# skill-audit-mcp

A static scanner for MCP servers, agent skills and plugins. It flags 17 attack patterns across four severity levels before you install someone else's code.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: eltociear
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/eltociear/skill-audit-mcp
- Updated: 2026-09-30
- HTML: https://affpapa.org/en/nevibecode/mcp/skill-audit-mcp

## What it does

The server reads code and instruction files looking for behaviour that signals an attack: fetching and running remote payloads, sending credentials out, generating keys, writing to sensitive directories, harvesting seed phrases. It also catches auth bypass, identity impersonation and prompt injection. Severity comes from the worst match in the scan, not an average — a single credential leak lands as CRITICAL even if everything around it looks clean.

Two ways to connect: a hosted HTTP endpoint, or the local Docker image `ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0`. Beyond the MCP server there is a CLI built on the Python 3.8+ standard library and a GitHub Action that scans pull requests and can push SARIF into GitHub Code Scanning. In the CLI, findings carry a location label: `production` sets the exit code, while `documentation` and `test` are only listed unless you pass `--include-nonproduction`. Files an agent treats as instructions — `SKILL.md`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, anything inside `.claude/commands|agents|skills/` or `.cursor/rules/` — count as production, because for a skill they are the program itself.

Run it before installing a plugin you did not write. The scanner watches behaviour, so leaked API keys are outside its scope; the same author ships `secrets-audit-mcp` with 32 provider rules for that. Matches inside comments, string literals and markdown tables still get reported, but drop in weight when harm would require execution.

## Requirements
- Needs: Docker
- Remote server: `https://eltociear-skill-audit.hf.space/mcp`

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcp
```

2. **Platform CLI**
```bash
claude mcp add skill-audit-mcp -- docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0
```

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add skill-audit-mcp --url https://eltociear-skill-audit.hf.space/mcp
```

2. **Platform CLI**
```bash
codex mcp add skill-audit-mcp -- docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "skill-audit-mcp": {
            "url": "https://eltociear-skill-audit.hf.space/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "skill-audit-mcp": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "skill-audit-mcp": {
            "type": "http",
            "url": "https://eltociear-skill-audit.hf.space/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "skill-audit-mcp": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0"
            ]
        }
    }
}
```

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcp
```

2. **Platform CLI**
```bash
gemini mcp add skill-audit-mcp docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0
```

## When to use it
- check an unfamiliar MCP server for hidden command execution
- catch credential exfiltration in a skill before installing it
- scan pull requests for prompt injection and auth bypass
- separate agent instruction files from ordinary docs during a scan
- push scan results into GitHub Code Scanning

## Example prompts
- Scan `./some-skill/` and show me findings at HIGH or above
- Check `server.py` for remote download-and-execute patterns
- Audit this MCP server and explain what you found

## Similar
- [Bawbel Scanner](https://affpapa.org/en/nevibecode/mcp/bawbel-scanner.md) — MCP server · ★ 12
- [audit-augmentation](https://affpapa.org/en/nevibecode/skills/audit-augmentation.md) — skill · 3900 installs
- [triage](https://affpapa.org/en/nevibecode/skills/anthropics-triage.md) — skill · 1100 installs
- [web-security-scanner-pro](https://affpapa.org/en/nevibecode/skills/web-security-scanner-pro.md) — skill · 607 installs
- [Prism Scanner](https://affpapa.org/en/nevibecode/mcp/prism-scanner.md) — MCP server · ★ 28
- [trailmark-finding-triage](https://affpapa.org/en/nevibecode/skills/trailmark-finding-triage.md) — skill · 1300 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md