SkillTotal

Scan an AI component before you trust it

Supply-chain risk, dangerous capabilities, prompt-injection and exfiltration surfaces — derived only from the component itself. Free, no account.

Try:
Scan your whole MCP setupGot many servers? Paste your config — every server at once.Scan a skill or projectUpload a ZIP — an agent skill folder or any project. Nothing stored.
Open-sourceNo accountSARIF export
A real report, from the catalogOpen it →
@modelcontextprotocol/server-filesystem@2026.8.31LOW
No malicious indicators - review capabilities before installing
  • filesystem readdist/lib.js:149
    return await fs.readFile(filePath, encoding);
  • filesystem writedist/lib.js:155
    await fs.writeFile(filePath, content, { encoding: "utf-8", flag: 'wx' }…
  • install time executionpackage.json:23
    "prepare": "npm run build",
Or read the whole MCP registry, scanned →

How it works

1

Submit a component

Paste a public git URL (GitHub/GitLab/Bitbucket/Hugging Face) or an npm:/pypi: package — an MCP server, agent skill/plugin, model repo, or package.

2

We analyze the component itself

Deterministic static analysis — no execution, no LLM: capabilities, dangerous APIs, prompt-injection and exfiltration surfaces.

3

Get an evidence-backed report

A risk score and every finding anchored to file, line and snippet — export as JSON or SARIF.

What you get

Free

Always free

The full static report — no account needed.

  • Risk score (0–100) and level
  • All capabilities the component exposes
  • Behavioral trait fingerprint — mapped to CSA / MAESTRO / MITRE ATLAS
  • Every finding with file:line evidence
  • JSON and SARIF export

Deep Analysis

Coming soon

Server-side analysis that explains why a finding matters.

  • LLM verification of each finding
  • Exploitability & impact analysis
  • Dynamic behavior analysis in our isolated sandbox
  • Tailored remediation guidance
  • History & monitoring

100% open source (Apache-2.0). Run the engine locally and your code never leaves your machine — no account, no token, no LLM key. Scans on this site run on our servers, never executing your code; public reports are cached and shared.

GitHubPyPIDetection benchmarkpipx install skilltotal