Checking a server or skill Vigile has already scored, and searching the registry, cost nothing against the monthly allowance — only vigile_scan_content, which analyses content nobody has scored yet, draws it down. That makes the useful habit a cheap one: look a package up before wiring it into a config, and spend a scan only on the claude.md or .cursorrules file that arrived from somewhere you cannot vouch for. Read the number as one input rather than a verdict; the publisher says plainly that it comes from automated analysis and does not claim to catch everything.
A client for Vigile's trust registry, which scores MCP servers and agent skills against tool poisoning, data exfiltration, prompt injection and supply-chain attacks. It covers servers from npm, Smithery, PyPI and other registries and skills from Claude Code, Cursor and OpenClaw/ClawHub, with a memory layer for recalling what an earlier investigation found.
- vigile_check_server returns a 0-100 trust score, a trust level, a findings summary and a link to the full report for a named server or package
- vigile_check_skill does the same for a skill file — claude.md, .cursorrules, skill.md and their relatives
- vigile_scan_content takes raw file content and analyses it directly, for something nobody has scored yet
- vigile_search finds servers and skills by keyword with their scores already attached
- The scale is published rather than implied: 80-100 trusted, 60-79 caution, 40-59 risky, 0-39 dangerous
- vigile_verify_location assesses location privacy and safety risk for physical-world interactions such as deliveries, meetups and transactions, preferring an H3 cell index over raw coordinates
- A memory layer sits alongside: vigile_remember records a bounded security episode, vigile_recall returns compact context and evidence chunks with provenance status, vigile_timeline assembles a timeline for an incident or topic, and vigile_check_provenance fetches the canonical payload behind a source id
Node.js 18 or newer, run as npx -y vigile-mcp over stdio, or installed globally. It works against the public registry with no key at 10 scans a minute and 50 a month; VIGILE_API_KEY raises that to 60 a minute and 1,000 a month on Pro at $30/mo, or 300 a minute and 5,000 a month on Pro+ at $100/mo. Registry lookups — check_server, check_skill and search — do not count against the quota; only vigile_scan_content does. The publisher states that scores come from automated analysis and are not a security guarantee. MIT.
One command — npx -y vigile-mcp