Skip to content

feat(mcp): expose SkillSpector as an MCP server with a scan_skill tool#36

Open
CharmingGroot wants to merge 1 commit into
NVIDIA:mainfrom
CharmingGroot:feat/mcp-server
Open

feat(mcp): expose SkillSpector as an MCP server with a scan_skill tool#36
CharmingGroot wants to merge 1 commit into
NVIDIA:mainfrom
CharmingGroot:feat/mcp-server

Conversation

@CharmingGroot

@CharmingGroot CharmingGroot commented Jun 13, 2026

Copy link
Copy Markdown

Adds an MCP server (skillspector mcp) that wraps the existing graph and exposes one tool, scan_skill, over stdio and HTTP. Lets an agent — Claude Code, Codex, Gemini, or a remote A2A runtime — scan a skill and gate the install on the result.

Opened #35 first per CONTRIBUTING; sending this alongside so there's something concrete to look at. Glad to change the naming or packaging based on what you decide there.

What's here:

  • mcp_server.pyrun_scan() does the actual work and doesn't import the mcp SDK, so it's testable without the extra. build_server() wraps it in FastMCP; run() serves stdio or streamable HTTP.
  • cli.pyskillspector mcp --transport stdio|http.
  • pyproject.tomlmcp as an optional extra so the core deps don't grow, plus it's in dev so CI exercises it. uv.lock updated (additions only).

The verdict includes llm_used / scan_mode, so a static-only scan (e.g. no credentials) doesn't get mistaken for a clean full scan — related to #3 / #4 / #9.

I also noticed the TODO(SADD A.5.1) for a FastAPI skillspector serve. This is deliberately a separate surface (mcp, not serve) so the two don't collide; happy to fold it into serve later if you'd prefer.

Tested: unit tests for the verdict shape and the llm-accounting cases, plus a stdio client round-trip and the HTTP server run locally. ruff clean, unit suite passes.

pip install "skillspector[mcp]"
skillspector mcp                                # stdio
skillspector mcp --transport http --port 8000   # remote / A2A

Commits are DCO signed-off.

Add an MCP server entrypoint (`skillspector mcp`) that wraps the existing
graph and exposes a single `scan_skill` tool over stdio and streamable HTTP
transports, so any MCP-capable agent (Claude Code, Codex CLI, Gemini CLI) or
remote/A2A runtime can scan a skill and gate installs on the verdict.

- mcp_server.py: SDK-independent run_scan() core + FastMCP build_server().
  Reports honest llm_used / scan_mode so a static-only scan is never mistaken
  for a full semantic scan when credentials are absent.
- cli.py: `skillspector mcp --transport stdio|http` subcommand.
- pyproject.toml: optional `mcp` extra, kept out of the core dependencies.
- tests + README section.

Refs NVIDIA#35

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: CharmingGroot <ohyes9711@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant