Use the MCPSkills pre-install trust layer from inside Claude Code, Cursor, or any MCP client.
13 standard signals (15 in Skills Mode) across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks. Check install risk before an MCP server or AI skill reaches your agent.
claude mcp add mcpskills -- npx @mcpskillsio/serverAdd to your .cursor/mcp.json:
{
"mcpServers": {
"mcpskills": {
"command": "npx",
"args": ["@mcpskillsio/server"]
}
}
}Add to claude_desktop_config.json:
{
"mcpServers": {
"mcpskills": {
"command": "npx",
"args": ["@mcpskillsio/server"]
}
}
}Related MCP server: mcp-security-audit
check_trust_scoreScore any GitHub repo, npm package, or registry URL. Returns trust tier, composite score, and 4 dimension scores.
"Score anthropics/anthropic-sdk-typescript"scan_safetyFocused safety scan for AI skills. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads.
"Is this MCP server safe? modelcontextprotocol/servers"list_packagesBrowse curated, pre-scored skill packages organized by use case.
"Show me safe AI skill packages for full-stack development"get_badgeGenerate an SVG trust badge URL for your README.
"Get a trust badge for my repo anthropics/anthropic-sdk-typescript"watch_repoStart monitoring a repo for trust score changes (requires API key).
"Watch modelcontextprotocol/servers for score changes"check_watchedRe-scan all watched repos for score or tier changes (requires API key).
"Check my watched repos"batch_checkScore up to 5 repos in a single call (Developer Pro or Team).
"Batch check these repos: anthropics/anthropic-sdk-typescript, langchain-ai/langchainjs"auto_gateGet a boolean go/no-go decision with reasoning.
"Should I install this MCP server? 21st-dev/magic-mcp"build_stackRecommend a vetted, pre-scored stack from MCP Skills' curated packages.
"Build me a stack: auth + payments + email"Free tier returns trust tier + dimension scores (same as mcpskills.io free scans, 10/day).
For full reports (13 standard / 15 Skills Mode signals + safety findings) inside your IDE, set your API key:
export MCPSKILLS_API_KEY=your_key_hereGet your API key at mcpskills.io/api. Developer Pro is $19/mo or $149/yr. Team is $99/mo for org/security workflows.
The server calls the mcpskills.io trust scoring API, which:
Fetches repo data from GitHub API and OpenSSF Scorecard
Scores 13 standard signals across 4 dimensions (Alive, Legit, Solid, Usable)
Detects AI skills/MCP servers and activates Skills Mode (+2 bonus signals — 15 total)
Runs 5 safety scans based on ClawHavoc and ToxicSkills attack patterns
Assigns a trust tier: Verified (>=7.0), Established (>=4.5), New, or Blocked
MIT — Built by Michael Browne at Rise Above Partners.
Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Any of: "owner/repo", "npm:@scope/package", "@scope/package", Smithery URL, or OpenClaw URL |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully carries the burden. It discloses the return format '{ proceed: true/false, reason: "..." }', which is beyond simple 'returns a decision', and implies no side effects. This is sufficient for an AI agent to understand behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences that front-load the purpose with a question. Every sentence provides essential information without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description explains what it does, what input it accepts, and what output it returns. It is complete and leaves no gaps for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description merely repeats the accepted formats from the schema ('owner/repo, npm package, Smithery URL, etc.'). No additional meaning is added, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Should I install this? Returns a simple go/no-go decision with reasoning.' It uses a specific verb ('decide') and resource ('install decision'), and differentiates from sibling tools like 'check_trust_score' by focusing on a yes/no install verdict.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states input formats ('owner/repo, npm package, Smithery URL, etc.'), making it clear when to use the tool. However, it does not mention when not to use it or suggest alternatives like 'batch_check' for multiple items.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Developer Pro or Team API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).
