Skill Scan by Agentropolis

Check an MCP server or agent skill before you install it. Send a GitHub repo, an npm: or pypi: package, or paste the code with its tools/list / SKILL.md. The scan flags tool poisoning and hidden instructions, credential and env-var exfiltration, remote code execution, obfuscated payloads, install hooks, persistence and wallet risks.

Consensus: two rule families (code and agent-facing text) and two independent LLM reviewers vote, and the result is cross-checked against Agentropolis seller trust data (verification, payment-verified settlements, wash flags). You get allow, review or block, file:line evidence, a tools_sha256 baseline and repo/package provenance.

Read-only. Code is fetched from GitHub, npm or PyPI and pattern-matched. It is never installed or executed. Run-time behaviour is out of scope for this tier. Advisory.

$0.30 USDC per scan (LIVE: real USDC payments). Not charged if the source can't be fetched.

curl -s https://seenly-skill-scan.vercel.app/api/scan -H 'content-type: application/json' \
  -d '{"repo":"https://github.com/owner/some-mcp-server","context":"connect to my desktop agent"}'
# -> HTTP 402 + PAYMENT-REQUIRED (x402 v2). Pay, retry with PAYMENT-SIGNATURE.
# Also: {"repo":"npm:@scope/server@1.2.3"}  {"repo":"pypi:some-mcp"}
#       {"files":[{"path":"server.py","content":"..."}],"manifest":{"tools":[...]}}

Machine-readable: openapi.json · llms.txt · kits.json · x402 · A2A card · sample output

First-party Agentropolis kit. What the badges mean

Agentropolis kit · listed on Agentropolis · contact hello@agentropolis.io