MCP Server Discovery for Developers

SkillzBench is building the independent testing lab for the Model Context Protocol ecosystem — discovering, verifying, benchmarking, and tracking MCP servers and agent skills so developers don't have to trust blind.

The MCP Ecosystem Is Exploding — and Mostly Unverified

Mostly Unverified

More Than Half of MCP Marketplace Listings Are Junk

>50%

Quality control hasn't kept pace with the MCP ecosystem's explosive growth. More than half of listed MCP marketplace projects are invalid, low-value placeholders, or abandoned prototypes. With 15,926 GitHub repositories tagged mcp-server and 9,652 latest server records in the official MCP Registry, developers waste hours triaging repos that were never production-ready — reading READMEs, checking star counts, and manually testing stdio transports that fail on first contact. Star counts and download numbers don't tell you whether an MCP server actually works with your host or whether a SKILL.md package improves your agent at all.

Security Is the #1 Barrier to MCP Adoption — and the Threats Are Real

50%

Half of adopters cite security complexity as their top challenge, and for good reason: MCP servers are active targets for tool poisoning, prompt injection, and supply chain attacks. Published research found ~of agent skills carry at least one vulnerability. Every SKILL.md package you attach to a Claude Code, Codex, Cursor, or Gemini CLI agent is injected instruction text — and a malicious or sloppy package can steer your agent's behavior the moment it loads. Without security scanning and license checks, you're trusting anonymous GitHub authors with access to your agent's tool surface.

8,000% Growth With No Trust Infrastructure to Match

8,000%

MCP server downloads surged from ~100,000 in November 2024 to over 8 million by April 2025 — an 8,000% jump — and the ecosystem now sees 97 million+ monthly SDK downloads across Python and TypeScript. The official MCP Registry lists 9,652 latest server records and 28,959 server/version records, with modelcontextprotocol/servers at 86,148 stars. No team can manually vet that volume of servers and SKILL.md packages. Meanwhile, upstream repos change constantly: a skill that was safe and effective last month may have been rewritten, broken, or abandoned. Manual vetting doesn't scale — and stale vetting decisions are worse than none.

How SkillzBench <span class="gradient">De-Risks</span> Your MCP Stack

An independent testing lab and control panel for AI agent skills and MCP servers — built on five pillars.

SkillzBench continuously crawls and dedupes skills from GitHub, then verifies every entry: each version is pinned to a commit SHA, validated, license-checked, security-scanned, and quality-judged. Every skill is benchmarked in a sandbox with the same model, with and without the skill, and the Lift in percentage points is published. One MCP server plus per-agent loadouts lets you toggle skills and tools per agent — the agent only sees what you chose. Upstream changes are tracked, re-scanned, re-benchmarked, and you get notified.

• Every skill version pinned to a commit SHA, security-scanned, license-checked, and quality-judged before it earns trust
• Sandbox benchmarks with and without each skill publish the Lift in percentage points — never just a rating
• Per-agent loadouts through one MCP server: toggle skills and tools per agent, and the agent only sees what was chosen

Why MCP Developers <span class="gradient">Choose SkillzBench</span>

Trust Scores You Can Defend

SkillzBench is building a 0-100 trust score for every skill, computed from security, quality, license, maintenance, and community signals. Instead of guessing from star counts, you evaluate SKILL.md packages and MCP-facing skills against defensible criteria: security scan results, license checks, quality judgments, and maintenance signals. Every version is pinned to a commit SHA, so the score you see applies to exactly the code you'd run — not a moving target on the default branch.

Lift, Not Marketing

Every skill is benchmarked in a sandbox with the same model, with and without the skill, and the Lift is published in percentage points. That's the comparison that matters: does this SKILL.md package actually make the agent better, or does it just look good in a README? Lift is always shown separately from ratings, and money never touches scores — so a paid placement can't outperform a free skill in the numbers.

Stay Current Without the Manual Work

SkillzBench tracks upstream changes to every skill, then re-scans and re-benchmarks automatically and notifies you when something moved. In an ecosystem where uneven maintenance leaves many public MCP servers unmaintained, a skill that passed vetting three months ago may have silently changed. Commit-SHA pinning means you always know which version you evaluated — and continuous re-scanning means you find out when that version is superseded, broken, or newly risky.

