KillerSkills — Control what your agents run

Your agents run other people's code with your keys. Now you decide what it can do.

An MCP server can access credentials, connect to outside hosts, and expose powerful tools to your agent. KillerSkills shows what it did in testing, then lets you restrict supported local servers while they run.

Check an MCP — free, no accountBring the MCP you want to use. Not your credentials.

$npm i -g vet-skills && vet-skills guard install

Install the runtime guard. For supported local stdio servers. Reversible installation.

A server requests your token

The server's environment gets a placeholder instead of the value. The guard keeps the real credential and writes it only into requests to the host the package's own code names, so a server that posts it anywhere else posts a random string, and the attempt is logged.

Illustrative example

guard · holding SUPABASE_ACCESS_TOKEN for supabase.com
        (the server sees a placeholder)
guard · brokered SUPABASE_ACCESS_TOKEN into a request
        to api.supabase.com
guard · ✕ placeholder sent to collect.example.net,
        not bound there; the real value never left

Supported: Credentials passed as environment variables to a local stdio server, bound automatically from the package's verdict, or by hand with --secrets NAME=host. Optionally exchanged for a minutes-long token (GitHub App, AWS STS, GCP) per launch.
Limits: The server must honor HTTPS_PROXY; one that pins certificates is tunnelled opaquely after its first refused handshake and placeholders sent to that host cannot be inspected. Remote (http/sse) servers are not wrapped. Credentials read from files are not brokered.

An agent calls a restricted tool

Your policy names tool patterns and what happens to them: allow, deny, or hold for a person. A held call waits for a decision from the dashboard or Slack; the agent receives the outcome as the tool's reply, and later calls wait their turn behind it.

Illustrative example

runtime:
  tools:
    - match: "delete_*"
      action: approve   # a human decides
    - match: "github/force_push*"
      action: deny
  default_tool_action: allow

guard · holding tools/call delete_branch…
guard · delete_branch approved by k.hijazi

Supported: Rules on tool names (globs, optionally server/tool), per org or per machine. Default org policy holds common destructive verbs.
Limits: Rules match names, not meaning: a tool called run_query can drop a table, and a rule cannot know that. Approval is a human reading the call's argument keys, not an analysis of what the call will do.

A team revokes a version

A version an organization revokes is refused by every enrolled guard at its next launch, with the reason printed for the developer. KillerSkills revokes network-wide when the honeypot confirms an incident.

Illustrative example

guard · ✕ not launching crm (@acme/[email protected]):
  revoked by your organization: placeholder sent
  to collect.example.net on 2 machines
  killerskills.ai/skills/npm/@acme/crm-mcp/1.2.0

Supported: Org-level revoke from the Runtime page; network-wide flags by KillerSkills on confirmed incidents; blocked verdicts refuse by default under policy.
Limits: Existing processes are not terminated: a server already running keeps running until the agent restarts it. Machines that are offline learn of the revocation when they next launch the server.

The examples above are written to show the shape of each situation, not recorded from a customer. The guard documentation lists supported clients and every limit.

Which MCP servers are running across your team, and what are they allowed to do?

Inventory. Every enrolled machine reports the servers its agents actually launch: the package and version, who runs it, which credential variables it was given (names, never values), which hosts it reached. Discovery across GitHub repos and laptops lists what is configured but not yet running.

Policy. One policy applies to every developer's agent: what may install, which tools run freely, which are denied, which wait for a person, whether credentials are brokered or exchanged for short-lived tokens.

Approval records. Every held call, every decision and who made it, every policy change, in a hash-chained audit log you can export and stream to your SIEM. For your access review, a date-bounded pack keeps what was configured, observed, approved and attested in separate files, with deterministic review items and an acknowledgment bound to the records' hash.

Next-launch revocation. Revoke a version once; every guard refuses it the next time an agent starts it. Running processes are not killed, and the developer sees why.

What this does not do

The guard wraps local stdio MCP servers launched from the supported clients' configs. Remote servers (http/sse) are not wrapped; hosted endpoints can be watched for tool-surface changes, which is a different thing.

Brokering needs the server to honor the proxy. A client that pins certificates is tunnelled opaquely after its first refused handshake, and placeholders sent to that host cannot be inspected. The guard says so when it happens.

A Verified verdict covers what ran. “Startup only” means the server was started and answered the handshake; its tools were not exercised with a real credential. Coverage is printed beside every label for this reason.

Tool rules match names, not intent. Revocation applies at the next launch, not to running processes. None of this prevents every exfiltration; it makes the common paths visible and the credential worthless where it can.

Your agents run other people's code with your keys. Now you decide what it can do.

Three things that happen on a developer's machine, and what the guard does about each.

A server requests your token

An agent calls a restricted tool

A team revokes a version

Which MCP servers are running across your team, and what are they allowed to do?

What deploying it means

Everything above links to something you can check.

A real verdict

How the testing works

Which clients and servers are supported

A public correction

What this does not do

Verdicts, as they land.