| Name | Required | Description | Default |
|---|---|---|---|
| repos | Yes | Array of repos/packages in any format (max 5). E.g., ["owner/repo", "npm:@scope/pkg", "https://smithery.ai/server/name"] |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations; description discloses the output (trust assessment for each input) and preconditions (API key), but does not explicitly state read-only behavior or other side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no fluff, front-loaded with key info. Every sentence adds necessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers purpose, input, output, and requirements. Lacks only details on trust assessment interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for 'repos'. The description adds value by clarifying max 5 items and providing example formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool checks up to 5 repos or packages and returns trust assessments, distinguishing it from siblings like check_trust_score which likely handles single items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Specifies when to use (batch checks), the required API key tier, and acceptable input formats. Does not explicitly mention when not to use, but context implies alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recommend a vetted stack of trusted tools for a described task. Describe what you're building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.
| Name | Required | Description | Default |
|---|---|---|---|
| description | Yes | What the user wants to build or accomplish. Can be a full sentence ("I need a Next.js app with auth and Stripe") or just keywords ("auth payments database mcp") |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so description carries full burden. It discloses that the tool returns 'tool names, trust scores, tiers, and install hints' and is based on 'live trust data'. It implies read-only behavior but does not explicitly state non-destructiveness or required permissions. Adequate but could be more explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: it states the purpose, how to use, what is returned, and the benefit—all in a few sentences without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With one parameter, no output schema, and no annotations, the description is relatively complete. It tells what input to provide, what output to expect, and the value. It does not cover constraints like rate limits or auth, but for a recommendation tool, it is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'description' has a schema description and the main text adds examples and elaboration (e.g., 'Can be a full sentence or just keywords'). Schema coverage is 100%, so baseline is 3; the extra context pushes it to 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool recommends a vetted stack of trusted tools for a described task. It specifies the action ('recommend'), the resource ('vetted stack'), and the input (task description), distinguishing it from sibling tools that check individual packages or trust scores.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this instead of guessing which tools to recommend' and implies when to use it. It contrasts with other tools by saying 'every suggestion is backed by live trust data', but does not explicitly name alternative tools or exclusions. Context is clear given sibling tools focus on individual checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Any of: "owner/repo", GitHub URL, "npm:@scope/package", "@scope/package", Smithery URL, or OpenClaw URL |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses output format (0-10 score across 4 dimensions) and enhanced safety scanning for AI skills. However, it lacks details on rate limits, authentication requirements, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise, front-loading the purpose and then providing details on inputs and special cases. No wasted sentences, though a slightly more structured format could improve scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 param, no output schema, no annotations), the description covers inputs, output, and an additional condition (enhanced scanning for AI skills). It is sufficiently complete for an agent to understand usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter with 100% schema coverage. The description and schema both list accepted input formats; description adds minor variations like 'npm:@scope/name' but generally repeats schema info. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool scores trustworthiness for AI skills, MCP servers, or GitHub repos, returning a score across 4 dimensions. It lists accepted input types, but does not explicitly distinguish from sibling tools like 'scan_safety' or 'list_packages'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use: to check trustworthiness of various resources. Mentions enhanced scanning for AI skills and notes the need for an API key for full reports. However, it does not specify when not to use or compare with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Re-scan all watched repos and check for score changes. Returns any repos whose trust score changed significantly since last check.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | Email address used when watching repos |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It clearly states the tool re-scans all watched repos and returns those with significant changes, providing the core behavior. However, it lacks details on auth requirements, rate limits, or definition of 'significant change'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. Efficiently conveys the action, scope, and return value. Every sentence is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description is largely complete. It explains what the tool does and what it returns. Minor gaps: no definition of 'significant change', and no mention that repos must be previously watched. But overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (one parameter described). The description adds context that the email is the one used when watching repos, which clarifies the parameter's purpose beyond the schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Re-scan') and resource ('all watched repos'), and specifies the outcome ('check for score changes' and returns repos with significant changes). This distinguishes it from siblings like check_trust_score (single repo) and watch_repo (adding repos).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. While the action implies a batch check, there is no guidance on scenarios or exclusions. The usage is implied from sibling names but not articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Any of: "owner/repo", GitHub URL, "npm:@scope/package", or Smithery URL |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that it returns an SVG badge and auto-updates hourly, but does not specify error handling or required permissions. For a simple read-only operation, this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. Every sentence provides essential information: action, output, usage, and behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description covers purpose, return value, usage context, and update frequency. It is fully complete given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, so baseline is 3. The description adds value by explaining the accepted formats for the 'repo' parameter (owner/repo, GitHub URL, etc.), which exceeds the schema's description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Get a trust badge URL for any repo or package' and specifies it returns an SVG badge with trust score and tier. It distinguishes from siblings like check_trust_score and scan_safety by focusing on badge generation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It mentions embedding in READMEs and auto-update behavior, which helps context. However, it does not explicitly state when to use this tool versus alternatives like check_trust_score, though the purpose is distinct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Browse curated, pre-scored AI skill packages organized by use case. Each package contains vetted skills with trust scores. Available packages: Claude Power User, Full-Stack Vibe Coder, Data & Research, DevOps & Infrastructure, Content & Marketing.
