# SkillTotal > SkillTotal is a free, open-source static security scanner for what AI coding agents install: MCP servers, agent skills (SKILL.md), npm and PyPI packages, VS Code extensions and git repositories. It never executes the code it reads and never calls an LLM, so the same component and engine version always give the same result, and every confirmed finding cites the file and line it came from. It reports malicious indicators, risky constructs and capabilities; it does not certify a component as safe. The current engine is 1.1.0 (ruleset 100), Apache-2.0, with no runtime dependencies beyond the Python standard library. Scanning needs no account. The same engine runs on the website, as a CLI (`pipx install skilltotal`, or `npx -y --package=skilltotal@1.1.0 -- skilltotal`), as a Claude Code plugin that checks packages before the agent installs them, as a GitHub Action, and as an MCP server (`skilltotal mcp`). - What it scans: a git repository URL (a branch, subfolder or commit works too), `npm:`, `pypi:`, and `vscode:` or `openvsx:` editor extensions. The website also takes a zipped skill or project and a pasted MCP client config, and the CLI scans local folders and archives. - What a report contains: a risk score out of 100, a risk level, the capabilities found (shell, filesystem, network and others), and findings with file:line evidence, exportable as JSON or SARIF. - How the score works: capabilities alone add nothing to the score, so shell or network access by itself does not make a server look malicious. The score comes from malicious indicators (for example tool poisoning, hidden Unicode instructions, decode-and-execute payloads) and risky constructs (for example reading credential files and sending data to the network). - Measured detection: on its published, labeled corpus, engine 1.1.0 flags 231 of 231 malicious samples and 0 of 194 benign samples. The corpus and the harness are in the open-source repository, so the numbers can be reproduced from the release tag. - Limits: a scan reads the component's own files, not its dependencies. A remote MCP server (a URL) runs on someone else's machine with no code to read, so it is listed as not scanned. There is no runtime or sandbox analysis. ## Common questions - [How do I check an MCP server before installing it?](https://www.skilltotal.ai/mcp-server-security#checklist): scan its repository or npm/PyPI package, read its tool descriptions and launch command, and pin the version you checked - [Is there a free scanner for Claude Code skills?](https://www.skilltotal.ai/agent-skill-security#automatic-checks): yes; scan the skill's repository URL or a zipped skill folder on the website, or run `skilltotal scan ./my-skill` - [How do I check an npm package for malware before npm install?](https://www.skilltotal.ai/npm-package-security#how-to-check): read its lifecycle scripts with `npm view scripts`, then scan `npm:` - [How do I check a PyPI package before pip install?](https://www.skilltotal.ai/pypi-package-security#how-to-check): scan `pypi:`; it covers setup.py, import-time code, .pth files and unsafe deserialization - [How do I stop an AI agent from installing a malicious package?](https://www.skilltotal.ai/claude-code-plugin): the Claude Code plugin checks each npm, PyPI or MCP install before the command runs ## Scanners and guides - [Scan a component](https://www.skilltotal.ai/): the home page scanner; paste a repository URL or an npm:, pypi:, vscode: or openvsx: name - [AI security scanner](https://www.skilltotal.ai/ai-security-scanner): what the scanner covers across MCP servers, agent skills and packages, and how the verdict works - [MCP server security](https://www.skilltotal.ai/mcp-server-security): scan an MCP server, plus a nine-point checklist (version pinning, launch commands, tool poisoning, approvals, secrets in configs, remote servers) - [Agent skill security](https://www.skilltotal.ai/agent-skill-security): how to check a Claude Code skill before installing it (frontmatter and allowed-tools, instructions, bundled scripts, hidden text) - [npm package security](https://www.skilltotal.ai/npm-package-security): how to check an npm package before npm install (lifecycle scripts, typosquats, obfuscated code, lockfiles) - [PyPI package security](https://www.skilltotal.ai/pypi-package-security): how to check a PyPI package before pip install (build hooks, .pth files, import-time code, unsafe deserialization, wheels vs sdists) - [GitHub repository scanner](https://www.skilltotal.ai/github-repo-scanner): scan a repository, a subfolder or a commit - [GitHub Actions security](https://www.skilltotal.ai/github-actions-security): what the scan checks in workflows and composite actions (a workflow that dumps every secret and sends it off GitHub, secrets posted from an action) and what to check after a CI secret-stealer campaign - [Scan your MCP config](https://www.skilltotal.ai/scan-config): paste a client's MCP config and scan the package behind every server - [Scan a skill or project upload](https://www.skilltotal.ai/scan-project): upload a zipped agent skill, AI-generated project or single file ## Tools - [Claude Code plugin](https://www.skilltotal.ai/claude-code-plugin): checks each npm, PyPI or MCP package before Claude Code installs it, and lists the hooks for other agents with how far each has been tested - [GitHub Action](https://www.skilltotal.ai/github-action): scan on every push and pull request, with SARIF for Code Scanning, a job summary and a PR comment - [Docs](https://www.skilltotal.ai/docs): how the analysis works, coverage by component type, CLI commands, CI setup and what is out of scope ## Research - [Detection benchmark](https://www.skilltotal.ai/detection-benchmark): recall and precision of engine 1.1.0 on a published, labeled corpus, per attack technique - [Static analysis vs LLM review](https://www.skilltotal.ai/static-vs-llm-scanning): how deterministic rules, LLM-as-judge review and sandbox monitoring compare - [What we catch, and what we do not](https://www.skilltotal.ai/what-we-catch): the published scanner bypasses (whitespace inflation, bytecode, archive indirection, prompt injection against an LLM judge) and what the engine does with each - [MCP registry survey](https://www.skilltotal.ai/mcp-registry-security-report): a static scan of the official MCP registry, with open aggregate data - [Security labs](https://www.skilltotal.ai/labs): interactive lessons on prompt injection, tool poisoning, typosquatting, install scripts and more ## About - [About SkillTotal](https://www.skilltotal.ai/about): what it checks, how it works, how the hosted site handles data, responsible disclosure - [Privacy policy](https://www.skilltotal.ai/privacy) ## Source - [GitHub repository](https://github.com/pezhik/skilltotal): engine, rules, tests and the evaluation harness - [Release v1.1.0](https://github.com/pezhik/skilltotal/releases/tag/v1.1.0) - [PyPI package](https://pypi.org/project/skilltotal/) - [npm wrapper](https://www.npmjs.com/package/skilltotal) - [GitHub Marketplace action](https://github.com/marketplace/actions/skilltotal-ai-component-security-scan)