ZBS Index What actually exists in applied AI, with the source next to it

mcp server

skill-audit-mcp

Scan agent skills and MCP servers for malicious patterns before you load them

Description as published by the maintainer. Source

  • version 1.1.0
  • active

active — Most recent push to the repository was 2026-08-02.

What this server can do

11 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.

air_quality(location)
Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: location.
audit_skill_text(content)
Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 60 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more. Required: content.
audit_skill_url(url)
Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 60 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more. Required: url.
country_indicator(years, country, indicator)
World Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: country.
earthquakes(days, limit, location, radius_km, min_magnitude)
Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)
elevation(location)
Ground elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: location.
geocode(name, count)
Resolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: name.
paid_catalogue
List the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, live DEX prices, wallet intel, supply-chain scans). Payment is x402 over USDC on Base — no account or API key. Takes no arguments.
public_holidays(year, country)
Public holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: country.
read_url(url)
Fetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: url.
web_search(query, max_results)
Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.) Required: query.

Last successful function declaration observed on . Source: https://eltociear-skill-audit.hf.space/mcp. We list what the server declared; we do not call any of these functions.

Endpoint status observed on . Source: https://eltociear-skill-audit.hf.space/mcp.

Signals

These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.

Signal Value What it measures Window Observed Source
GitHub stars 5 Number of GitHub accounts that bookmarked this repository since it was created. It is a bookmark count, not installs, not active users and not quality. cumulative, all time GitHub
Last commit 2026-08-02 Date of the most recent push to any branch. This is the strongest cheap indicator of whether the project is still maintained. point in time GitHub
Open issues 1 Open issues plus open pull requests, as GitHub counts them together. A high number can mean an active project or an abandoned one. as of fetch GitHub
Latest published version 1.1.0 Latest version string the maintainer published to the registry. as of fetch Model Context Protocol
Registry record last updated 2026-07-29 When the registry record was last updated by its maintainer. point in time Model Context Protocol
First listed in the MCP Registry 2026-07-29 Date this server was first published to the official MCP Registry. Not a usage or quality measure. point in time Model Context Protocol
repository status active The repository exists on GitHub and is not archived. This says nothing about how recently it was worked on. as of fetch GitHub
mcp tools declared 11 tools Number of functions the server itself declared when asked to list them. This is what the server offers an agent, not a measure of how well any of them work. as of probe eltociear-skill-audit.hf.space
mcp endpoint status ok The server listed 11 functions when asked. as of probe eltociear-skill-audit.hf.space

Where to get it

Related, by what their authors tagged them

  • Draugr — last commit 2026-08-06, shares devsecops, github-action, sarif
    Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
  • pkgxray — last commit 2026-08-06, shares ai-agent-security, devsecops, prompt-injection
    Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
  • Bomly — last commit 2026-08-03, shares devsecops, sarif, supply-chain-security
    Give your coding agent the dependency graph it is about to change: scan, diff, explain, audit
  • io.github.caglarbozkurt/heimdall — last commit 2026-07-06, shares prompt-injection, sarif, security
    Scan an MCP server or agent config for injection, exfiltration, and risky capabilities.
  • Aegis — AI Agent Governance — last commit 2026-05-05, shares ai-agent-security, prompt-injection
    Policy-based governance for AI agent tool calls. YAML policy, approval gates, audit logging.
  • Cejel — last commit 2026-08-06, shares devsecops, sarif, security
    Offline deterministic engineering-trust certificates for repositories, with no telemetry.
  • ai.marchward/mcp-server — last commit 2026-07-01, shares ai-agent-security
    Runtime authority for AI agents: credential mediation, spend cap, approval gates, audit log.
  • Grasp — Code Architecture & Dependency Analysis — last commit 2026-07-17, shares github-action, static-analysis
    Codebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab.
  • io.github.asklokesh/loki-mode — last commit 2026-08-06, shares github-action
    Autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio.
  • andon — last commit 2026-08-04, shares github-action
    Deterministic verification for AI-generated analysis: run a spec, inspect or diff a workbook

These share tags the maintainers applied themselves, such as devsecops, github-action, sarif, security. Common tags like "mcp" or "ai" are ignored for this: agreeing with six hundred other projects is not a similarity.

This is not a recommendation and not a test result. It is a map of what the authors said their work is about.

Also from eltociear

How the author describes it

Topics the maintainer set on GitHub: ai-agent-security, claude-skills, devsecops, github-action, mcp, mcp-server, prompt-injection, sarif, security, static-analysis, supply-chain-security, vulnerability-scanner.

This record as data

Every field on this page, with its source and observation date, is in the catalog JSON. Fetch the whole kind at once instead of parsing this HTML.

GET /api/v1/entries/mcp_server.json

Sources

  1. eltociear/skill-audit-mcp on GitHub — GitHub, observed , trust tier 3.
  2. Tools declared by the MCP server at https://eltociear-skill-audit.hf.space/mcp — eltociear-skill-audit.hf.space, observed , trust tier 4.
  3. Official MCP Registry — Model Context Protocol, observed , trust tier 1.