SkillTriage

dev.moorai/skilltriageVersion 0.6.1

Scan AI agent skills, MCP server packages and MCP configs before you install them. Static analysis.

Status

Responds447 msNov 14, 2026, 14:26 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:26 UTC
Latency: 447 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://skilltriage.moorai.dev/mcpResponds447 msNov 14, 2026, 14:26 UTC

No sign-in

Claude Code

claude mcp add --transport http skilltriage https://skilltriage.moorai.dev/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: skilltriage
Remote MCP server URL: https://skilltriage.moorai.dev/mcp

Cursor

{
  "mcpServers": {
    "skilltriage": {
      "url": "https://skilltriage.moorai.dev/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"skilltriage","type":"http","url":"https://skilltriage.moorai.dev/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

4 tools

Tools of SkillTriage
	Description		Read-only	Idempotent	Open world
`lookup_verdict`Look up the verdict the public catalogue has published for an MCP server package on npm or PyPI. Returns found:false when the catalogue has no published verdict for that name; that is not a clean result. Nothing is downloaded or scanned. This request names the package to the server; to match without naming it, download /api/reputation-feed.json and match on your side.	Look up the verdict the public catalogue has published for an MCP server package on npm or PyPI. Returns found:false when the catalogue has no published verdict for that name; that is not a clean result. Nothing is downloaded or scanned. This request names the package to the server; to match without naming it, download /api/reputation-feed.json and match on your side.	No	Yes	Yes	No
`scan_mcp_config`Check a pasted MCP client config (.mcp.json, claude_desktop_config.json, mcp.json, Codex config.toml). Reports each npm or PyPI launch by its position and how its version is pinned (exact, @latest, a tag or range, none), flags releases on the known-compromised list, and runs static analysis over the text. Server names, package names, arguments, env and header values are never returned or stored; remove secrets before sending anyway. Static analysis only; nothing is run or fetched. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the pinning advice and a permalink.	Check a pasted MCP client config (.mcp.json, claude_desktop_config.json, mcp.json, Codex config.toml). Reports each npm or PyPI launch by its position and how its version is pinned (exact, @latest, a tag or range, none), flags releases on the known-compromised list, and runs static analysis over the text. Server names, package names, arguments, env and header values are never returned or stored; remove secrets before sending anyway. Static analysis only; nothing is run or fetched. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the pinning advice and a permalink.	No	Yes	Yes	No
`scan_package`Download one published package and run static analysis on its code with MoorAI's open-source engine. npm and PyPI packages also get ten MCP pre-install checks on their registry metadata, a reputation score and a known-compromised release check. Static analysis only: the package is never installed and the server is never run. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), content-free findings (threat ids, categories, file paths, hashes; never file contents) and a permalink. The package name and version are sent to its registry. A completed analysis is reused for 24 hours; a new one can take a minute and runs one at a time.	Download one published package and run static analysis on its code with MoorAI's open-source engine. npm and PyPI packages also get ten MCP pre-install checks on their registry metadata, a reputation score and a known-compromised release check. Static analysis only: the package is never installed and the server is never run. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), content-free findings (threat ids, categories, file paths, hashes; never file contents) and a permalink. The package name and version are sent to its registry. A completed analysis is reused for 24 hours; a new one can take a minute and runs one at a time.	No	Yes	Yes	Yes
`scan_skill`Scan one agent skill or instruction file (SKILL.md, AGENTS.md, a tool.json, any text file) with MoorAI's open-source engine. Static analysis only; nothing is run. The text is written to a temporary directory, scanned and deleted; only its hash, the verdict and content-free findings are kept. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the findings and a permalink.	Scan one agent skill or instruction file (SKILL.md, AGENTS.md, a tool.json, any text file) with MoorAI's open-source engine. Static analysis only; nothing is run. The text is written to a temporary directory, scanned and deleted; only its hash, the verdict and content-free findings are kept. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the findings and a permalink.	No	Yes	Yes	No

Details

Registry status: Active
Published: Oct 31, 2026
Updated: Oct 31, 2026
Website: https://skilltriage.moorai.dev/api⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): AI modelsSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing