for opaque local scripts, none for vanilla `tsc`/`build`/`husky install`). Checks are behavior-based (a secret-path read, an exfiltration call to a public host, `curl|sh` from an unknown source) rather than keyword matches.

Files are classified into three tiers: the installed/runtime artifact (source code, entry points, npm-published files, agent-facing SKILL.md, and files auto-executed by npm lifecycle scripts), infrastructure (Dockerfiles, CI, devcontainer, deploy scripts), and documentation. Findings resolve to one of three levels: Blocking (installed/runtime artifact only — counts toward SAFETY_BLOCK), Review (lowers the tool_safety score, never blocks), and Note (infrastructure or documentation — informational only, zero score effect, never blocks).

### Vulnerability Intelligence (Solid Dimension)
known_vulnerabilities signal cross-references the latest published version against:
- OSV.dev — unified advisory database (GHSA + npm + PyPA + Go + RustSec)
- CISA KEV — Known Exploited Vulnerabilities catalog (actively exploited in the wild)
- EPSS — Exploit Prediction Scoring System (30-day exploit probability)
Any unpatched critical OR any CVE in CISA KEV triggers the CRITICAL_CVE disqualifier and hard-gates the tier to "blocked" — cannot be offset by other signals.

## Key Facts

- Built by Michael Browne at Rise Above Partners LLC
- Viroqua, Wisconsin
- 2,631 repos and packages scored across MCP, ClawHub/OpenClaw, and npm registries as of 2026-07-30 (2,546 live in the public /servers directory; growing daily via nightly crawl)
- Official domains: mcpskills.io and mcpskills.netlify.app. Not affiliated with mcpskills.dev or the github.com/mcpskills organization — those are unrelated projects that share the name
- Cross-registry: GitHub, npm, Smithery, OpenClaw, mcp.run
- Data sources: GitHub API, OpenSSF Scorecard, OSV.dev, CISA KEV, FIRST.org EPSS
- Safety patterns from ClawHavoc and ToxicSkills research
- All API calls audited with privacy-safe IP hashing
- API keys stored as SHA-256 hashes (never plaintext)
- Launched March 2026

## Contact

- Website: https://mcpskills.io
- Email: hello@mcpskills.io
- npm: @mcpskillsio/server
- Builder: https://www.linkedin.com/in/michaelbrowne03/
- Company: https://rise-above.net