Skip to content
Agentmart
Submit a tool

SkillTotal

Deterministic security scan of MCP servers, agent skills and npm/PyPI packages.

Connector by skilltotal.aiOfficial · Domain verified by the MCP Registry

IndexedApache-2.0Local (stdio)★ 15
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/skilltotal-ai-skilltotal

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.

Use cases: security-scanning

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Runs code on install

Its package runs an install script (such as npm postinstall or setup.py code) as soon as you install it, before any tool is called. Read the script first.

Tools
3 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
Runs code on install
Runs as
Python package

Tools by what they do 3

Read from the source code; the running server may list different tools.

Read 3 · Look things up without changing anything.

  • diff_components
  • list_rules
  • scan_component

Files it touches

  • Any path the agent passes to its tools

Tools (3)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • diff_components

    Compare two versions of a component and report what changed. Use for upgrade reviews (is the new version riskier than the one already vetted?). Both sides accept the same sources as scan_component. The default summary gives each side's verdict, the verdict change, the risk-score delta, new and removed risk findings (in scan_component's why shape) and capability changes; detail="full" returns the complete diff with every new/resolved/changed finding. Decide on the verdict (level, headline, has_malicious_indicators), not on the number of findings: a finding whose threat_class is "capability" is …

  • list_rules

    List SkillTotal detection rules: id, severity, category, title, threat class and capability. Use it to look up a rule id from a scan_component or diff_components result, or to see what SkillTotal checks before scanning. It reads the rule list bundled with this engine: offline, instant, no side effects. With no arguments it returns every rule. ids and query narrow the list and combine (a rule must match both); no match returns an empty array []. Pass verbose=true for each rule's description and recommendation.

  • scan_component

    Statically scan an AI component (agent skill, MCP server, npm/PyPI package, repository, local path or archive) for supply-chain risks, dangerous capabilities, prompt-injection surfaces, and exfiltration paths. Use this BEFORE installing or trusting a component. The scan is local, deterministic, and never executes the component's code. A local path is read in place; a git URL or npm:/pypi: source is downloaded to a temp folder that is removed afterwards. A source over the size limit is refused with an error naming the setting that raises it. Decide on the verdict (level, headline, has_malicious…

Compare and alternatives

    Featured in

    Signals

    Stars
    15
    Forks
    0
    Open issues
    0
    Weekly downloads
    1,670
    Last commit
    Oct 23, 2026 (6 days ago)
    Last release
    Oct 23, 2026 (6 days ago)
    Last package publish
    Oct 23, 2026 (6 days ago)

    From GitHub (fetched Oct 24, 2026) and the package registry.

    Details

    Registry name
    ai.skilltotal/skilltotal
    Version
    0.81.0
    Auth
    No auth
    Packages
    pypi skilltotal
    License
    Apache-2.0
    Repository
    github.com/pezhik/skilltotal
    Website
    www.skilltotal.ai
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql
    Cite this page

    SkillTotal MCP server. Agent Mart. https://agentmart.dev/connectors/skilltotal-ai-skilltotal (last updated 2026-10-24)