# skylos

Scans repositories for dead code, hardcoded secrets, security issues, and AI hallucination mistakes in Python, Go, and TypeScript.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 849
- Author: duriantaco
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/duriantaco/skylos
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/skylos

## What it does

Skylos runs static checks to detect unused classes, functions, dead imports, and empty files. Adding `-a` flags hard-coded secrets, dependency CVEs, excessive complexity, and typical AI coding mistakes like invented library methods, missing guards, or impossible package versions.

For pull requests written by AI assistants, the `skylos done --base main` command executes your test suite and compares changes against the target branch. It catches agents that try to turn off linters, drop failing tests, or add test-only bypasses. Findings are grouped into concrete defects, contextual reviews, and maintainability advice.

To run the tool through an MCP client, set the `SKYLOS_API_KEY` environment variable. Python has the deepest feature coverage; scanning Go code requires the native `skylos-go` engine, and private or Git dependencies inside `uv.lock` will be marked as unverified.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `SKYLOS_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add skylos -e SKYLOS_API_KEY=<SKYLOS_API_KEY> -- uvx skylos
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>

### Codex

**Platform CLI**
```bash
codex mcp add skylos --env SKYLOS_API_KEY=<SKYLOS_API_KEY> -- uvx skylos
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "skylos": {
            "command": "uvx",
            "args": [
                "skylos"
            ],
            "env": {
                "SKYLOS_API_KEY": "<SKYLOS_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "skylos": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "skylos"
            ],
            "env": {
                "SKYLOS_API_KEY": "<SKYLOS_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e SKYLOS_API_KEY=<SKYLOS_API_KEY> skylos uvx skylos
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from skylos <command>

## When to use it
- detect unused functions, classes, and dead imports
- catch skipped tests and weakened linters after AI agent edits
- scan code for hardcoded secrets and vulnerable dependencies
- identify hallucinated library APIs and synthetic helper functions

## Example prompts
- Run skylos on the current repository to spot dead code and empty files
- Scan the project for hardcoded secrets and security flaws using -a
- Verify if the current branch is ready to merge against main

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47392
- [Serena MCP: the IDE for your agent](https://affpapa.org/en/nevibecode/mcp/serena-mcp-the-ide-for-your-agent.md) — MCP server · ★ 30677
- [Repomix](https://affpapa.org/en/nevibecode/mcp/repomix.md) — MCP server · ★ 29027
- [Repowise](https://affpapa.org/en/nevibecode/mcp/repowise.md) — MCP server · ★ 7891
- [sem](https://affpapa.org/en/nevibecode/mcp/sem.md) — MCP server · ★ 3422

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md