| Name | Required | Description | Default |
|---|---|---|---|
| package_name | No | Optional: filter by package name (e.g., "claude-power-user"). Omit to list all packages. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It describes the basic function and lists available packages but does not disclose details like pagination, error handling, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff, front-loaded with the tool's purpose, and includes useful examples without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and a single optional parameter, the description adequately explains what the tool does and lists available packages. Could mention return structure but not necessary for simple list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and parameter has a clear description. The description adds example package names but does not significantly enhance understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool browses curated AI skill packages, lists available packages with examples, and distinguishes from siblings by specifying its focus on package browsing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for browsing packages but does not provide explicit guidance on when to use this tool versus siblings like check_trust_score or get_badge.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Any of: "owner/repo", GitHub URL, "npm:@scope/package", Smithery URL, or OpenClaw URL |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description lists the checks performed and input flexibility, which is helpful. However, it omits details about output format, error handling, authentication needs, or any destructive actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with action verb and resource. Every phrase adds value; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with no output schema, the description covers essential behavior and checks. Minor gap: no mention of return value, but acceptable given lack of output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a detailed description. The tool description repeats the input formats but adds no new meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a focused safety scan, specifies exact checks (prompt injection, shell execution, etc.), and lists supported input formats. It distinguishes itself from generic scanning tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings like batch_check or check_trust_score. The description does not mention alternative scenarios or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Any of: "owner/repo", GitHub URL, "npm:@scope/package", or Smithery URL | |
| Yes | Email address for alerts |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It reveals that monitoring is ongoing and alerts are sent on significant changes. It also notes the requirement for a paid API key. Missing details like how to stop monitoring or confirmation behavior, but core behavior is covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences: first states the core action, second adds important detail (alert condition) and a requirement. No redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the main purpose and prerequisites but lacks details on post-monitoring behavior (e.g., confirmation, how to manage watches). Without an output schema, the agent might wonder what the tool returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
100% schema coverage means parameters are well-documented in the schema. The description adds no extra meaning beyond the schema's parameter descriptions, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: start monitoring a repo/package for trust score changes. It specifies the alert threshold (±0.3 or tier change), making it distinct from one-time checks like check_trust_score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use (to get alerts on score changes) and mentions a prerequisite (paid API key). However, it does not explicitly explain when not to use it or list alternatives like check_trust_score for single checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v2.5.2auto_gatebatch_checkbuild_stackcheck_trust_scorecheck_watchedget_badgelist_packagesscan_safetywatch_repoEach tool has a clearly distinct purpose: auto_gate gives a simple go/no-go decision, check_trust_score provides detailed scoring, batch_check handles multiples, scan_safety focuses on safety, list_packages curates packages, build_stack recommends stacks, get_badge generates badges, check_watched and watch_repo monitor changes. No two tools have overlapping functionality that would cause confusion.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., auto_gate, batch_check, check_trust_score, watch_repo). The naming is predictable and easy to parse, with no mixing of conventions.
With 9 tools, the set is well-scoped for a trust and safety assessment server. Each tool serves a necessary function without being redundant or excessive, fitting comfortably within the ideal 3-15 range.
The tool surface covers the full lifecycle of trust assessment: single and batch scoring, safety scanning, recommendation (build_stack), curated packages (list_packages), monitoring (watch_repo, check_watched), and a badge output (get_badge). There are no obvious gaps for the stated purpose.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/BeBraveBeKind/mcpskills-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
