Skilltotal MCP server
{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}{
"servers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal"
]
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall uvx skilltotalversion 0.51.0
What it does
SkillTotal is a static analysis tool that scans MCP servers, agent skills, and npm/PyPI packages for security risks including supply-chain vulnerabilities, dangerous capabilities, and prompt-injection surfaces. It runs entirely locally without uploading code, making it suitable for developers evaluating untrusted components before installation.
- Scan an MCP server or agent plugin from a git repository or local path to identify exposed capabilities, network access, and shell execution before integrating it into an application.
- Audit npm or PyPI package dependencies by scanning their source code for evidence of credential hardcoding, data exfiltration paths, or suspicious behaviors mapped to MITRE ATLAS tactics.
- Evaluate AI-generated projects or downloaded archives for supply-chain risks and prompt-injection surfaces before running them in your environment.
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.