skylos — Claude Code MCP server: what it does, how to install
Scans repositories for dead code, hardcoded secrets, security issues, and AI hallucination mistakes in Python, Go, and TypeScript.
claude mcp add skylos -e SKYLOS_API_KEY=<SKYLOS_API_KEY> -- uvx skylosWhat skylos does
Skylos runs static checks to detect unused classes, functions, dead imports, and empty files. Adding -a flags hard-coded secrets, dependency CVEs, excessive complexity, and typical AI coding mistakes like invented library methods, missing guards, or impossible package versions.
For pull requests written by AI assistants, the skylos done --base main command executes your test suite and compares changes against the target branch. It catches agents that try to turn off linters, drop failing tests, or add test-only bypasses. Findings are grouped into concrete defects, contextual reviews, and maintainability advice.
To run the tool through an MCP client, set the SKYLOS_API_KEY environment variable. Python has the deepest feature coverage; scanning Go code requires the native skylos-go engine, and private or Git dependencies inside uv.lock will be marked as unverified.
What it helps with
- detect unused functions, classes, and dead imports
- catch skipped tests and weakened linters after AI agent edits
- scan code for hardcoded secrets and vulnerable dependencies
- identify hallucinated library APIs and synthetic helper functions
Example prompts for the agent
- Run skylos on the current repository to spot dead code and empty files
- Scan the project for hardcoded secrets and security flaws using -a
- Verify if the current branch is ready to merge against main
How to install skylos
Platform CLI
claude mcp add skylos -e SKYLOS_API_KEY=<SKYLOS_API_KEY> -- uvx skylosReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>
Platform CLI
codex mcp add skylos --env SKYLOS_API_KEY=<SKYLOS_API_KEY> -- uvx skylosReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>
Config file
{
"mcpServers": {
"skylos": {
"command": "uvx",
"args": [
"skylos"
],
"env": {
"SKYLOS_API_KEY": "<SKYLOS_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>
Config file
{
"servers": {
"skylos": {
"type": "stdio",
"command": "uvx",
"args": [
"skylos"
],
"env": {
"SKYLOS_API_KEY": "<SKYLOS_API_KEY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>
Platform CLI
gemini mcp add -e SKYLOS_API_KEY=<SKYLOS_API_KEY> skylos uvx skylosReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about skylos
How to install skylos in Claude Code?
Run claude mcp add skylos -e SKYLOS_API_KEY=<SKYLOS_API_KEY> -- uvx skylos. Replace <SKYLOS_API_KEY> with your actual key.
What does skylos do?
It audits source code for unused logic, secrets, security flaws, and maintainability issues. It also validates pull requests by detecting silenced linters or skipped tests.
Which programming languages are supported?
Python receives the deepest analysis, followed by TypeScript, JavaScript, and Java for dead code and security. Go requires the skylos-go binary, while C++ is limited to unused file-local functions.
