Enterprise DNAEnterprise DNA

MCP Servers

duriantaco/skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge.

Visit site ↗

Our verdict

Not reviewed yet

We have not reviewed duriantaco/skylos yet

No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.

How we review records

From the listing

About duriantaco/skylos

Open source PR scanner that runs locally to detect dead code, security bugs, secrets, quality regressions, and errors in AI-generated code before merge. Written in Python and designed to be triggered on pull requests, it provides an offline, privacy-preserving alternative to cloud-based scanning tools.

Best for

Teams wanting a self-hosted, privacy-focused pre-merge check that catches security and quality issues in pull requests

Use cases

  • Catching security vulnerabilities and leaked secrets in pull requests before deployment
  • Identifying dead code and quality regressions during code review
  • Detecting mistakes in AI-generated code commits

Notes

446 stars on GitHub. Last updated 2026-05-30. Licensed Apache-2.0.

Pros

  • Local-first design keeps code and scan results private without external data transfer
  • Addresses multiple issue categories in a single scan (security, quality, AI code errors)
  • Free and open source with no licensing costs

Cons

  • Requires Python runtime and manual setup on the developer's machine or CI runner
  • Smaller community and fewer integrations compared to established commercial scanners
  • May need tuning to avoid false positives or cover project-specific rules

Key facts

What we have checked

Days since the last commit
0
Checked GitHub
GitHub forks
64
Checked GitHub
GitHub stars
893
Checked GitHub
Days to a first reply on issues
29.9
Checked GitHub
Open issues
0
Checked GitHub
Releases in the last 90 days
35
Checked GitHub

Each value shows when we last confirmed it and where it came from. Values we have not confirmed are left out, never guessed.

How to use

How to set it up

As the listing publishes it. We have not run this install.

Install

pip install skylos

Tools exposed

  • verify_change
  • verify_agent

Clients the listing names (not checked here)

Claude Code, Cursor, VS Code, ChatGPT

Install

Add duriantaco/skylos to your client

Not verified yet

Our lab has not run this server yet. "Config checked" on a client means the recipe matches that client's documented config format; it does not mean we ran it.

Claude Code

Config checked

Run in your terminal (runs on your computer)

claude mcp add --transport stdio duriantaco-skylos -- uvx skylos@3.5.10

Version 3.5.10 · From the Official MCP registry, read · Format checked against Claude Code's config docs

Claude Desktop

Config checked

Add to claude_desktop_config.json (runs on your computer)

{
  "mcpServers": {
    "duriantaco-skylos": {
      "command": "uvx",
      "args": [
        "skylos@3.5.10"
      ]
    }
  }
}

Version 3.5.10 · From the Official MCP registry, read · Format checked against Claude Desktop's config docs

Cursor

Config checked

Add to .cursor/mcp.json (runs on your computer)

{
  "mcpServers": {
    "duriantaco-skylos": {
      "command": "uvx",
      "args": [
        "skylos@3.5.10"
      ]
    }
  }
}

Version 3.5.10 · From the Official MCP registry, read · Format checked against Cursor's config docs

VS Code

Config checked

Add to .vscode/mcp.json (runs on your computer)

{
  "servers": {
    "duriantaco-skylos": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "skylos@3.5.10"
      ]
    }
  }
}

Version 3.5.10 · From the Official MCP registry, read · Format checked against VS Code's config docs

Codex

Config checked

Add to ~/.codex/config.toml (runs on your computer)

[mcp_servers.duriantaco-skylos]
command = "uvx"
args = ["skylos@3.5.10"]

Version 3.5.10 · From the Official MCP registry, read · Format checked against Codex's config docs

  • ChatGPT: ChatGPT connects only to remote servers that need no API key.

Recipes come from the server's entry in the official MCP registry. Check the package name before you run it, and keep keys out of shared files.

Works with

What duriantaco/skylos connects to

5 clients, each with how we know and when we checked.

Works withTypeHow we knowChecked
Claude CodeClientInstall recipe matches the client's documented formatRuns locally, version 3.5.10Config checkedClaude Code docs
Claude DesktopClientInstall recipe matches the client's documented formatRuns locally, version 3.5.10Config checkedClaude Desktop docs
CursorClientInstall recipe matches the client's documented formatRuns locally, version 3.5.10Config checkedCursor docs
VS CodeClientInstall recipe matches the client's documented formatRuns locally, version 3.5.10Config checkedVS Code docs
CodexClientInstall recipe matches the client's documented formatRuns locally, version 3.5.10Config checkedCodex docs

Stars and usage

How duriantaco/skylos is growing

GitHub stars

856 to 893

stars. 28 Oct 2026 to 9 Nov 2026, 3 readings.

Source: GitHub. Checked .

Health and security

Is duriantaco/skylos looked after, and what do its setup files show

Health score

45 out of 100

Does someone look after this repository? It does not say the code is good or safe. Worked out from GitHub signals checked . How it is worked out

PartPointsWhat we saw
Recent activity30 of 30Last push 0 days ago
Releases15 of 1535 releases in 90 days
Issue replies0.1 of 20First reply in 29.9 days (median)
Maintainer0 of 15Owned by a single user
Official source0 of 20Community server

Alternatives

Alternatives to duriantaco/skylos

RecordTypeHow we knowChecked
semgrep/semgrepThis is an alternative to itMCP serverNamed in the listingNot dated

Compare

Compare duriantaco/skylos side by side

Sources

Where this comes from

  • GitHubRegistry

    Checked · Days since the last commit, GitHub forks, GitHub stars, Days to a first reply on issues, Open issues, Releases in the last 90 days

A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.

Changelog

What changed

No changes recorded yet. Releases, price changes and deprecations appear here, with their dates, once we track them for this record.

Open-source & AI alternatives

Swap-in tools that solve the same job. Weigh the trade-offs before you commit.

Free 27-page guide

Get the free Developer’s Field Guide

A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.

Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.

No spam. Unsubscribe any time.

← Back to MCP ServersSubmit your own entry →