MCP Server Discovery for Teachers

SkillzBench is building the independent testing lab for the Model Context Protocol ecosystem — discovering, verifying, and benchmarking MCP servers and agent skills so you can trust what you install.

The MCP Gold Rush Is a Minefield

Minefield

Most Listed MCP Servers and Skills Are Junk — Are Invalid or Low-Value

Directories keep ballooning — MCP.so catalogs over 21,000 public MCP servers and Glama.ai lists over 23,000 — but a 14-day MCPCrawler study aggregating 17,630 raw entries found that more than half of listed MCP projects are invalid or low-value, inflated by placeholders and abandoned prototypes. The same signal-free sprawl is now hitting agent skills: SKILL.md packages are multiplying across GitHub with no way to tell which ones actually improve agent performance. When 58% of MCP builders are just wrapping existing APIs, catalog size tells you nothing about quality.

Security Risks Are Baked Into the MCP Workflow — Hard-Coded Keys and ~of Skills Carry Vulnerabilities

Hard-coded keys

MCP server installation is widely described as a 'Byzantine nightmare' of copying JSON blobs and hard-coding API keys into configuration files. Worse, malicious actors can craft prompts that manipulate AI agents into exposing sensitive data from MCP servers — a human-in-the-loop gap that context engineering alone can't fix. Published research found ~of agent skills carry at least one vulnerability, meaning teams are routinely wiring unvetted instruction packages into agents with access to production systems.

Tool Discovery Keeps Failing — Agents Can't Find or Call the Right Tools

Frequent failed calls

LLM-backed tools often fail to discover and call tools exposed by MCP servers, especially for novel products with new vocabulary. Developers resort to 'secret incantations' of careful prompt engineering just to trigger the right tool, and incomplete tool descriptions cause agents to make incorrect or excessive calls. With 63% of MCP users syncing to data sources like documentation and knowledge bases, every failed tool call compounds into wasted tokens, broken workflows, and agents that hallucinate around the very capabilities you installed them to use.

How SkillzBench <span class="gradient">Transforms</span> MCP Server Discovery

An independent control panel for AI agent skills — built to tell you which MCP servers and skills actually help, and which are risky.

SkillzBench is AIQ Labs' independent testing lab and control panel for AI agent skills. We're building five pillars: Discover (continuously crawling and deduping skills from GitHub), Verify (pinning every version to a commit SHA with license checks and security scans), Benchmark (testing every skill in a sandbox with the same model, with and without the skill, and publishing the Lift in percentage points), Equip (one MCP server plus per-agent loadouts so your agent only sees what you chose), and Stay current (tracking upstream changes, re-scanning, and notifying you). The MCP ecosystem has exploded — <a href='https://nordicapis.com/10-interesting-mcp-statistics/' target='_blank' rel='noopener'>MCP server downloads grew from ~100,000 in November 2024 to over 8 million by April 2025</a> — and SkillzBench exists to bring order, evidence, and trust to that chaos.

• Discover: continuously crawl and dedupe skills from GitHub so you see the real ecosystem, not placeholder noise
• Verify: pin every version to a commit SHA, validate, license-check, security-scan, and quality-judge before it reaches you
• Benchmark: test every skill in a sandbox with the same model, with and without the skill, and publish the Lift in percentage points

Why MCP Builders <span class="gradient">Choose SkillzBench</span>

Evidence, Not Marketing Hype

When more than half of listed MCP projects are invalid or low-value, you need a source that tests rather than catalogs. SkillzBench is building its Benchmark pillar to test every skill in a sandbox with the same model, with and without the skill, and publish the Lift in percentage points. Because Lift is always shown separately from ratings — and money never touches scores — you get a clean, comparable measure of whether a skill actually helps your agent, not marketing hype.

Security Scanning Before You Install

Published research found ~of agent skills carry at least one vulnerability — and SkillzBench's Verify pillar is being built to catch them before they reach your agent. Every skill version is pinned to a commit SHA, then license-checked, security-scanned, and quality-judged, feeding a trust score from 0-100 built on security, quality, license, maintenance, and community signals. Instead of blindly pasting JSON config blobs, you'll know exactly what you're installing and where it came from.

One MCP Server, Per-Agent Loadouts

Instead of juggling fragmented MCP clients and configuration blobs, SkillzBench is building Equip: one MCP server plus per-agent loadouts. You toggle skills and tools per agent, and the agent only sees what was chosen — no more hard-coded API keys, no more agents stumbling over tools they were never meant to call. And with Stay Current, SkillzBench will track upstream changes, re-scan, re-benchmark, and notify you when a skill you rely on shifts under your feet.

