Agent Skill Audit
Login

MCP Server

Integrate Agent Skill Audit directly into your autonomous agents.

Configuration

The MCP server runs locally from this repository. Clone it, install dependencies (uv sync or pip install -r requirements.txt), then point your agent at it. Provide your API key via the SKILL_AUDIT_API_KEY environment variable, and set SKILL_AUDIT_API_URL to the audit service.

{
  "mcpServers": {
    "ai-skill-audit": {
      "command": "python",
      "args": ["-m", "mcp_server.server"],
      "env": {
        "SKILL_AUDIT_API_KEY": "sk_live_...",
        "SKILL_AUDIT_API_URL": "https://www.agentskillaudit.ai"
      }
    }
  }
}

Run the command from the repository root (or set the MCP client's working directory to it) so mcp_server.server resolves. A published npx package is coming soon.

Available Tools

audit_skill

Security-audits a GitHub repo or skill text before installing. Returns a structured decision with findings.

  • source: URL or raw markdown text
  • is_text: boolean — set true when source is raw skill markdown rather than a URL
  • force: boolean — bypass the cache and run a fresh audit
  • is_public: boolean — whether the result is shared in the public directory (default true; raw text defaults to private)
  • output_format: "json" (full result) or "toon" — a compact, agent-friendly structured format with the verdict and a findings table

Returns the verdict (allow / warn / block / human_review), grade, and the list of findings.

check_skill_url

Instant pre-flight lookup: returns a cached verdict for a known URL without spending a credit or triggering a fresh scan. Call this first; only call audit_skill if the result is unknown.