SkillLite MCP
Rust OS-level sandbox and MCP server for agent skills: process isolation, install-time scanning and self-evolution
- 152 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The engine executes skills and commands on your machine, and protection depends on OS isolation
- Evolution mode changes prompts and memory and generates skills automatically
Install
- Works in
Manual install
pip install "skilllite[mcp]"Then skilllite mcp starts a stdio server, and skilllite init-cursor and skilllite init-opencode wire the host.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The engine executes skills and commands on your machine, and protection depends on OS isolation
- Evolution mode changes prompts and memory and generates skills automatically
This is third-party code. Review the repository files before installing.
What it does
SkillLite is a Rust engine that runs agent skills inside a built-in operating-system sandbox. The recommended path is pip install skilllite and connecting it as an MCP server to Cursor, Claude Desktop, OpenCode or your own agent. The full agent loop and the desktop app are not needed for that. Protection covers the whole skill lifecycle. At install it runs a static scan, model analysis and a supply-chain check. Before execution it asks for a two-phase confirmation and checks integrity. At runtime OS-native isolation applies (Seatbelt, bwrap, seccomp): a process allowlist, filesystem, network and IPC lockdown, and CPU and memory limits. The other half of the project is self-evolution. An immutable core (agent loop, model orchestration, tool execution) is compiled into the binary and never rewrites itself. Evolvable data (prompts, memory of task patterns and failures, auto-generated skills) improves through a feedback, reflect, evolve, verify cycle. Every change passes through the same sandbox. A lighter skilllite-sandbox binary with only the sandbox and MCP is also available.
Who it is for. Agent developers who run third-party skills and want OS-level isolation instead of trusting the code on faith.
Good fit when
- Skills from external catalogs must run in an isolated environment
- Cursor or Claude Desktop needs an MCP server with a sandbox for tools
- A skill must be checked at install: static scan and model analysis
- An agent accumulates rules and skills and their changes must pass verification
Not a fit when
- You only need a skill list with no execution: the project is code and not a catalog
- You need isolation on Windows: the README describes Seatbelt, bwrap and seccomp, so macOS and Linux
- You need a hosted cloud service: SkillLite runs locally
Example request
Connect SkillLite to Cursor as an MCP server and run skills from the external catalog only inside the sandboxMCP
- Transport
- stdio
- Authentication
- not required
Limitations
The repository is large (about 260 MB) with several entry points (CLI, Python SDK, sandbox, desktop app), so start with the sandbox and MCP path. The graphical app moved to a separate skilllite-assistant folder. The 20 out of 20 security score comes from the author's own test suite. Building from source needs Rust, while the pip route needs only Python. The author calls the sandbox and MCP path the main one, and other features such as self-evolution and the Python SDK have separate guides in the docs folder.
How to disable. Remove the package with pip uninstall skilllite and the MCP server entry from the Cursor, Claude Desktop or OpenCode configuration. Delete folders with accumulated memory and skills by hand.
FAQ
How do I connect SkillLite to Cursor or Claude Desktop?
Install with pip install skilllite, run skilllite mcp and wire the host with skilllite init-cursor or skilllite init-opencode. Claude Desktop has a guide in tutorials/06_mcp_server.
How does skilllite-sandbox differ from skilllite?
Skilllite includes evolution, the agent, the sandbox and MCP. Skilllite-sandbox weighs about 3.6 MB and holds only the sandbox and MCP, so any agent framework can adopt it.
Which isolation mechanisms does it use?
Seatbelt on macOS, bwrap and seccomp on Linux. They set a process allowlist, lock down filesystem, network and IPC access, and cap CPU and memory.
What does self-evolution mean in SkillLite?
A feedback, reflect, evolve, verify loop changes data only: prompts, memory of patterns and failures and generated skills. The core in the binary stays immutable, and all changes go through the sandbox.
Which models and frameworks are supported?
The README lists supported model providers and agent framework integrations in the Usage section. The MCP server itself works with any MCP client.
Discussion
No questions or reviews yet.
Related
MCP serversSecurity scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A security scanner for AI agent skills: static analysis, LLM review and runs of suspicious skills in a Docker sandbox.
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A security scanner for MCP servers and agent skills that looks for prompt injection, secret leaks and swaps after approval.
The SkillHawk static scanner finds dangerous instructions in SKILL.md, MCP configs and AGENTS.md and runs as a GitHub Action
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| SkillLite (this card) | no | not required | 152 | |
| sandbox-mcp | no | 422 | a code-execution sandbox only, with no skill scanning | |
| LLM Sandbox MCP | no | not required | 1,143 | container-based code execution isolation |
| Agent-Sandbox | no | key is optional | 232 | a sandbox for an agent without evolution |
README in short
The README starts with choosing a path (sandbox and MCP, full stack, desktop), then shows the architecture of an immutable core and evolvable data, protection at every stage, security and speed measurements, pip install and MCP wiring. It ends with tutorials, the Rust crate layout and building from source.