Yotta Verify MCP

Name: Yotta Verify MCP
Author: YottaMeta

by YottaMetaversion 0.4.3i★ –iRuns on your computer

Registry nameio.github.YottaMeta/yotta-verify-mcp

Install

Overview

Description from the maker (original English)

Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiEarly↓ 610/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Cybersecurity

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "yotta-verify": {
      "command": "npx",
      "args": [
        "-y",
        "@yottameta/yotta-verify-mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add yotta-verify -- npx -y @yottameta/yotta-verify-mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "yotta-verify": {
      "command": "npx",
      "args": [
        "-y",
        "@yottameta/yotta-verify-mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "yotta-verify": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@yottameta/yotta-verify-mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account YottaMeta, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Cybersecurityi

More stars than 0% of the other 1003 servers in this category
Published to the registry more recently than 48% of the other 1003 servers in this category
Basic checks equal to or better than 100% of the other 1003 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Yotta Verify MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.4.3) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: KillerSkills, Draugr, OpenWorkProof

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

KillerSkills

Security verdicts for agent skills and MCP servers, from sandbox runs, before you install them.

by cyligence-karimGrowing↓ 3.1K/wkUpdated today

Runs on your computer

Install

Draugr

Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.

by draugr-devVery newUpdated today

Runs on your computer✓ draugr.dev

Install

OpenWorkProof

Verifiable agent evidence; opt-in Codex guard and reference SOC alert review.

by dengyierVery new↓ 303/wkUpdated today

Runs on your computer

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Language : English · 中文

yotta-verify-mcp · 元信MCP (YuanXin MCP)

YottaMeta's pre-install security scanner for Agent skills , exposed as a stdio MCP server. Before you install any skill, plugin or MCP server, it runs a deterministic static scan — prompt injection, malicious patterns, SKILL.md integrity and permissions — and returns a verdict , an audited badge , a CI gate and a report as MCP tools. Activates when configuring the 元信 MCP server in an MCP client, wiring a trust-scan into an agent / workflow, or calling the MCP tools. Zero dependencies (Python 3.8+ standard library); Windows + Linux + macOS; fully local and offline — no network calls, no execution of the scanned code.

What it is

The skill / plugin market has a trust problem: a 2025 survey of 22,511 skills found 140,963 issues, and 36% contain prompt injection. 元信 MCP gives you a deterministic answer before you install — the same scan as the yotta-verify CLI, exposed as four MCP tools so any MCP client (Claude, VS Code, Codex, Cursor, …) can call it.

It is a pre-install verifier , not a sandbox and not a runtime monitor: it only reads files and prints a report. It never executes the scanned code, never connects to the network for the scan, and never fixes anything.

Why use it

Advantage	Description
Trust before install	A deterministic verdict for any skill / MCP server, instead of "trust me"
Zero dependency	Python 3.8+ standard library; no daemon / database / network
Fully local offline	Scans directories and npm tarballs on disk; nothing is executed or uploaded
Drop into any MCP client	Standard stdio MCP server — configure the server, and the four tools appear
Family synergy	Same rules table as yotta-verify (single source); verdicts merge with yotta-vetter / yotta-security-audit
Free & open	MIT; the whole scanner is free

MCP tools

Tool	What it does
`scan_skill`	Pre-install scan: `target` (dir / .tgz / npm package) → verdict + severity counts + findings
`generate_badge`	Audited badge: local SVG + shields.io URL; folds in validate / vetter / audit / version / tests
`gate_check`	CI gate: fail when the worst severity exceeds `max_severity` (default medium)
`get_report`	Verification report: Markdown or JSON, same format as the CLI

MCP client configuration

MCP configuration is optional. An AI agent may show you the target config file, the exact mcpServers JSON, and the effect, then wait for your explicit consent before writing anything. If you decline, use the bundled CLI scanner directly; the scan result is unchanged.

Tool reference

`scan_skill`

Scan a skill directory or package before install.

Param	Type	Required	Meaning
`target`	string	yes	Skill directory path, `.tgz` / `.tar.gz` path, or npm package name (auto `npm pack` to a temp dir, then scan)

Returns a JSON result: verdict, severity counts, and findings (prompt injection / malicious patterns / SKILL.md integrity).