How it works

1. Join the Waitlist — SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live. Sign up to follow discovery, verification, and benchmarking progress as each pillar ships.
2. Get Early Access to the Pillars — As the Discover, Verify, and Benchmark pillars roll out, waitlist members see which skills are crawled, deduped, security-scanned, and benchmarked first — with trust scores and Lift published for every entry.
3. Equip Your Agents with Confidence — Use one MCP server plus per-agent loadouts to toggle exactly the skills and tools each agent sees, backed by trust scores 0-100 and benchmark Lift data — and stay current as upstream changes are tracked and re-benchmarked.

What you get

• Continuous Discovery: SkillzBench crawls and dedupes agent skills from GitHub, filtering out the placeholders and abandoned prototypes that inflate other MCP server directories
• Rigorous Verification: every version is pinned to a commit SHA, validated, license-checked, security-scanned, and quality-judged before it earns a listing
• Sandbox Benchmarking: each skill is tested with the same model, with and without the skill, and the Lift is published in percentage points so you can see real impact
• Trust Score 0-100: security, quality, license, maintenance, and community signals combine into one score — and money never touches the ratings
• Per-Agent Loadouts: one MCP server plus loadouts let you toggle skills and tools per agent, and the agent only sees exactly what you chose
• Stay Current: upstream changes are tracked, skills are re-scanned and re-benchmarked, and you're notified when something you rely on changes

Quick wins

• Check the trust score before installing any skill — a 0-100 signal built on security, quality, license, maintenance, and community signals replaces hours of manual GitHub vetting.
• Compare Lift in percentage points, not star ratings — SkillzBench will always show benchmark Lift separately from trust scores, so a well-marketed skill can't hide behind hype.

Why this is different

• Independent testing lab, not another crowded MCP directory
• Every skill benchmarked with and without it, in identical sandboxes
• Lift published in percentage points, always separate from ratings
• Trust scores 0-100 — money never touches the scores
• Every version pinned to a commit SHA for full traceability
• One MCP server with per-agent loadouts, not config-file chaos
• Upstream changes tracked, re-scanned, re-benchmarked, and notified
• Backed by AIQ Labs' AI expertise, built as a public control panel

Built by AIQ Labs as the independent testing lab for AI agent skills — with ~of published skills found to carry at least one vulnerability, the waitlist is the place to get proven skills first.

I've burned entire afternoons on MCP server installation only to find the tool descriptions were too ambiguous for my agent to call anything correctly. A lab that benchmarks every skill in a sandbox — same model, with and without the skill — and publishes the Lift in percentage points is exactly what this ecosystem needs. — Marcus Delgado

The trust score concept sold me — security, license, maintenance, and community signals in one 0-100 number, with the benchmark Lift shown separately. No directory I've used gives me both, and most can't tell a real server from a marketing placeholder. Knowing every version is pinned to a commit SHA changes how I'd evaluate skills entirely. — Priya Raghavan

Per-agent loadouts are the feature I've been waiting for. One MCP server where I toggle skills and tools per agent, and the agent only sees what I chose — that replaces the JSON blob juggling and hard-coded API keys I've been living with. And having upstream changes tracked and re-benchmarked automatically means I stop babysitting my config. — Elena Kovacs

Frequently asked questions

What is MCP protocol, and why does server discovery matter for it?

The Model Context Protocol (MCP) is a standard that lets AI agents discover and call tools exposed by MCP servers. The problem is discovery quality: a 14-day MCPCrawler study found more than half of listed MCP projects are invalid or low-value, so builders need a trusted source that verifies and benchmarks servers rather than just cataloging them. That's the gap SkillzBench's Discover and Verify pillars are being built to close.

How does SkillzBench benchmark MCP servers and agent skills?

Every skill is tested in a sandbox with the same model, once with the skill and once without, and the difference is published as the Lift in percentage points. The Lift is always shown separately from ratings, and money never touches trust scores — so you get an honest, evidence-based picture of whether a skill actually helps your agent.

Are there real MCP security vulnerabilities I should worry about?

Yes. Published research found ~of agent skills carry at least one vulnerability, and hard-coding API keys into JSON config files creates serious exposure risks. Malicious actors can also craft prompts that manipulate AI agents into leaking sensitive data from MCP servers. SkillzBench's Verify pillar security-scans every skill, pins versions to commit SHAs, and feeds a trust score from 0-100 built on security, quality, license, maintenance, and community signals.

When can I actually use SkillzBench, and what does rollout look like?

SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live now, and the product itself is not yet public. The launch scope is instruction-only skills (SKILL.md plus text references), with script-bearing skills listed link-out only. Joining the waitlist gets you progress updates and early visibility as each pillar ships.

How is SkillzBench different from MCP server directories like MCP.so or Glama.ai?

Directories catalog; SkillzBench tests. MCP.so lists over 21,000 public servers and Glama.ai over 23,000, but neither benchmarks skills in a sandbox, publishes Lift in percentage points, or pins every version to a commit SHA. SkillzBench also adds Equip — one MCP server plus per-agent loadouts — and tracks upstream changes with re-scans and re-benchmarks, which pure directories don't offer.