SkillTotal MCP server

by skilltotal.ai·ai.skilltotal/skilltotal·v0.49.0

Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.

B75/100grade B

What users say

No reviews yet

Safety scan

B75/100

Adoption

Growing

3 stars1.4k downloads/wk

Reviews

Nobody has reviewed SkillTotal yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

_ensure_agent_facing
run_commandwrite action
Return the dangerous-capability categories a tool name/description matches.

scanner v0.1.9 · 2026-09-19 · same rubric, same numbers if you re-run it

2 medium

Code scan50 source files scanned15/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10

mediumeval / new Function usedexec.eval

skilltotal-0.49.0/skilltotal/engine.py: … False # A string a sink executes (`new Function("…")`, `exec("…")`) is code for every ru…

mediumsubprocess with shell=Trueexec.shell-true

skilltotal-0.49.0/skilltotal/scanners/python_ast.py: … "derived from untrusted input; avoid shell=True." ), capability…

Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

2026-09-19restoreC → Bscore 75: eval / new Function used; subprocess with shell=True
2026-09-19restoreD → Cscore 57: Base64 decoded then executed; eval / new Function used; subprocess with shell=True

claude mcp add skilltotal -- uvx skilltotal

Is SkillTotal MCP server safe?: Mostly: it is graded B (75/100). Read the SkillTotal safety report
How do I install SkillTotal?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does SkillTotal need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is SkillTotal maintained?: The last commit was in the last day (2026-09-19). The latest release is v0.49.0.
What can I use instead of SkillTotal?: Servers from other publishers that do the same job: Skillsmith MCP server, mcpm MCP server and Claude Real Video MCP server. Compare all SkillTotal alternatives.

Same job from other publishers: the closest match first, then the best rated.

Skillsmith
Share agent skills across your team, scan them for risk, and track what's actually used.
not reviewed
Established
B
mcpm
MCP security guard + package manager: trust-scored installs, blocks prompt injection and rug-pulls.
not reviewed
Growing
B
Claude Real Video
Let any LLM watch a video locally — and search everything it has ever watched.
not reviewed
Established
A
IWE
Markdown knowledge base as agent memory. Runs against the notes directory it is started in.
not reviewed
Established
A
Orcareplay
Read, replay and fork recorded coding-agent runs.
not reviewed
Established
A