vet-skills 0.7.0 → 0.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +69 -1
  2. package/dist/index.js +1 -1
  3. package/package.json +12 -8
package/README.md CHANGED
@@ -10,6 +10,72 @@ vet-skills check <skill> # or just ask before you add one
10
10
  vet-skills publish ./my-skill # org members: detonate + list in the private registry
11
11
  ```
12
12
 
13
+ ## Use it as an MCP server
14
+
15
+ Give any agent the verdicts directly, so it checks a skill or MCP server before
16
+ installing it and can pick a verified alternative. Read-only, no account, no API key.
17
+ Tools: `check_skill` (verdict, score, what the sandbox saw, top findings, last safe
18
+ version) and `search_skills` (the index by keyword, with verdicts).
19
+
20
+ **Claude Code**
21
+
22
+ ```
23
+ claude mcp add killerskills -- npx -y vet-skills mcp
24
+ ```
25
+
26
+ **Cursor**: `~/.cursor/mcp.json` (or `.cursor/mcp.json` in a project)
27
+
28
+ ```json
29
+ {
30
+ "mcpServers": {
31
+ "killerskills": { "command": "npx", "args": ["-y", "vet-skills", "mcp"] }
32
+ }
33
+ }
34
+ ```
35
+
36
+ **Claude Desktop**: Settings → Developer → Edit Config (`claude_desktop_config.json`)
37
+
38
+ ```json
39
+ {
40
+ "mcpServers": {
41
+ "killerskills": { "command": "npx", "args": ["-y", "vet-skills", "mcp"] }
42
+ }
43
+ }
44
+ ```
45
+
46
+ **VS Code**: `.vscode/mcp.json`
47
+
48
+ ```json
49
+ {
50
+ "servers": {
51
+ "killerskills": { "type": "stdio", "command": "npx", "args": ["-y", "vet-skills", "mcp"] }
52
+ }
53
+ }
54
+ ```
55
+
56
+ **Windsurf**: `~/.codeium/windsurf/mcp_config.json`, same `mcpServers` block as Cursor.
57
+ **Codex**: `~/.codex/config.toml`
58
+
59
+ ```toml
60
+ [mcp_servers.killerskills]
61
+ command = "npx"
62
+ args = ["-y", "vet-skills", "mcp"]
63
+ ```
64
+
65
+ Then ask your agent: *"Before you add that MCP server, check it with KillerSkills."*
66
+ Requires Node 20+. Index: 16,000+ skills and MCP servers from skills.sh, ClawHub,
67
+ npm, PyPI, the Docker MCP Catalog and Claude Code plugin marketplaces, each run in a
68
+ honeypot sandbox. Browse them at [killerskills.ai](https://killerskills.ai/?utm_source=npm&utm_medium=readme&utm_campaign=cli).
69
+
70
+ ## See what is already configured
71
+
72
+ ```
73
+ vet-skills discover # every MCP server, skill, plugin and hook on this machine, with verdicts
74
+ ```
75
+
76
+ Reads Claude Code, Cursor, Windsurf, Claude Desktop, Gemini CLI and Codex configs
77
+ locally. Only names leave the machine, and only when you are enrolled in an org.
78
+
13
79
  ## What it does
14
80
 
15
81
  Every `skills add`, `claude plugin install`, and `claude mcp add` is resolved to
@@ -18,7 +84,7 @@ an artifact hash, looked up, and evaluated against your policy before it runs:
18
84
  ```
19
85
  $ vet-skills check deploy-helper
20
86
  Resolving deploy-helper …
21
- vet-skills 0.1.0 · policy acme/default-strict
87
+ vet-skills 0.7.2 · policy acme/default-strict
22
88
 
23
89
  BLOCKED 14/100 deploy-helper@2.3.1 · devtools-cloud · 4,210 installs
24
90
 
@@ -68,6 +134,8 @@ prompts, environment variables, or file contents. `vet-skills leave` reverts.
68
134
  | `policy show` / `policy set <file>` | Personal policy. |
69
135
  | `block <skill> [--reason]` | Personal block list. |
70
136
  | `status` | Org, policy version, cache, pending approvals; syncs policy. |
137
+ | `discover [--project] [--json]` | Inventory agent config on this machine; report names to the org when enrolled. |
138
+ | `mcp` | Run as an MCP server over stdio (`check_skill`, `search_skills`). |
71
139
  | `hook install claude-code` | Registers the PreToolUse hook in `~/.claude/settings.json`. |
72
140
  | `hook eval` | Called by the agent; reads hook JSON on stdin. |
73
141
 
package/dist/index.js CHANGED
@@ -7910,7 +7910,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync, chm
7910
7910
  import { homedir } from "node:os";
7911
7911
  import { join } from "node:path";
7912
7912
  import { randomUUID } from "node:crypto";
7913
- var VERSION = "0.7.0";
7913
+ var VERSION = "0.7.2";
7914
7914
  var HOME = process.env.VET_SKILLS_HOME ?? join(homedir(), ".vet-skills");
7915
7915
  var API = (process.env.KILLERSKILLS_API ?? "https://killerskills.ai").replace(/\/$/, "");
7916
7916
  var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
package/package.json CHANGED
@@ -1,7 +1,8 @@
1
1
  {
2
2
  "name": "vet-skills",
3
- "version": "0.7.0",
4
- "description": "Vet agent skills and MCP servers before they run. Verdicts from KillerSkills, policy from your org.",
3
+ "version": "0.7.2",
4
+ "mcpName": "io.github.cyligence-karim/killerskills",
5
+ "description": "Vet agent skills and MCP servers before they run, and give your agent the verdicts as an MCP server. Verdicts from KillerSkills, policy from your org.",
5
6
  "type": "module",
6
7
  "bin": {
7
8
  "vet-skills": "./dist/index.js"
@@ -33,19 +34,22 @@
33
34
  "homepage": "https://killerskills.ai/docs/cli",
34
35
  "repository": {
35
36
  "type": "git",
36
- "url": "git+https://github.com/cyligence-karim/killerskills.git",
37
- "directory": "packages/cli"
37
+ "url": "git+https://github.com/cyligence-karim/vet-skills.git"
38
38
  },
39
39
  "bugs": {
40
- "url": "https://github.com/cyligence-karim/killerskills/issues"
40
+ "url": "https://github.com/cyligence-karim/vet-skills/issues"
41
41
  },
42
42
  "keywords": [
43
43
  "agent-skills",
44
- "mcp",
44
+ "ai-security",
45
45
  "claude-code",
46
+ "cursor",
47
+ "mcp",
48
+ "mcp-server",
49
+ "modelcontextprotocol",
46
50
  "security",
47
- "supply-chain",
48
- "skills"
51
+ "skills",
52
+ "supply-chain"
49
53
  ],
50
54
  "publishConfig": {
51
55
  "access": "public"