Skill Total MCP Server

AI Component Security Platform - open-source CLI engine. SkillTotal statically analyzes AI-related components - agent skills/plugins, MCP servers, npm / Python packages, repositories, and AI-generated projects you upload as an archive or file - to surface supply-chain risks, dangerous capabilities, prompt-injection surfaces, and data-exfiltration paths before the component is installed or trusted. Point it at a…

People who work with ai security, devsecops and prompt injection and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-09-18 · ★ 2 · #36 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

Apache-2.0 · Python servers · how we verify → /methodology

01 · Install Skill Total

before you install - you'll need

The README does not document required environment variables for a basic install.

Claude Code

claude mcp add pezhik-skilltotal -- uvx skilltotal

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "pezhik-skilltotal": {
      "command": "uvx",
      "args": [
        "skilltotal"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

pypi package skilltotal - check the name against the project README before installing (PyPI has no namespace ownership)

registry vendor namespace ai.skilltotal - domain-verified with the official MCP registry

03 · What Skill Total can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.48.3 · 2026-09-17

Fixed · The high tier of the registry survey, read by hand (ruleset 58). Five shapes still read as · a command printed through several arguments (printf "%s" "$C" "curl … | bash"), a · PowerShell # comment, a sentence…

v0.48.2 · 2026-09-17

Fixed · A command printed for a person is not a command the line runs (ruleset 57). An installer that · prints curl … | sh or powershell -c "irm … | iex" as a hint (echo, Write-Host, print, · console.log) scored as…

v0.48.1 · 2026-09-16

Fixed · Parsing a URL is not network egress (ruleset 56). urllib.parse and urllib.error counted · as an HTTP client, so a component that only splits URLs read as "can reach the network" and could · supply the egress…

04 · Who maintains Skill Total

SkillTotal is maintained by pezhik. It's the only MCP server we track from this author; the repo dates to Jun 2026.

05 · Facts

repository: github.com/pezhik/skilltotal
website: https://www.skilltotal.ai/
category: security - ranked #36 of 204 actively-maintained security servers as of 2026-09-18.
release cadence: 10+ releases in the last 90 days (latest 2026-09-17)
registry: ai.skilltotal/skilltotal (active, first published 2026-08-19 · 14 versions)
packages: pypi:skilltotal

06 · Skill Total FAQ

What is Skill Total?

Is Skill Total still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-18 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

How do I install Skill Total?

Run `uvx skilltotal`. The README does not document required environment variables for a basic install. You can also paste the ready-made client config above.

Does Skill Total run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Skill Total

Alternatives to Skill Total

Maintained security servers if Skill Total isn't the fit.

Pairs well with

Servers that cover what Skill Total doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Commit - Supply Chain Risk Scoring · Imf Portwatch · SSH · Promptrejectormcp · Royal MCP

More Python MCP servers · CallRail MCP · Palinode · Fabricator Panel MCP · Anneal Memory · Bolor Brain MCP · see all