Back to Browse

Skillproof MCP Server

Developer ToolsModerate6.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Check whether a Claude Code skill was tested and whether it works before installing it.

About

Check whether a Claude Code skill was tested and whether it works before installing it.

Security Report

6.2
Moderate6.2Moderate Risk

SkillProof MCP is a well-designed server with no critical security vulnerabilities. It fetches read-only data from a single trusted API endpoint, implements proper caching, and has minimal dependencies. The only minor concerns are the use of a customizable API endpoint via environment variable and a lack of explicit input validation on the query parameter, but these do not pose significant security risks given the server's purpose. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

3 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-skillproofdev-skillproof": {
      "args": [
        "-y",
        "skillproof-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

SkillProof MCP

Ask whether a Claude Code skill actually works — before you install it.

GitHub has tens of thousands of SKILL.md files. Almost none have been run by anyone but their author. SkillProof installs them from their repo, triggers them, and runs them on a real task against a no-skill baseline. This MCP server puts those verdicts in your agent's hands.

> is there a tested skill for converting markdown to Confluence?

## Confluence — DIDN'T PASS — scored below the no-skill baseline
What our test found: Ran the bundled convert_markdown_to_wiki.py on a real sample doc: it silently
turns **bold** text into wiki _italic_ (a genuine regex bug), and leaves standard GitHub-style tables
completely unconverted, despite SKILL.md listing "tables" among the elements it handles.

That is the whole point. A directory that only lists winners tells you nothing.

Tools

ToolWhat it answers
find_skill"Is there a tested skill for X?" — ranked matches with verdict, score, test notes, install command
check_skill"Someone recommended X — is it any good?" — the verdict for one skill by name, slug, or repo

Every answer carries one of three verdicts:

  • pass — installed, triggered, and beat the no-skill baseline on a real task.
  • setup — works, but needs a manual step first (the notes say which).
  • didn't pass — scored below the no-skill baseline: it either couldn't run, or left you worse off than not installing it.

If nothing has been tested for your job, the server says so instead of guessing. "Not tested" is a real answer.

Install

Claude Code:

claude mcp add skillproof -- npx -y skillproof-mcp

Or add it to your MCP config by hand:

{
  "mcpServers": {
    "skillproof": {
      "command": "npx",
      "args": ["-y", "skillproof-mcp"]
    }
  }
}

Works in any MCP client (Claude Code, Claude Desktop, Cursor, Windsurf, Zed). Node 18+. No API key, no account.

Where the data comes from

The server reads the live catalog at skillproof.dev/api/skills.json and caches it for 15 minutes. Nothing is bundled, so verdicts are never stale. The scoring rubric — install /5, triggering /5, output-vs-baseline /10, docs /5 — is published at skillproof.dev/methodology.

Catalog data is CC BY 4.0: use it, cite skillproof.dev.

License

MIT

Reviews

No reviews yet

Be the first to review this server!