Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add timurgaleev/vibestack --skill mcp-reviewgit clone --depth 1 https://github.com/timurgaleev/vibestackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/timurgaleev/vibestack/mcp-review)<a href="https://agentmods.dev/skills/timurgaleev/vibestack/mcp-review"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/mcp-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/timurgaleev/vibestack/mcp-review"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/mcp-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 177 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 179 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 180 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 183 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 192 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 16 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 199 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.05627 |
| Opus 5 | $0.00044 | $0.02814 |
| Sonnet 5 | $0.00018 | $0.01125 |
| Haiku 4.5 | $0.00009 | $0.00563 |
Grade A, and why
mcp-review scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Resources and tools that take URLs fetch against an allowlist.** Look for `httpx.get`, `requests.get`, `fetch(` with an argument from the schema. Confirm a host allowlist, a scheme check (`https` only), a size cap an Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
grep -rnE 'f"[^"]*(SELECT|INSERT|UPDATE|DELETE|WHERE)|\+[[:space:]]*["'"'"'].*(SELECT|WHERE)|shell=True|child_process|execSync|exec\(' \ How it starts
The opening of the file, as written. The whole thing — 280 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to invoke
Use when: "review my MCP server", "is this MCP server safe", "check the tool schemas", "MCP auth", "MCP security", or before an MCP server is published, deployed over HTTP, or given to an agent with real credentials.
Preamble
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi
{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
User-invocable
When the user types /mcp-review, run this skill. An optional argument names the server directory or entry file; without one, review the current repository.
Step 1: Locate the server
Find the entry point and the SDK before reading anything else. The SDK decides which registration patterns to look for.
# SDK and entry point
grep -rlE 'from (mcp|fastmcp)|import (mcp|fastmcp)' --include='*.py' . 2>/dev/null | grep -v node_modules | head
grep -rlE '@modelcontextprotocol/sdk' --include='*.ts' --include='*.js' --include='package.json' . 2>/dev/null | grep -v node_modules | head
# Transport
grep -rnE 'stdio|streamable|StreamableHTTP|sse|transport=' --include='*.py' --include='*.ts' . 2>/dev/null | grep -v node_modules | head -20
# Registrations
grep -rnE '@(mcp|server|app)\.(tool|resource|prompt)\(|server\.(registerTool|registerResource|registerPrompt|tool|resource|prompt)\(' \
--include='*.py' --include='*.ts' . 2>/dev/null | grep -v node_modules
Record: entry file, transport (stdio or streamable HTTP; flag legacy SSE), the count of tools, resources and prompts, and whether any auth middleware is mounted (bearer, OAuth, verify_token, requireBearerAuth, authMiddleware). Then read every tool registration in full, including its input schema (Pydantic model, zod object, or hand-written JSON schema) and its description string. Keep a list of tool names with their schemas; Steps 2 and 4 work from that list.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 280 lines · 89 tokens per session scan A 6f6923dabda4
mcp-review is a skill published in the GitHub repository timurgaleev/vibestack (6 stars, last pushed 7d ago), licensed MIT. It adds 89 tokens to every session and 5,627 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
grok-build-supervisor
Initialize the persistent local proxy, then immediately ensure a visible Grok Build TUI for the current workspace when /grokexecute on activates, and continuously supervise that coding-agent session through a user-level Supervisor daemon as the user sends work, waits for completion, reconnects from another host task…
cursor-delegate
Delegate bounded light-to-medium implementation, investigation, documentation, configuration, testing, and tooling work to Cursor Bridge after the primary agent owns direction and risk boundaries. Also use when the user explicitly asks to create, keep, continue, inspect, or close the same Cursor execution session…
grok-executor-off
Explicitly disable Grok executor mode for this task without cancelling work or closing its terminal. Select this skill directly; no argument is required.
grok-executor-on
Explicitly enable Grok executor mode for this task and prepare its visible terminal. Select this skill directly; no argument is required.
agentcore-gateway-mcp
Turn Lambda functions, OpenAPI and Smithy APIs, and existing MCP servers into a unified MCP tool surface with Amazon Bedrock AgentCore Gateway. Use when giving an agent tools, configuring inbound or outbound Gateway auth, or enabling semantic tool discovery at scale.
bedrock-agentcore
Deploy and operate agents on Amazon Bedrock AgentCore — Runtime, Harness, Memory, Identity, and Observability. Use when hosting an agent on AWS, containerising an agent for AgentCore Runtime, wiring session or long-term memory, or choosing between Harness, Runtime, and plain Lambda.