Use Skill Doctor as an MCP server in your AI agent

Run as an MCP server, Skill Doctor lets your agent scan a skill before it loads, runs or modifies it.

Claude Code
Cursor, Windsurf, Claude Desktop
Ask your agent

claude mcp add skill-doctor -- npx -y @security.kalarislabs/skill-doctor mcp

Add this entry to your mcp.json or the agent’s MCP settings:

mcp.json

{
  "mcpServers": {
    "skill-doctor": {
      "command": "npx",
      "args": ["-y", "@security.kalarislabs/skill-doctor", "mcp"]
    }
  }
}

Paste this into your coding agent:

Please install @security.kalarislabs/skill-doctor and register it as an MCP server with command npx -y @security.kalarislabs/skill-doctor mcp. Use it to audit skill files and tools in this workspace before executing or modifying them.

Restart the agent after you change its MCP configuration.

If you installed with cargo, run skill-doctor mcp directly and make sure the binary was built with --features mcp. See installation.

Scanner hijacking protection

A malicious skill can try to instruct the agent that called the scanner. Skill Doctor fences scanned content before it returns results, and tracks these attempts as threat class SD-11.

⌘I

Get started

Guides

Reference

Use Skill Doctor as an MCP server in your AI agent

Scanner hijacking protection

​Scanner hijacking protection

Scanner hijacking protection