# SkillTotal

Scans MCP servers, agent skills, and npm/PyPI packages with static checks. Use it before an agent installs a component.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 15
- Author: pezhik
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/pezhik/skilltotal
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/skilltotal

## What it does

SkillTotal examines MCP servers, agent skills, plugins, repositories, folders, archives, and individual files. Its checks cover shell execution, filesystem and secret access, outbound network calls, dynamic code, obfuscation, and risky MCP tools. Package install hooks are included too.

The server runs locally and reads code without executing it. Regex and AST matching produce repeatable findings without an LLM, with each issue linked to a file and line. MCP setup uses `uvx skilltotal`; the CLI package runs on the Python standard library. In Claude Code, the plugin checks install commands before execution, so those agent-side checks depend on the MCP server being connected.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add skilltotal -- uvx skilltotal
```
uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>

### Codex

**Platform CLI**
```bash
codex mcp add skilltotal -- uvx skilltotal
```
uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "skilltotal": {
            "command": "uvx",
            "args": [
                "skilltotal"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "skilltotal": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "skilltotal"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add skilltotal uvx skilltotal
```
uvx runs the command named after the package; if the README names another one, use uvx --from skilltotal <command>

## When to use it
- scan an npm package before installation
- detect reads from `.env` and SSH keys
- spot secrets sent over the network
- review dangerous MCP tools
- find code triggered by package installation

## Example prompts
- Scan `npm:express` before installing it.
- Check this MCP server folder and report every finding with its file and line.
- Inspect the repository for install hooks and secret access.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md