How it works

1. Join the Waitlist — SkillzBench is pre-launch and actively being built. Join the waitlist and newsletter to follow progress and get early access to discovery, verification, and benchmarking.
2. Discover and Verify — Once live, browse continuously crawled and deduped skills from GitHub, each pinned to a commit SHA and screened with security scans, license checks, and quality judgments.
3. Equip Your Agents — Build per-agent loadouts on one MCP server — toggle skills and tools per agent, check the published Lift, and stay notified as upstream changes are re-scanned and re-benchmarked.

What you get

• Discover: continuous crawling and deduplication of agent skills from GitHub, cutting through thousands of low-value and abandoned repos
• Verify: every skill version pinned to a commit SHA, then validated, license-checked, security-scanned, and quality-judged
• Benchmark: sandbox testing of every skill with the same model, with and without the skill, publishing the Lift in percentage points
• Equip: one MCP server plus per-agent loadouts — toggle skills and tools per agent so the agent only sees what was chosen
• Trust score 0-100 combining security, quality, license, maintenance, and community signals, with Lift always shown separately
• Stay current: upstream changes tracked, re-scanned, re-benchmarked, and pushed to you via notifications

Quick wins

• Before adopting any SKILL.md package, check whether the listing pins a specific commit SHA — if you can't tell which version you're evaluating, you can't trust the vetting.
• Run every new skill with-and-without on the same task in a sandbox before rolling it out; a measurable Lift in percentage points beats a star count every time.

Why this is different

• Independent testing lab — not a marketplace selling listings
• Lift published in percentage points, tested with and without each skill
• Money never touches trust scores — zero pay-to-rank
• Every version pinned to a commit SHA for reproducibility
• Security, license, quality, and maintenance signals in one 0-100 score
• Per-agent loadouts: agents only see what you explicitly chose
• Continuous upstream tracking with re-scan, re-benchmark, and notifications
• Same-model sandbox benchmarks for apples-to-apples comparisons

Built by AIQ Labs' independent testing lab. Join the waitlist alongside developers preparing for an ecosystem of 9,652+ registered MCP servers.

The commit-SHA pinning and security scan workflow is exactly what I wanted for vetting SKILL.md packages before they touch my agents. With ~of skills carrying at least one vulnerability, I can't afford to trust READMEs — I need to know exactly which version was scanned and what the license check said. — Marcus Delgado

Seeing Lift in percentage points instead of vague star ratings changes how I pick skills. With-and-without sandbox testing on the same model is the comparison I've been doing by hand for months — and knowing Lift is always shown separately from ratings means the numbers aren't for sale. — Priya Raghavan

Per-agent loadouts through a single MCP server are the control I need — my coding agent and my chat agent see completely different toolsets, and the agent only sees what I explicitly toggled on. Combined with the trust score, I know exactly why each skill was allowed in. — Elena Vasquez

Frequently asked questions

What does SkillzBench actually test about an MCP server or agent skill?

SkillzBench verifies every skill version by pinning it to a commit SHA, then runs validation, license checks, security scans, and quality judgments. It also benchmarks each skill in a sandbox with the same model, with and without the skill, and publishes the Lift in percentage points. At launch, scope covers instruction-only skills (SKILL.md plus text references); script-bearing skills are listed link-out only.

How does the trust score work, and can vendors pay for a better rating?

The trust score runs 0-100 and combines security, quality, license, maintenance, and community signals. Lift is always shown separately from ratings, and money never touches scores — there is no pay-to-rank mechanism. That independence is the core of SkillzBench's role as a testing lab rather than a marketplace.

With so many MCP security vulnerabilities like tool poisoning and prompt injection, how does SkillzBench help?

Security complexity is the top challenge for half of MCP adopters, and published research found roughly of agent skills carry at least one vulnerability. SkillzBench addresses this with automated security scanning on every pinned version, plus per-agent loadouts through one MCP server so an agent only sees the skills and tools you explicitly enabled — shrinking the attack surface per agent.

When can I start using SkillzBench, and what will it cost?

SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live now. The planned pricing includes a generous free tier, Pro at roughly $9-15/month for more agents and unlimited enabled skills, Teams at $15-25/seat/month for org loadouts, allowlists and audit, and Creator at $5-10/month for verified authors.

How is SkillzBench different from browsing the official MCP Registry or GitHub directly?

The official MCP Registry lists thousands of servers, and GitHub hosts mcp-server repositories — but neither tells you whether a skill actually helps or is risky. SkillzBench dedupes crawled skills, pins versions to commit SHAs, security-scans and quality-judges them, and publishes measured Lift from sandbox benchmarks, so you get evidence instead of raw listings.