Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude Code plugin, Action.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add skilltotal -- uvx skilltotal mcp~/.codex/config.toml
[mcp_servers.skilltotal]
command = "uvx"
args = ["skilltotal", "mcp"]
# codex mcp add skilltotal -- uvx skilltotal mcp~/.cursor/mcp.json
{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal",
"mcp"
]
}
}
}.vscode/mcp.json
{
"servers": {
"skilltotal": {
"type": "stdio",
"command": "uvx",
"args": [
"skilltotal",
"mcp"
]
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal",
"mcp"
]
}
}
}claude_desktop_config.json
{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal",
"mcp"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"skilltotal": {
"command": "uvx",
"args": [
"skilltotal",
"mcp"
]
}
}
}