Security-Gated Skill Management for AI Coding Assistants

Search the SkillsMP marketplace by keyword. Returns skill names, descriptions, authors, star counts, and GitHub links. Supports sorting by stars or recency. All results are sanitized against prompt injection.

Natural language search through the SkillsMP ai-search API (hosted by SkillsMP; it states it uses Cloudflare AI). Returns relevance-scored results that are treated as untrusted content.

Combines keyword search with automatic security scanning of the top N results. Shows risk levels and threat summaries inline with search results.

Recommends new skills based on what you already have installed and optional context about your current project. Filters out already-installed skills automatically. Privacy note: the query sent to SkillsMP includes the names of up to 10 of your installed skills and your optional context (up to 200 characters).

Scans a GitHub skill repository against 101 regex threat patterns across prompt injection, reverse shells, credential theft, supply chain attacks, crypto mining, and more. Returns a risk level, threat list, content hash, and recommendation.

Compare two skills by GitHub URL or installed name. Shows risk levels, threat counts, categories, and a recommendation for which is safer.

Forces a fresh security scan on a specific installed skill. Shows detailed threat report, file count, total size, content hash, and SKILL.md status.

Scans a GitHub skill, then installs it to ~/.claude/skills/. Installs matching a critical pattern are blocked. Medium/high risk requires force=true. Runs npm install with --ignore-scripts.

Removes an installed skill directory and updates the in-memory registry. Restart your MCP client to apply changes.

Lists all installed skills with risk levels, file counts, SKILL.md status, and last scan timestamps. Supports forced refresh and re-sync.

Manage sync subscriptions and settings. Add or remove search subscriptions, set sync interval, risk threshold, and conflict policy (skip, overwrite, or unmanage).

Polls subscriptions, diffs against installed skills, and installs/updates/removes as needed. Supports dryRun=true to preview changes before applying.

Shows sync engine state: managed vs manual skills, subscription count, last sync time, next scheduled sync, and per-skill details.

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}

Add to ~/.openclaw/mcp.json:

{
  "mcpServers": {
    "skillsmp": {
      "version": "1.4.1",
      "autoUpdate": false,
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp@1.4.1"]
    }
  }
}

OpenClaw uses the same SKILL.md format as Claude Code. Pin versions and review tool policies per the security hardening guide.

Add to .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}

Add to ~/.windsurf/mcp.json:

{
  "mcpServers": {
    "skillsmp": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"]
    }
  }
}

Add to .github/copilot-mcp.json in your project root, or ~/.github/copilot-mcp.json for global:

{
  "mcpServers": {
    "skillsync": {
      "command": "npx",
      "args": ["-y", "@stranzwersweb2/skillsync-mcp"],
      "env": {
        "SKILLSMP_API_KEY": "your-api-key"
      }
    }
  }
}

Add to ~/.config/zed/settings.json under "context_servers":

{
  "context_servers": {
    "skillsync": {
      "command": {
        "path": "npx",
        "args": ["-y", "@stranzwersweb2/skillsync-mcp"],
        "env": {
          "SKILLSMP_API_KEY": "your-api-key"
        }
      }
    }
  }
}

npm install -g @stranzwersweb2/skillsync-mcp

Then reference skillsync-mcp as the command in any MCP config:

{
  "mcpServers": {
    "skillsmp": {
      "command": "skillsync-mcp"
    }
  }
}