`generate_badge`

Generate an audited badge (local SVG + shields.io URL).

Param	Type	Meaning
`target`	string	Optional: scan this to derive the verdict
`verdict`	string	Optional: set the verdict directly
`validate`	string	Optional: `pass` / `fail` (validate-skill result)
`vetter` / `audit`	string	Optional: external verdicts to fold in
`version`	string	Optional: version label. Defaults to the scanner (yotta-verify) version (e.g. 0.1.1)
`tests`	integer	Optional: engine test count
`out`	string	Optional: write the SVG to this path

Note: the badge's version segment reflects the version of the bundled scanning engine

(yotta-verify), which may differ from the MCP package version. Pass version to override.

`gate_check`

CI pre-install gate.

Param	Type	Meaning
`target`	string	Required: dir / package to scan
`max_severity`	string	Optional: `info` / `low` / `medium` / `high` / `critical` (default `medium`)

Returns pass, verdict, worst, max_severity and an exit code.

`get_report`

Generate a verification report.

Param	Type	Meaning
`target`	string	Required: dir / package to scan
`format`	string	Optional: `json` / `markdown` (default `markdown`)
`out`	string	Optional: write the report to this path

Boundary

This is a local, offline, static scan:

Directory scan is fully offline — content never leaves your machine.
npm package scan only downloads the public package into a temporary directory (then removes it); it does not upload your content and does not execute the scanned package code.
It does not perform dynamic analysis, does not fix anything, and does not make the final decision. Treat the verdict as a strong signal and confirm any "install / don't install" decision yourself.
Only scan targets you are authorised to evaluate.

Installation of the skill

The package also ships a SKILL.md so an agent can explain how to configure and use the MCP server with explicit user consent. Pick any of the four methods below (skill files come from npm; GitHub can be slow without a proxy).

Method 1: npm one-liner (recommended)

# Optional China mirror: npm config set registry https://registry.npmmirror.com

npx -y @yottameta/yotta-verify-mcp --agent # install to the agent's default user-level skills dir npx -y @yottameta/yotta-verify-mcp --dir # point to the skills dir itself (e.g. ~/.codex/skills)

--agent installs to that agent's default user-level directory; --list shows each agent's default directory.
--dir installs to the given directory.
The installer also starts an MCP server when run with no arguments: npx -y @yottameta/yotta-verify-mcp.

Method 2: git clone (developers / git available)

git clone https://github.com/YottaMeta/yotta-verify-mcp.git <your-skills-dir>/yotta-verify-mcp

Method 3: GitHub Download ZIP (manual / no git)

On the GitHub repository YottaMeta/yotta-verify-mcp, click Code → Download ZIP, unzip it and put the yotta-verify-mcp folder into the agent's skills directory.

Method 4: install.sh (multi-agent one-liner script)

bash install.sh --agent <name>   # install to the agent's default user-level directory

bash install.sh --dir # install to the given directory bash install.sh --list # list agents -> default directories

Development & validation

Repository validation includes the MCP engine suite and a documentation consent regression:

# MCP engine suite (Python 3.8 / 3.13)

python scripts/test_yotta_verify_mcp.py

Documentation consent regression

node --test test/docs-consent.test.js

Run the MCP server directly for debugging

python scripts/yotta_verify_mcp.py

References: references/trust-checklist.md (pre-install trust checklist for MCP servers / plugins).

Yotta Verify MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Cybersecurityi

Common questions

Alternatives

KillerSkills

Draugr

OpenWorkProof

README from the maker

What it is

Why use it

MCP tools

MCP client configuration

Tool reference

scan_skill

generate_badge

gate_check

get_report

Boundary

Installation of the skill

Method 1: npm one-liner (recommended)

Method 2: git clone (developers / git available)

Method 3: GitHub Download ZIP (manual / no git)

Method 4: install.sh (multi-agent one-liner script)

Development & validation

Documentation consent regression

Run the MCP server directly for debugging

License

`scan_skill`

`generate_badge`

`gate_check`

`get_report`