Agent Reliability Skills MCP
The Trustabl Forge MCP server writes a reliability skill for your repository, so SDK rules apply while code is written.
- 62 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The server downloads and runs a binary analyzer, reads dependency files and can write `SKILL.md` into the repository.
Install
- Works in
Manual install
claude mcp add agent-reliability-skills -- npx -y https://github.com/trustabl/agent-reliability-skills/releases/download/v0.1.0-rc.3/agent-reliability-skills-0.1.0-rc.3.tgzThe command from the Claude Code section of the README; Node.js 22 or newer is required.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server downloads and runs a binary analyzer, reads dependency files and can write `SKILL.md` into the repository.
This is third-party code. Review the repository files before installing.
What it does
The server reads the repository dependency manifests (`package.json`, `pyproject.toml`, `requirements.txt`, `go.mod` and others), finds the agent SDKs in use and builds a `SKILL.md` from Trustabl detection rules for those SDKs. An agent that reads the skill applies the rules while working instead of receiving findings after a scan. One tool, `trustabl_forge`, takes the repository path and returns a short summary and the skill text. It writes a file only when `output_path` is given, usually `.claude/skills/trustabl-pre-coding/SKILL.md`. Covered are the Claude Agent SDK, OpenAI Agents SDK, Google ADK, MCP, LangChain, LangGraph, CrewAI, Pydantic AI, the Vercel AI SDK and AutoGen.
Who it is for. Teams building agents on the Claude Agent SDK, LangGraph or CrewAI who want their coding agent to know typical reliability pitfalls up front.
Good fit when
- A project uses several agent SDKs and needs one skill with rules for exactly those.
- Dependencies changed and a stale skill must be regenerated: a previously generated file gets replaced.
- You want the rules before writing code instead of triaging scanner findings.
- Cursor or Claude Desktop is attached to a repository whose path is passed explicitly.
Not a fit when
- A fixed ready-made skill is wanted: here it is built per repository and changes with dependencies.
- The server must stay offline: the first call downloads the analyzer and the rules repository.
- A project has no agent SDKs: the rules have nothing to attach to.
Example request
Generate the Trustabl reliability skill for this repository and write it to `.claude/skills/trustabl-pre-coding/SKILL.md`.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
TRUSTABL_VERSION- Analyzer version: a tag or `latest`.
GITHUB_TOKENsecret- GitHub token used only to download the analyzer, lifts the anonymous limit.
TRUSTABL_BIN- Path to a local `trustabl` build instead of downloading.
Limitations
Node.js 22 or newer is required. Installation pulls the release archive from GitHub, and the README version is marked as release candidate `v0.1.0-rc.3`. The first call downloads the analyzer for your OS and architecture, verifies it against `checksums.txt` (a mismatch is a hard failure) and caches it in `~/.agent-reliability-skills/`. `GITHUB_TOKEN` is needed only against the anonymous limit of 60 requests an hour. A hand-written file at `output_path` is never overwritten.
How to disable. Run `claude mcp remove agent-reliability-skills` or delete the entry from `.cursor/mcp.json` and the Claude Desktop config. Remove the cache in `~/.agent-reliability-skills/` and the generated `SKILL.md` by hand.
FAQ
How do I connect the server to Claude Code?
Run `claude mcp add agent-reliability-skills -- npx -y https://github.com/trustabl/agent-reliability-skills/releases/download/v0.1.0-rc.3/agent-reliability-skills-0.1.0-rc.3.tgz`.
Do I have to give the repository path?
Not if the client reports its workspace through MCP roots. Otherwise `path` is required: the server never guesses from its own working directory.
What happens on the first call?
The Trustabl analyzer for your OS and the rules repository are downloaded. After that both work from cache offline, and no `git` is needed.
How do I choose the analyzer version?
With `TRUSTABL_VERSION`: a tag such as `v0.1.15` or `latest`. Without it the version pinned by the server runs.
Can I plug in a local build?
Yes, set the path to your own `trustabl` build in `TRUSTABL_BIN` and the download is skipped.
Discussion
No questions or reviews yet.
Related
MCP serversA skill registry for teams with security scanning and versioning; the MCP server finds and installs skills on request.
A command-line skill manager: installs skills from a marketplace, GitHub, private Git and npm into 45 agents' folders and scans them first
A meta-skill that folds rules scattered across AGENTS.md, CLAUDE.md and Cursor files into one project skill with task routes.
A CLI that compiles a SKILL.md file into a standalone Python agent with tools, knowledge-base retrieval and its own runner.
A skill registry with a CLI and API: the agent describes a task and gets a recommendation with a trust score and install command
A CLI that detects your project's stack and installs matching agent skills from a vetted registry in one command
README in short
The README covers Claude Code, Cursor and Claude Desktop. For Desktop you name the repository path in the request, because the app has no project folder.