SkillScan

SS A registry of agent skills, plugins, rules and MCP servers, each with a static security scan.

SkillScan lists Claude skills and plugins, AGENTS.md, CLAUDE.md and GEMINI.md files, the rules of Cursor, Windsurf, Cline and Grok, GitHub Copilot instructions, Gemini CLI extensions and MCP servers from the MCP registry, npm, PyPI and GitHub, with sources, licence, stars, an install hint and a heuristic scan of the text an agent would read or run. It can also scan a public GitHub repository on request.

Get a free key Live docs OpenAPI 3.1

1,000 free calls a month on each API. No card.

What it answers

Which MCP servers or skills match a search, with licence and stars?
What did the static scan find in this artifact, and at what risk level?
How do I install it, and which agent tools can use it?
What is new or changed since yesterday?
What does a scan of this public GitHub repository find right now?

What it holds now

SS-MCP MCP registry servers: loading
SS-GH GitHub agent artifacts: loading
SS-NPM npm MCP servers: loading
SS-PY PyPI MCP servers: loading

Read live from https://api.elysianintelligence.com/skillscan/status.

Example

curl "https://api.elysianintelligence.com/skillscan/v1/search?q=context7&kind=mcp-server&limit=1" \
  -H "Authorization: Bearer $EP_KEY"

{
  "results": [
    {
      "id": "102f823c1f37f3e5",
      "kind": "mcp-server",
      "name": "io.github.upstash/context7",
      "description": "Context7. Up-to-date docs for AI agents",
      "source": "mcp-registry",
      "repo": "upstash/context7",
      "claimed_repository": "upstash/context7",
      "url": "https://github.com/upstash/context7",
      "license": "MIT",
      "stars": 63325,
      "install_hint": "npx -y '@upstash/context7-mcp@4.4.4'",
      "compatible_tools": [
        "mcp"
      ]
    }
  ],
  "next_cursor": null
}

Shortened. Field names are the API's own; the values come from the MCP registry and GitHub, read on 19 Oct 2026. The io.github namespace and the repository have the same owner, so the repository is proven. Stars change daily.

Endpoints

Every route is also an MCP tool with the same input and output, at https://api.elysianintelligence.com/skillscan/mcp.

REST route	MCP tool	What it does
`GET /v1/search?q=&kind=&license=&max_risk=&min_stars=`	`search_agent_tools`	Full-text search of names and descriptions.
`GET /v1/artifact/{id}`	`get_agent_tool`	The full record with every scan finding.
`POST /v1/scan`	`scan_agent_tool`	Scan a public GitHub repository, folder or file now.
`GET /v1/changes?since=`	`agent_tool_changes`	New, updated and risk-changed artifacts.

Sources, licences and refresh

Source	Licence	Updates
Data from the official MCP registry	CC0 1.0, per the registry's terms of service	Daily at 06:15 UTC, changed entries only
npm registry search	npm Open Source Terms; package metadata as each author published it	Daily at 06:45 UTC, in rotation
PyPI JSON API and RSS feeds	PyPI Terms of Service; package metadata as each author published it	Daily at 06:45 UTC, each project weekly
GitHub REST API	GitHub Terms of Service; each repository's licence is recorded	Daily at 07:45 UTC
raw.githubusercontent.com	Each repository's own licence; we keep only the scan result and short excerpts	With the GitHub run, only when a file changed