← All skills
auditing-mcp-servers-for-tool-poisoning
77 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By adriannoes/awesome-agentic-ai (GitHub) · coding · 99 stars · scanned at commit e797ed5
Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 21 places.
Show 17 more
- cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 55
uvx --with "mcp-scan[proxy]" mcp-scan@latest proxy --help - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 58
pip install requests mcp - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 86
uvx mcp-scan@latest - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 89
uvx mcp-scan@latest ~/.vscode/mcp.json - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 92
uvx mcp-scan@latest --json ~/.cursor/mcp.json > mcp_scan_report.json - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 101
uvx mcp-scan@latest inspect ~/.cursor/mcp.json - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 111
uvx mcp-scan@latest ~/.cursor/mcp.json - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md, line 180
uvx --with "mcp-scan[proxy]" mcp-scan@latest proxy - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md, line 5
Run via uvx (no global install): `uvx mcp-scan@latest` - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md, line 16
uvx mcp-scan@latest ~/.vscode/mcp.json - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md, line 17
uvx mcp-scan@latest inspect ~/.cursor/mcp.json - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md, line 18
uvx --with "mcp-scan[proxy]" mcp-scan@latest proxy - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md, line 25
Install: `pip install mcp` - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/scripts/agent.py, line 56
runner = shutil.which("uvx") or shutil.which("mcp-scan") - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/scripts/agent.py, line 59
if "uvx" in runner else [runner, "--json", args.config]) - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/scripts/agent.py, line 69
findings["scanner"] = {"error": "uvx/mcp-scan not found; install uv: " - cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning/scripts/agent.py, line 70
"curl -LsSf https://astral.sh/uv/install.sh | sh"}
and 1 more places
Sends data to these websites: astral.sh, mcp-host
This is disclosed by the author in the skill's SKILL.md or README.
Found in 3 places.
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 8 places.
Show 5 more
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'auditing-mcp-servers-for-tool-poisoning' ] || [ -L ~/.agents/skills/'auditing-mcp-servers-for-tool-poisoning' ]; then echo 'A skill folder named auditing-mcp-servers-for-tool-poisoning already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/adriannoes/awesome-agentic-ai' "$d" && git -C "$d" checkout --quiet 'e797ed58cfe6dd6453fe7632f89d7226d203f6f6' -- 'cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning' && mkdir -p ~/.agents/skills && cp -R "$d"/'cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/auditing-mcp-servers-for-tool-poisoning' ~/.agents/skills/'auditing-mcp-servers-for-tool-poisoning' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'auditing-mcp-servers-for-tool-poisoning' ~/.claude/skills/'auditing-mcp-servers-for-tool-poisoning' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for adriannoes/awesome-agentic-ai shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/adriannoes/awesome-agentic-ai/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | e797ed5 | 77 |