Skip to content
Agentmart
Submit a tool

Skill Audit MCP

MCP server: static security scanner for MCP servers, agent skills & plugins.

Connector by eltociear · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)Remote (HTTP)★ 5
Write a review

Install

Works with Claude Code, VS Code, Codex, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/eltociear-skill-audit-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://eltociear-skill-audit.hf.space/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
6 read · 0 write · 0 delete · 5 not yet classified
Secrets
None asked for
Install scripts
None found
Runs as
Docker image

Tools by what they do 11

From the running server's own tool list (tools/list) on Oct 25, 2026.

Read 6 · Look things up without changing anything.

  • audit_skill_text
  • audit_skill_url
  • geocode
  • paid_catalogue
  • read_url
  • web_search

Not yet classified 5 · We could not tell from the name and description.

  • air_quality
  • country_indicator
  • earthquakes
  • elevation
  • public_holidays

Network hosts it talks to 5

  • eltociear-skill-audit.hf.space · found in remote endpoint, install command, code
  • eltociear.github.io · found in code
  • github.com · found in code
  • glama.ai · found in code
  • raw.githubusercontent.com · found in code

Files it touches

  • Your home directory (~)
  • Any path the agent passes to its tools

Tools (11)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • air_quality

    Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • audit_skill_text

    Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

  • audit_skill_url

    Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

  • country_indicator

    World Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • earthquakes

    Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • elevation

    Ground elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • geocode

    Resolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • paid_catalogue

    List the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, live DEX prices, wallet intel, supply-chain scans). Payment is x402 over USDC on Base — no account or API key. Takes no arguments.

  • public_holidays

    Public holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • read_url

    Fetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

  • web_search

    Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Signals

Stars
5
Forks
2
Open issues
3
Last commit
Sep 30, 2026 (28 days ago)
Last release
Sep 30, 2026 (28 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name
io.github.eltociear/skill-audit-mcp
Version
1.2.0
Auth
Auth not stated
Packages
oci ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0
License
MIT
First seen
Oct 24, 2026
Last checked
Oct 24, 2026

More from eltociear

Cite this page

Skill Audit MCP. Agent Mart. https://agentmart.dev/connectors/eltociear-skill-audit-mcp (last updated 2026-10-24)