Arc Security
com.arcself/arc-security is a MCP server that scans AI agent skills across 25 attack classes and supports runtime monitoring.
About
com.arcself/arc-security is an MCP server that lets developers and small teams treat agent skills like installable code: scan SKILL.md and related bundles for 25 attack classes, then keep an eye on behavior at runtime. The registry positions it around a large findings corpus (1,316+ cited), which signals mature rule coverage rather than a one-off linter. Install via npm stdio in Claude Desktop, Cursor, or other MCP clients that support local processes. It is an integration for security reviewers, not a replacement for full app pentests or SOC tooling.
- Covers 25 documented attack classes aimed at agent skill payloads
- Catalog cites 1,316+ historical findings from real scans
- npm stdio package arc-security-mcp (v0.5.1) for local MCP hosts
- Runtime monitoring complements one-off directory scans
- GitHub source: ArcSelf/arc-security-mcp
Arc Security by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
claude mcp add arc-security-mcp -- npx -y arc-security-mcpAdd your badge
Show developers this MCP server is listed on Skillselion. Paste this into your README.
| Package | arc-security-mcp |
|---|---|
| Transport | STDIO |
| Auth | None |
What it does
Audit third-party and custom agent skills for malicious patterns before you wire them into Claude Code or Cursor.
Who is it for?
Best when you're curating many third-party skills for Claude Code and want a dedicated MCP security pass before enabling tools.
Skip if: Skip if you only need generic dependency SAST on a Node repo without any agent-skill surface area.
What you get
You get classified findings on skill packages and ongoing monitoring hooks so you can block or quarantine risky skills before production use.
- Findings mapped to 25 attack classes
- Actionable pass/fail signal per skill package
- Runtime monitoring integration when enabled
By the numbers
- 25 attack classes
- 1,316+ cited findings
- Server version 0.5.1
Recommended MCP Servers
1Claw VaultHSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.2
1passwordMCP server for 1Password service accounts — tools and resources for vaults and credentials18
402sentinel McpAssess an x402 counterparty's risk BEFORE paying: allow/review/block, scored on-chain (Base).1
A2adependencyinspector McpRemote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi
A2a Governance Bridge McpA2A Governance Bridge MCP server.A2aidentitytoll McpRemote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.How it compares
Skill-focused security MCP, not a general code-review skill or OWASP ZAP replacement.
FAQ
Who is com.arcself/arc-security for?
Developers and small teams using Claude Code, Cursor, or similar agents who install skills from registries and want supply-chain scanning via MCP.
When should I use com.arcself/arc-security?
Run it during ship/security whenever you add or update agent skills, especially before granting network or filesystem tools to a new skill.
How do I add com.arcself/arc-security to my agent?
Add the npm stdio server arc-security-mcp (v0.5.1) to your MCP client config pointing at the published package, then invoke its scan tools from your agent session.