SkillTotal — Claude Code MCP server: what it does, how to install
Scans MCP servers, agent skills, and npm/PyPI packages with static checks. Use it before an agent installs a component.
claude mcp add skilltotal -- uvx skilltotalWhat SkillTotal does
SkillTotal examines MCP servers, agent skills, plugins, repositories, folders, archives, and individual files. Its checks cover shell execution, filesystem and secret access, outbound network calls, dynamic code, obfuscation, and risky MCP tools. Package install hooks are included too.
The server runs locally and reads code without executing it. Regex and AST matching produce repeatable findings without an LLM, with each issue linked to a file and line. MCP setup uses uvx skilltotal; the CLI package runs on the Python standard library. In Claude Code, the plugin checks install commands before execution, so those agent-side checks depend on the MCP server being connected.
What it helps with
- scan an npm package before installation
- detect reads from
.envand SSH keys - spot secrets sent over the network
- review dangerous MCP tools
- find code triggered by package installation
Example prompts for the agent
- Scan
npm:expressbefore installing it. - Check this MCP server folder and report every finding with its file and line.
- Inspect the repository for install hooks and secret access.
How to install SkillTotal
Platform CLI
claude mcp add skilltotal -- uvx skilltotaluvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>
Platform CLI
codex mcp add skilltotal -- uvx skilltotaluvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>
Config file
{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>
Config file
{
"servers": {
"skilltotal": {
"type": "stdio",
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>
Platform CLI
gemini mcp add skilltotal uvx skilltotaluvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about SkillTotal
How do I install SkillTotal in Claude Code?
Run claude mcp add skilltotal -- uvx skilltotal. Claude Code can then use the MCP server.
What does SkillTotal do?
It statically checks MCP servers, agent skills, plugins, and packages for risky behavior such as command execution, file access, network egress, and dynamic code. Findings point to source files and lines.
Does SkillTotal execute the code it scans?
No. It runs locally and analyzes the code without executing it, using regex and AST matching rather than an LLM.
