Security-Gated Skill Management for AI Coding Assistants

Search the SkillsMP marketplace by keyword. Returns skill names, descriptions, authors, star counts, and GitHub links. Supports sorting by stars or recency. All results are sanitized against prompt injection.

Natural language search powered by Cloudflare AI. Returns relevance-scored results. Finds skills even when keywords do not exactly match.

Combines keyword search with automatic security scanning of the top N results. Shows risk levels and threat summaries inline with search results.

Recommends new skills based on what you already have installed and optional context about your current project. Filters out already-installed skills automatically.

Scans a GitHub skill repository for 60+ threat patterns across prompt injection, reverse shells, credential theft, supply chain attacks, crypto mining, and more. Returns a risk level, threat list, content hash, and recommendation.

Compare two skills by GitHub URL or installed name. Shows risk levels, threat counts, categories, and a recommendation for which is safer.

Forces a fresh security scan on a specific installed skill. Shows detailed threat report, file count, total size, content hash, and SKILL.md status.

Scans a GitHub skill, then installs it to ~/.claude/skills/. Critical threats are permanently blocked. Medium/high risk requires force=true. Runs npm install with --ignore-scripts.

Removes an installed skill directory and updates the in-memory registry. Restart your MCP client to apply changes.

Lists all installed skills with risk levels, file counts, SKILL.md status, and last scan timestamps. Supports forced refresh and re-sync.

Manage sync subscriptions and settings. Add or remove search subscriptions, set sync interval, risk threshold, and conflict policy (skip, overwrite, or unmanage).

Polls subscriptions, diffs against installed skills, and installs/updates/removes as needed. Supports dryRun=true to preview changes before applying.

Shows sync engine state: managed vs manual skills, subscription count, last sync time, next scheduled sync, and per-skill details.

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}

Add to ~/.openclaw/mcp.json:

{
  "mcpServers": {
    "skillsmp": {
      "version": "1.3.0",
      "autoUpdate": false,
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp@1.3.0"]
    }
  }
}

OpenClaw uses the same SKILL.md format as Claude Code. Pin versions and review tool policies per the security hardening guide.

Add to .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}

Add to ~/.windsurf/mcp.json:

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}

Add to .github/copilot-mcp.json in your project root, or ~/.github/copilot-mcp.json for global:

{
  "mcpServers": {
    "skillsync": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"],
      "env": {
        "SKILLSMP_API_KEY": "your-api-key"
      }
    }
  }
}

Add to ~/.config/zed/settings.json under "context_servers":

{
  "context_servers": {
    "skillsync": {
      "command": {
        "path": "npx",
        "args": ["-y", "@stranzwersweb2/skillsync-mcp"],
        "env": {
          "SKILLSMP_API_KEY": "your-api-key"
        }
      }
    }
  }
}

npm install -g @stranzwersweb2/skillsync-mcp

Then reference skillsync-mcp as the command in any MCP config:

{
  "mcpServers": {
    "skillsmp": {
      "command": "skillsync-mcp"
    }
  }
}