Question 1

What is Aescut?

Accepted Answer

Aescut is a curated registry of AI skills and MCP servers. It helps teams check permissions, supply-chain trust, maintainer reputation, and review status before they install tools that run inside AI coding agents. The project publishes a website, public feeds, a JSON catalog, and an MCP server so both humans and agents can look up the same trust data.

Question 2

Is Aescut free?

Accepted Answer

Aescut is a curated registry of AI skills and MCP servers. It helps teams check permissions, supply-chain trust, maintainer reputation, and review status before they install tools that run inside AI coding agents. The project publishes a website, public feeds, a JSON catalog, and an MCP server so both humans and agents can look up the same trust data.

Question 3

How often is the registry updated?

Accepted Answer

Aescut is a curated registry of AI skills and MCP servers. It helps teams check permissions, supply-chain trust, maintainer reputation, and review status before they install tools that run inside AI coding agents. The project publishes a website, public feeds, a JSON catalog, and an MCP server so both humans and agents can look up the same trust data.

Question 4

What is an AI skill?

Accepted Answer

An AI skill is a reusable bundle of instructions, examples, scripts, and optional metadata that teaches an agent how to perform a focused job well. It is usually loaded from the local filesystem or a repository, not discovered dynamically over a network protocol during each tool call. Skills are best when the capability is mostly behavioral: how to investigate, how to structure output, how to review code, or how to orchestrate existing tools safely.

Question 5

What is an MCP server?

Accepted Answer

An MCP server is a program that exposes tools, prompts, or resources to an AI client over the Model Context Protocol. Instead of packaging instructions for the agent to read once, it stays available as a live integration the client can call during a session. That makes MCP servers the right abstraction for databases, browsers, file systems, SaaS APIs, issue trackers, and other capabilities that need runtime interaction.

Question 6

What is the difference between a skill and an MCP server?

Accepted Answer

Use a skill when you want reusable instructions. Use an MCP server when you want live tools or external data. Many serious agent setups need both: a skill tells the model how to work, and an MCP server gives it the runtime capability to act. Confusing the two leads to bad onboarding. Teams either expect a markdown bundle to behave like a tool integration, or they treat a live server as if it were just passive documentation.

Question 7

What permissions do skills have?

Accepted Answer

Skills and MCP servers inherit the permissions of the host agent and client configuration around them. If the client can read files, run shell commands, call the network, or access OAuth-backed services, the tool layer can often reach those capabilities too. The real question is not “does it have permissions in theory?” but “what exact host, config, scope, and approval model is wrapped around it?”

Question 8

Can a skill access my files?

Accepted Answer

Skills and MCP servers inherit the permissions of the host agent and client configuration around them. If the client can read files, run shell commands, call the network, or access OAuth-backed services, the tool layer can often reach those capabilities too. The real question is not “does it have permissions in theory?” but “what exact host, config, scope, and approval model is wrapped around it?”

Question 9

Can a skill make network requests?

Accepted Answer

Skills and MCP servers inherit the permissions of the host agent and client configuration around them. If the client can read files, run shell commands, call the network, or access OAuth-backed services, the tool layer can often reach those capabilities too. The real question is not “does it have permissions in theory?” but “what exact host, config, scope, and approval model is wrapped around it?”

Question 10

Can a skill execute shell commands?

Accepted Answer

Skills and MCP servers inherit the permissions of the host agent and client configuration around them. If the client can read files, run shell commands, call the network, or access OAuth-backed services, the tool layer can often reach those capabilities too. The real question is not “does it have permissions in theory?” but “what exact host, config, scope, and approval model is wrapped around it?”

Question 11

Are skills safe to install?

Accepted Answer

No AI tool is safe just because it has a nice README. Skills and MCP servers can be well built and still be dangerous in the wrong host, with the wrong auth, or without a realistic review of what they can touch. The safe path is to verify maintainer identity, runtime permissions, freshness, install method, and client guardrails before enabling the tool.

Question 12

How do I install a skill on Claude Code?

Accepted Answer

Claude Code does not currently document a dedicated “install skill from URL” workflow in the way Codex does. The current official customization primitives are slash commands in .claude/commands/ or ~/.claude/commands/ , plus shared project instructions in CLAUDE.md and live integrations through MCP. If an Aescut entry is a plain skill rather than an MCP server, the practical move is to port its instructions into a slash command or project memory file instead of looking for a hidden claude skill add command.

Question 13

How do I install a skill on OpenAI Codex?

Accepted Answer

Codex has a real skill system. According to the current OpenAI docs, Codex reads skills from repository, user, admin, and system locations, and OpenAI’s skill installer can add curated or external skills for you. The safest path is to install a reviewed skill, keep it in the narrowest scope that makes sense, and restart Codex if the newly added skill does not appear immediately.

Question 14

How do I install an MCP server on Claude Code?

Accepted Answer

Claude Code officially supports MCP in both project and user scopes. You can add servers through the Claude CLI or by editing the JSON config files that Anthropic documents for Claude Code. The minimum working config is still the familiar command plus args block inside mcpServers .

Question 15

How do I install an MCP server on Claude Desktop?

Accepted Answer

Claude Desktop reads MCP server definitions from a local JSON config file. The current MCP quickstart documents the config paths on macOS and Windows and uses the same mcpServers structure that other clients use. The most common failure is not the JSON itself. It is a bad executable path, especially on macOS setups where the GUI app does not inherit the same shell environment as your terminal.

Question 16

How do I install an MCP server on Cursor?

