skillssafe-mcp 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SkillsSafe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,95 @@
+# skillssafe-mcp
+
+[![npm version](https://badge.fury.io/js/skillssafe-mcp.svg)](https://www.npmjs.com/package/skillssafe-mcp)
+[![MCP Registry](https://img.shields.io/badge/MCP%20Registry-com.skillssafe%2Fscanner-blue)](https://registry.modelcontextprotocol.io)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+**MCP server for [SkillsSafe](https://skillssafe.com)** — the security layer for AI agents.
+
+Scan SKILL.md files, MCP configs, and system prompts for:
+- 🔐 Credential theft & data exfiltration
+- 💉 Prompt injection attacks
+- 👻 Zero-width character attacks
+- 🦠 ClawHavoc malware indicators
+- 🐚 Shell injection & reverse shells
+- 🔍 Scope creep & memory poisoning
+
+**Free. No API key. No signup.**
+
+## Quick Start
+
+### Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "skillssafe": {
+      "command": "npx",
+      "args": ["-y", "skillssafe-mcp"]
+    }
+  }
+}
+```
+
+### Cursor
+
+Add to `.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "skillssafe": {
+      "command": "npx",
+      "args": ["-y", "skillssafe-mcp"]
+    }
+  }
+}
+```
+
+### Direct SSE (Remote)
+
+For clients that support SSE transport:
+
+```
+https://mcp.skillssafe.com/sse
+```
+
+## Tools
+
+### `scan_skill`
+
+Scan an AI agent skill file for security threats before installation.
+
+```
+Parameters:
+  url      - URL of skill to scan (GitHub raw URL, ClawHub URL, etc.)
+  content  - Raw text content of skill to scan (alternative to url)
+  lang     - Response language: "en" | "zh" | "ja" (default: "en")
+
+Returns:
+  decision    - INSTALL / REVIEW / BLOCK
+  risk_score  - 0–100
+  threats     - List of detected threats with severity
+  scan_id     - ID for retrieving full report
+```
+
+### `get_report`
+
+Retrieve a previously generated scan report.
+
+```
+Parameters:
+  scan_id  - Scan ID returned by scan_skill
+```
+
+## Registry
+
+- **Official MCP Registry**: `com.skillssafe/scanner`
+- **Smithery**: [skillssafe](https://smithery.ai/server/skillssafe)
+- **Glama**: [skillssafe-mcp](https://glama.ai/mcp/servers/GUCCI-atlasv/skillssafe-mcp)
+
+## License
+
+MIT © SkillsSafe

package/bin/skillssafe-mcp.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+/**
+ * SkillsSafe MCP Server
+ * Proxies stdio ↔ remote SSE endpoint at mcp.skillssafe.com
+ *
+ * Usage:
+ *   npx skillssafe-mcp
+ *
+ * Config for Claude Desktop / Cursor / Codex:
+ *   { "command": "npx", "args": ["-y", "skillssafe-mcp"] }
+ */
+
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+const SSE_URL = "https://mcp.skillssafe.com/sse";
+
+async function main() {
+  // Connect to SkillsSafe remote SSE server
+  const remoteClient = new Client(
+    { name: "skillssafe-mcp-proxy", version: "1.0.0" },
+    { capabilities: {} }
+  );
+  const sseTransport = new SSEClientTransport(new URL(SSE_URL));
+  await remoteClient.connect(sseTransport);
+
+  // Get capabilities from remote
+  const remoteInfo = remoteClient.getServerVersion();
+  const remoteCapabilities = remoteClient.getServerCapabilities();
+
+  // Create local stdio server that mirrors remote capabilities
+  const server = new Server(
+    { name: "skillssafe", version: remoteInfo?.version ?? "1.0.0" },
+    { capabilities: remoteCapabilities ?? {} }
+  );
+
+  // Forward all tool calls to remote
+  server.setRequestHandler({ method: "tools/list" }, async () => {
+    return await remoteClient.listTools();
+  });
+
+  server.setRequestHandler({ method: "tools/call" }, async (request) => {
+    return await remoteClient.callTool(request.params);
+  });
+
+  // Start stdio transport
+  const stdioTransport = new StdioServerTransport();
+  await server.connect(stdioTransport);
+}
+
+main().catch((err) => {
+  process.stderr.write(`SkillsSafe MCP error: ${err.message}\n`);
+  process.exit(1);
+});

package/glama.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://glama.ai/mcp/servers/schema.json",
+  "name": "SkillsSafe Security Scanner",
+  "description": "Free AI agent skill security scanner. Scan SKILL.md files, MCP configs, and system prompts for credential theft, prompt injection, zero-width character attacks, and ClawHavoc malware indicators. No signup required.",
+  "homepage": "https://skillssafe.com",
+  "categories": ["security"],
+  "environment": []
+}

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "skillssafe-mcp",
+  "version": "1.0.0",
+  "mcpName": "com.skillssafe/scanner",
+  "description": "MCP server for SkillsSafe — AI agent skill security scanner. Detects prompt injection, credential theft, zero-width character attacks, and ClawHavoc malware. Free, no API key required.",
+  "keywords": ["mcp", "security", "ai-safety", "prompt-injection", "skill-scanner", "clawhavoc"],
+  "author": "SkillsSafe",
+  "license": "MIT",
+  "homepage": "https://skillssafe.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/GUCCI-atlasv/skillssafe-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/GUCCI-atlasv/skillssafe-mcp/issues"
+  },
+  "type": "module",
+  "bin": {
+    "skillssafe-mcp": "./bin/skillssafe-mcp.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.10.2"
+  }
+}