Scan an AI component before you trust it

Supply-chain risk, dangerous capabilities, prompt-injection and exfiltration surfaces — derived only from the component itself. Free, no account.

Open-sourceNo account15,341 registry components scanned23,300+ PyPI and npm downloadsSARIF export

Using Claude Code? Check packages before the agent installs them.Get the Claude Code plugin →

Scan your whole MCP setupGot many servers? Paste your config — every server at once.Scan a skill or projectUpload a ZIP — an agent skill folder or any project. Nothing stored.

What makes this scanner different

Deterministic. Same component, same engine version, same findings. Anyone can reproduce the published benchmark from a release tag.
No LLM in the loop. Detection is static analysis of the component's files. There is no model for hidden text to persuade, so a component cannot talk its own verdict down.
Reads files to the end. Every text file up to 2 MiB is read whole. Blank lines added to push a payload past a scanner's cut-off keep it in scope here.
Names what it could not read. A file over 2 MiB, a minified bundle, code in a language not analyzed for behavior, or bytecode shipped without its source is listed as not analyzed in the report and in the CI log. It is never counted as clean. What we catch, and what we do not.
Runs before the install. The Claude Code plugin checks a package before the agent's install command runs; the GitHub Action fails the pull request at the risk level you set. You do not wait for a marketplace to scan it.
The CLI runs offline. No account, no telemetry. Scans started on this site run on our servers, on the same engine that is on GitHub under Apache-2.0.

What a report looks like

Engine output for an MCP server from the catalog, with the file and line behind each capability.

A real report, from the catalogOpen it →

@modelcontextprotocol/server-filesystem@2.0.1LOW

No malicious indicators - review capabilities before installing

filesystem readdist/lib.js:202
return await fs.readFile(filePath, encoding);
filesystem writedist/pinned-directory.js:28
return new Promise((resolve, reject) => fs.writeFile(fd, content, "utf-…
install time executionpackage.json:26
"prepare": "npm run build",

Browse the MCP registry survey: 15,341 of 17,535 components scanned →

Mapped to the frameworks you already report against

Findings carry an OWASP class where one applies. Behavior traits carry CSA and MAESTRO references, plus ATLAS where it fits. AST06–AST10 need runtime observation, so a static scan doesn't claim them.

See the full mapping →

How it works

Submit a component

Paste a public git URL (GitHub/GitLab/Bitbucket/Hugging Face) or an npm:/pypi: package — an MCP server, agent skill/plugin, model repo, or package.

We analyze the component itself

Deterministic static analysis — no execution, no LLM: capabilities, dangerous APIs, prompt-injection and exfiltration surfaces.

Get an evidence-backed report

A risk score and every finding anchored to file, line and snippet — export as JSON or SARIF.

Using Claude Code? The SkillTotal plugin runs this check before your agent installs a package. See the Claude Code plugin →

What you get

Free

Always free

The full static report — no account needed.

Risk score (0–100) and level
All capabilities the component exposes
Behavioral trait fingerprint — mapped to CSA / MAESTRO / MITRE ATLAS
Every finding with file:line evidence
JSON and SARIF export

Deep Analysis

Coming soon

Server-side analysis that explains why a finding matters.

LLM verification of each finding
Exploitability & impact analysis
Dynamic behavior analysis in our isolated sandbox
Tailored remediation guidance
History & monitoring

The engine is 100% open source (Apache-2.0). Run it locally and your code never leaves your machine — no account, no token, no LLM key. Scans on this site run on our servers, never executing your code; public reports are cached and shared.

GitHub PyPI Detection benchmarkpipx install skilltotalnpx -y skilltotal scan <url>