Skill and MCP security scanner

How to use the MCP security scanner

Check a Claude Code skill, plugin or MCP server before you install it. Paste a link, or drop the files, and the report shows each risk with the file, the line, the text that matched and what to do about it.

1. Paste a GitHub address (a whole repository, one folder or one file), an npmjs.com package or a pypi.org project. You can also type npm:package-name or pypi:project-name.
2. Or choose files from your computer: a SKILL.md, a plugin or project folder, or a .zip, .skill, .mcpb, npm .tgz or Python wheel. Hidden folders such as .claude and files such as .mcp.json are read too.
3. Read the score, then the list of what the package can do on your computer, then the findings, worst first.

To see what a bad result looks like, press Check a booby-trapped demo skill. It builds a fake skill in your browser with every trick the scanner knows, aimed at the reserved attacker.example domain.

What the scanner looks for

Every text file is matched against 192 rules from Aguara, an open-source scanner, plus our own checks for the parts of Claude Code that a line-by-line rule cannot read.

• Hidden instructions: text that tells Claude to ignore your request, switch roles or send data somewhere, including HTML comments and instructions fetched from a URL.
• Invisible text: zero-width characters, right-to-left tricks and Unicode tag characters. Tag characters hide whole sentences that no editor shows; the report decodes them so you can read what was hidden.
• Encoded payloads: long base64 and hex strings are decoded and checked again.
• Commands: ! commands in a skill that run the moment it is used, hooks that run on events like SessionStart, allowed-tools: Bash without limits, and settings that approve every command or turn on bypassPermissions.
• MCP servers: launch lines such as npx -y package with no version, so every start downloads whatever is newest, remote servers on plain http://, and API keys written into the config.
• Packages: npm preinstall and postinstall scripts, dependencies that point at a git address, a custom install step in setup.py, compiled programs, and archive paths that try to write outside their folder.

The report also lists the package's powers as plain facts: runs commands, starts MCP servers, reaches the internet. A useful skill often needs some of them, so check that each one matches what it claims to do.

Fewer false alarms than a plain rule list

A rule that sees "ignore previous instructions" cannot tell an attack from a page that warns about attacks. So a match inside a Markdown code block, a test, a README or minified code counts one level lower and much less in the score, and the report says where it was found. We tested the rules on 14 well-known skills and MCP servers, including Anthropic's own skills and the official MCP servers, and moved code-quality rules such as XSS checks down to low, because they say nothing about whether a package is safe to install. A critical finding outside an example still caps the score at 35.

Your files stay in your browser

The scan runs in a Web Worker on your device. The rules run on the Rust regex engine compiled to WebAssembly, which cannot hang on a hostile file. Links are fetched by your browser straight from GitHub, npm or PyPI; we do not proxy or keep anything. Keys found in a file are masked in the report, so you can paste it into an issue or a chat with Copy report, or keep it with Download PDF report.

Limits

• GitHub allows 60 lookups an hour per visitor without signing in, and one repository check uses one or two of them. If you hit the limit, download the repository as a zip and drop it here.
• From GitHub we read up to 400 files and 20 MB, manifests and instructions first. Files over 4 MB, images, fonts and lock files are listed but not read.
• Archives stop at 5,000 files or 200 MB once unpacked, and any file that grows more than 100 times its packed size is treated as a zip bomb.
• A scan finds known patterns. It cannot prove code is safe, and it does not run the code.

Related tools

Paste a token from an MCP config into the JWT decoder to see what it grants. To check the server a remote MCP address points at, run the website checker. Every tool on the site works the same way, in your browser; how PieToolkit works explains it.

Questions people ask

Is it safe to install a skill from GitHub?

A skill is instructions plus any scripts it ships, and Claude follows the instructions with your permissions. Read what it can do in the report, and be careful with anything that downloads code or reads keys.

Does a low risk score mean the skill is safe?

No. It means none of the checks found a known bad pattern. New tricks appear all the time, so read any script you do not understand.

Which MCP clients does the MCP security scanner cover?

It reads the configs of Claude Code, Claude Desktop and any client that uses the mcpServers format, such as Cursor.