@mcpskillsio/server 2.4.0 → 2.4.2

package/README.md

@@ -2,7 +2,7 @@
 
 Trust-score any AI skill or MCP server from inside Claude Code, Cursor, or any MCP client.
 
-14 signals across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks.
+13 standard signals (15 in Skills Mode) across 4 dimensions with safety scanning for prompt injection, credential theft, and supply chain attacks.
 
 ## Install
 
@@ -100,11 +100,19 @@ Get a boolean go/no-go decision with reasoning.
 "Should I install this MCP server? 21st-dev/magic-mcp"
 ```
 
+### `build_stack`
+
+Recommend a vetted, pre-scored stack from MCP Skills' curated packages.
+
+```
+"Build me a stack: auth + payments + email"
+```
+
 ## Full Reports
 
 Free tier returns trust tier + dimension scores (same as mcpskills.io free scans).
 
-For full 14-signal reports with detailed safety findings inside your IDE, set your API key:
+For full reports (13 standard / 15 Skills Mode signals + safety findings) inside your IDE, set your API key:
 
 ```bash
 export MCPSKILLS_API_KEY=your_key_here
@@ -117,8 +125,8 @@ Get your API key at [mcpskills.io/api](https://mcpskills.io/api).
 The server calls the mcpskills.io trust scoring API, which:
 
 1. Fetches repo data from GitHub API and OpenSSF Scorecard
-2. Scores 14 signals across 4 dimensions (Alive, Legit, Solid, Usable)
-3. Detects AI skills/MCP servers and activates Skills Mode (+2 bonus signals)
+2. Scores 13 standard signals across 4 dimensions (Alive, Legit, Solid, Usable)
+3. Detects AI skills/MCP servers and activates Skills Mode (+2 bonus signals — 15 total)
 4. Runs 5 safety scans based on ClawHavoc and ToxicSkills attack patterns
 5. Assigns a trust tier: Verified (>=7.0), Established (>=4.5), New, or Blocked
 

package/index.js

@@ -225,7 +225,7 @@ function formatAgentResponse(data) {
     lines.push('🏅 Certified Safe by MCP Skills');
   }
 
-  lines.push('', 'Set MCPSKILLS_API_KEY for full 14-signal breakdown.');
+  lines.push('', 'Set MCPSKILLS_API_KEY for the full signal breakdown (13 standard / 15 Skills Mode).');
 
   return lines.join('\n');
 }
@@ -396,7 +396,7 @@ function formatSafetyResult(data) {
 const server = new Server(
   {
     name: "mcpskills",
-    version: "2.4.0",
+    version: "2.4.2",
   },
   {
     capabilities: {
@@ -428,7 +428,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "scan_safety",
         description:
-          "Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads. Accepts any input format (owner/repo, npm package, Smithery URL, etc.).",
+          "Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, obfuscated payloads, public network binding (0.0.0.0), and risky npm lifecycle scripts (preinstall/install/postinstall). Accepts any input format (owner/repo, npm package, Smithery URL, etc.).",
         inputSchema: {
           type: "object",
           properties: {
@@ -1071,7 +1071,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           lines.push(`Full signal breakdown available for each tool via check_trust_score.`);
         } else {
           lines.push(`---`);
-          lines.push(`Set MCPSKILLS_API_KEY for full 14-signal reports on each tool.`);
+          lines.push(`Set MCPSKILLS_API_KEY for full reports on each tool (13 standard / 15 Skills Mode).`);
           lines.push(`Get a key at https://mcpskills.io`);
         }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpskillsio/server",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Trust-score any AI skill or MCP server from inside Claude Code, Cursor, or any MCP client. Accepts GitHub repos, npm packages, Smithery URLs, and OpenClaw skills. 15 signals (incl. OSV/KEV/EPSS vulnerability intelligence), safety scanning, OpenClaw frontmatter parsing + transparency scoring, recommendations, badges, monitoring, batch checking, auto-gate decisions, and stack building from live trust data.",
   "type": "module",
   "main": "index.js",