Skill Audit Mcp

Working · 2.2 s

io.github.eltociear/skill-audit-mcpv1.2.0

MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.

Security Web Search

Source Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://eltociear-skill-audit.hf.space/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

air_quality

Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

locationstring, required

Place name, e.g. 'Tokyo'

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (11)

air_quality

Argument	Type	Description
location*	string	Place name, e.g. 'Tokyo'

Input schema (JSON)

{
  "type": "object",
  "required": [
    "location"
  ],
  "properties": {
    "location": {
      "type": "string",
      "description": "Place name, e.g. 'Tokyo'"
    }
  }
}

audit_skill_text

Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

Argument	Type	Description
content*	string	File or snippet to scan

Input schema (JSON)

{
  "type": "object",
  "required": [
    "content"
  ],
  "properties": {
    "content": {
      "type": "string",
      "description": "File or snippet to scan"
    }
  }
}

audit_skill_url

Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

Argument	Type	Description
url*	string	Raw file URL to fetch and scan

Input schema (JSON)

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Raw file URL to fetch and scan"
    }
  }
}

country_indicator

World Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
years	integer	1-60 most recent years (default 5)
country*	string	ISO 2- or 3-letter country code
indicator	string	Alias above, or a World Bank code

Input schema (JSON)

{
  "type": "object",
  "required": [
    "country"
  ],
  "properties": {
    "years": {
      "type": "integer",
      "description": "1-60 most recent years (default 5)"
    },
    "country": {
      "type": "string",
      "description": "ISO 2- or 3-letter country code"
    },
    "indicator": {
      "type": "string",
      "description": "Alias above, or a World Bank code"
    }
  }
}

earthquakes

Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
days	integer	1-30 days back (default 1)
limit	integer	1-100 events (default 20)
location	string	Centre on a place name
radius_km	number	Radius around location (default 500)
min_magnitude	number	Lower bound (default 4.5)

Input schema (JSON)

{
  "type": "object",
  "required": [],
  "properties": {
    "days": {
      "type": "integer",
      "description": "1-30 days back (default 1)"
    },
    "limit": {
      "type": "integer",
      "description": "1-100 events (default 20)"
    },
    "location": {
      "type": "string",
      "description": "Centre on a place name"
    },
    "radius_km": {
      "type": "number",
      "description": "Radius around location (default 500)"
    },
    "min_magnitude": {
      "type": "number",
      "description": "Lower bound (default 4.5)"
    }
  }
}

elevation

Ground elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
location*	string	Place name

Input schema (JSON)

{
  "type": "object",
  "required": [
    "location"
  ],
  "properties": {
    "location": {
      "type": "string",
      "description": "Place name"
    }
  }
}

geocode

Resolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
name*	string	Place name to resolve
count	integer	1-20 candidates (default 5)

Input schema (JSON)

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Place name to resolve"
    },
    "count": {
      "type": "integer",
      "description": "1-20 candidates (default 5)"
    }
  }
}

paid_catalogue

List the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, live DEX prices, wallet intel, supply-chain scans). Payment is x402 over USDC on Base — no account or API key. Takes no arguments.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "required": [],
  "properties": {}
}

public_holidays

Public holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
year	integer	Calendar year (defaults to current)
country*	string	ISO 2-letter country code, e.g. JP

Input schema (JSON)

{
  "type": "object",
  "required": [
    "country"
  ],
  "properties": {
    "year": {
      "type": "integer",
      "description": "Calendar year (defaults to current)"
    },
    "country": {
      "type": "string",
      "description": "ISO 2-letter country code, e.g. JP"
    }
  }
}

read_url

Fetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
url*	string	Page to fetch

Input schema (JSON)

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Page to fetch"
    }
  }
}

web_search

Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)

Argument	Type	Description
query*	string	Search query
max_results	integer	1-25 (default 10)

Input schema (JSON)

{
  "type": "object",
  "required": [
    "query"
  ],
  "properties": {
    "query": {
      "type": "string",
      "description": "Search query"
    },
    "max_results": {
      "type": "integer",
      "description": "1-25 (default 10)"
    }
  }
}