Skip to directory

Skylos MCP

Duriantaco (community-maintained open-source project)

stdio7+ documented tools0

About Skylos MCP

Skylos MCP exposes local static-analysis tools for dead code, security issues, code quality, secrets, AI-generated code risks, and agent guardrails, with optional authenticated remediation.

What you can use it for

  • Find likely dead code
  • Run static security and secrets scans
  • Check code quality and AI-generated code risks
  • Verify edits and AI-agent guardrails
  • Preview optional LLM-assisted remediations
Connection and setup
Hosting
Local Python process; analysis runs on the user's machine. An API key enables the broader Skylos MCP tool surface and cloud-linked remediation.
Transport
stdio
Endpoint
Local process; no hosted endpoint documented
Authentication
No key is needed for the limited local analyze tool (up to five calls per day according to current docs). SKYLOS_API_KEY from the official Skylos Cloud dashboard enables authenticated tools; remediate additionally needs an LLM API key configured in the server environment or through Skylos key setup.

Requirements

  • Python 3.10 or newer.
  • The official Skylos Python package installed with `pip install skylos`.
  • Read access to the project path being analyzed; scan only user-authorized folders.
  • An API key from https://skylos.dev/dashboard/settings is optional for broader tools; an LLM provider key is required for LLM-based remediation.

Setup steps

  1. Install the official Skylos package with `pip install skylos` using Python 3.10 or newer.
  2. Configure a local stdio server with command `python` and args `[-m, skylos_mcp.server]`. If Skylos was installed in a virtual environment, use that environment's Python executable.
  3. Without a key, the current documentation says only `analyze` is available and is limited to five calls per day. To enable the broader tool set, create an API key through https://skylos.dev/dashboard/settings and pass it to the server as SKYLOS_API_KEY through the client’s secure local environment mechanism. Never paste it into a catalog or chat.
  4. Reconnect the client and inspect tools/list. A safe initial call is `analyze` on a deliberately chosen project path. This tool reads local source files; avoid broad home-directory paths and exclude secret-bearing folders as appropriate.
  5. The `remediate` tool can generate and apply source changes. It defaults to dry-run according to the docs; do not set dry_run=false without explicit user approval. Add an LLM provider key only if remediation is intended.
Tools 7+

The official docs list seven tools. Without SKYLOS_API_KEY, only analyze is available and limited to five calls/day; other tools require authentication and remediate also needs an LLM provider key. This list is documentation-based, not live tools/list evidence.

  • analyze

    Find dead code and unused symbols in a selected local path.

    01
  • security_scan

    Run static security and taint analysis on a selected path.

    02
  • quality_check

    Analyze code complexity, nesting, structure, and quality patterns.

    03
  • secrets_scan

    Detect hard-coded credentials and sensitive data in supported files.

    04
  • verify_change

    Check a changed file or range for AI-code trust findings.

    05
  • verify_agent

    Statically assess agent integrations and deployment guardrails.

    06
  • remediate

    Generate candidate fixes, validate with tests, and optionally apply changes.

    07

This server’s available tools can vary by account, permissions, or configuration. The list shown is not its full runtime catalog.

Limitations and notes
  • Publisher is an independent open-source project, not an official MCP server from a large vendor.
  • Capabilities vary with authentication; without SKYLOS_API_KEY only analyze is available and is rate limited.
  • Remediate may use an LLM API and can modify source files when dry_run is disabled; review its plan and obtain approval before applying changes.
  • The official icon includes a white background, visually reviewed for contrast on both light and dark themes.
  • Documentation and logo were reviewed; connection, tools/list, and functionality were not tested.
Original sources
  • official mcp documentation

    Documents pip installation, Python module stdio configuration, API-key creation URL and limited unauthenticated access, seven tools, result storage, and remediation safety behavior.

  • official package metadata

    Project package metadata declares Python >=3.10.

  • official product logo asset

    512x512 product icon linked from Skylos' official website manifest; downloaded, decoded, and visually reviewed on light/dark contact sheets. Selection tier A: product logo.

  • discovery directory

    Skylos appeared in the awesome-mcp.tools security/developer-tools search results; used for discovery only.

  • maintainer or vendor documentation

    Official Skylos MCP page documents seven tools and Python stdio setup.

Documentation checked 2026-10-28T00:00:00Z. Connection has not been runtime tested.

Similar tools