froggychips

MCP Skills Vault — Security skill for Claude Code

Security community

Offline security check for MCP server configs (.mcp.json, VS Code, Cursor, Claude Code) — GitHub Action, pre-commit and CLI.

How to install MCP Skills Vault

This entry records only its repository, not the path inside it, so there is no exact command to give. Open froggychips/mcp-skills-vault and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MCP Skills Vault does

Offline security check for MCP server configs (.mcp.json, VS Code, Cursor, Claude Code) — GitHub Action, pre-commit and CLI. Flags unpinned servers, plaintext secrets, typosquats, tool poisoning and toxic tool flows; pins and verifies known packages. Fails closed. Zero deps, no telemetry.

Alternatives in Security

Om Vault Audit — Vault Audit 4.6k ★
Claude Code Security Review — An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities 3.9k ★
Azure Key Vault .net — Cryptographic key management 1.8k ★

README

mcp-skills-vault

[![npm version](https://img.shields.io/npm/v/@froggychips/mcp-vault.svg)](https://www.npmjs.com/package/@froggychips/mcp-vault) [![npm downloads](https://img.shields.io/npm/dm/@froggychips/mcp-vault.svg)](https://www.npmjs.com/package/@froggychips/mcp-vault) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE) [![Zero deps](https://img.shields.io/badge/runtime%20deps-0-brightgreen.svg)](./PHILOSOPHY.md) [![Tests](https://img.shields.io/badge/tests-822%20pass-brightgreen.svg)](./tests)

**Homepage:** [mcp.froggychips.xyz](https://mcp.froggychips.xyz) · **npm:** [`@froggychips/mcp-vault`](https://www.npmjs.com/package/@froggychips/mcp-vault)

**Make MCP boring.** A deterministic registry + integrity scanner for [Model Context Protocol](https://modelcontextprotocol.io) servers, so installing one stops feeling like `curl | bash`.

![demo](./docs/demo.gif)

$ npx -y @froggychips/mcp-vault scan
Stack: Langs: Node | DB: postgres | Infra: aws, teamcity, atlassian
Needs: database, infra, ci-cd, pm

── Recommended ──────────────────────────────────────────────
  Core         mcp-server-neon            10 tools  score 105
  Core         mcp-server-aws             20 tools  score 105
  Core         mcp-server-filesystem      10 tools  score 105
  Core         mcp-server-memory           9 tools  score 105
  Recommended  teamcity-mcp              null tools  score  65

── Heavy — scope before global install ──────────────────────
  Experimental mcp-atlassian             72 tools ⚠  score  55
                 --toolsets jira,confluence

$ npx -y @froggychips/mcp-vault verify --offline
…
FAIL  mcp-server-aws@1.0.27 (PyPI offline pin present for awslabs.core-mcp-server)
        [FAIL] stored evidence: availability: yanked (observed 2026-09-17)
…
112 entries checked — 1 failure(s)