Accepted Answer

Cursor supports MCP through .cursor/mcp.json for project scope and ~/.cursor/mcp.json for global scope. The official docs also support one-click install links and programmatic registration through the extension API. For most teams, plain JSON config is still the most transparent path because it is versionable, reviewable, and easy to diff.

Question 17

How do I install an MCP server on Windsurf?

Accepted Answer

Windsurf supports MCP natively through the Cascade panel and Windsurf settings. The official docs also note that you can edit the raw mcp_config.json file directly when you want full control. One practical constraint matters immediately: Windsurf caps the number of tools available to Cascade at one hundred at a time, so over-installing servers creates real usability problems.

Question 18

How do I install an MCP server on VS Code with GitHub Copilot?

Accepted Answer

VS Code now has first-class MCP support. You can add servers in the workspace file .vscode/mcp.json , in your user profile via the Command Palette, through the MCP gallery, or through install links that target the built-in MCP flow. It is also the most explicit mainstream client about trust and sandboxing, which makes it a good reference point for teams that care about least privilege.

Question 19

How do I install the Aescut MCP server?

Accepted Answer

The cleanest path is the Aescut installer package. It writes a generic agent bundle containing an MCP config snippet plus the guard prompt, and it can optionally patch Claude Desktop directly. It does not claim to auto-modify every AI client on earth. If you prefer full control, you can also add the Aescut MCP manually by pointing a client at @aeptus/aescut --skip-install with the right launcher and CMS URL.

Question 20

What tools does the Aescut MCP server provide?

Accepted Answer

The Aescut MCP server is read-only. It does not install arbitrary third-party tools for you. Its current job is to help an agent look up entries, search the registry, summarize categories, and compute a conservative risk recommendation before the user proceeds. That is a deliberate boundary: Aescut is the trust and policy layer first, not a blind package manager.

Question 21

What does check_risk actually return?

Accepted Answer

The Aescut MCP server is read-only. It does not install arbitrary third-party tools for you. Its current job is to help an agent look up entries, search the registry, summarize categories, and compute a conservative risk recommendation before the user proceeds. That is a deliberate boundary: Aescut is the trust and policy layer first, not a blind package manager.

Question 22

How does Aescut review skills and MCP servers?

Accepted Answer

Aescut treats registry entries as security-sensitive software, not as casual community bookmarks. Review combines structured metadata, automated analysis, provenance checks, and manual judgment where the risk justifies it. A core principle is that a review must be tied to a specific code state. A review that is not pinned to a commit becomes marketing copy the moment the repository changes.

Question 23

What happens when a reviewed skill gets a new commit?

Accepted Answer

Aescut treats registry entries as security-sensitive software, not as casual community bookmarks. Review combines structured metadata, automated analysis, provenance checks, and manual judgment where the risk justifies it. A core principle is that a review must be tied to a specific code state. A review that is not pinned to a commit becomes marketing copy the moment the repository changes.

Question 24

What do the risk levels mean?

Accepted Answer

Aescut risk levels are decision aids, not absolutes. They summarize how much caution a team should bring to a tool based on permissions, maintainer trust, supply-chain signals, and the freshness of the assessment. Trusted maintainer status and staleness signals matter because the same technical capability can be far safer in an official, actively maintained server than in an unreviewed copycat fork.

Question 25

What is a trusted maintainer?

Accepted Answer

Aescut risk levels are decision aids, not absolutes. They summarize how much caution a team should bring to a tool based on permissions, maintainer trust, supply-chain signals, and the freshness of the assessment. Trusted maintainer status and staleness signals matter because the same technical capability can be far safer in an official, actively maintained server than in an unreviewed copycat fork.

Question 26

How do I submit a skill or MCP server for review?

Accepted Answer

Submit through the public Aescut submission flow and come prepared with the real source of truth: repository URL, install method, maintainer identity, permissions, and enough documentation for an auditor to understand what the tool actually does. The more structured the metadata is, the faster and more credibly the tool can be reviewed.

Question 27

What is supply chain risk in AI tools?

Accepted Answer

Supply-chain risk in AI tooling is the risk that the code, releases, maintainers, or install path behind a skill or MCP server are compromised, abandoned, or simply not what they claim to be. The danger is amplified because these tools often sit one layer closer to your actual development environment than ordinary libraries do: they can read files, execute commands, and send data out through your agent workflow.

Question 28

What should I check before installing a skill?

Accepted Answer

Before you install, answer five questions: who maintains it, how it installs, what permissions it needs, how fresh the review is, and where your auth or secrets will flow once it is enabled. If you cannot answer those clearly, the burden of review is on you, not on the tool author.

Question 29

What is the Model Context Protocol (MCP)?

Accepted Answer

MCP is an open protocol for connecting AI clients to external tools, prompts, and data. It standardizes how clients discover capabilities and invoke them so every vendor does not have to invent a new plugin system from scratch. If skills are reusable instructions, MCP is the runtime plumbing that lets agents talk to live integrations.

Question 30

Can I use the registry data in my own project?

Accepted Answer

Yes. Aescut publishes reusable registry data and machine-readable outputs specifically so teams can consume the trust layer in their own tools. The content license is CC BY-SA 4.0, which means attribution and share-alike obligations apply. The practical question is less “can I use it?” and more “which output best fits my use case: website, JSON catalog, feed, or MCP?”.

Question 31

Is there an API?

Accepted Answer

Yes. Aescut publishes reusable registry data and machine-readable outputs specifically so teams can consume the trust layer in their own tools. The content license is CC BY-SA 4.0, which means attribution and share-alike obligations apply. The practical question is less “can I use it?” and more “which output best fits my use case: website, JSON catalog, feed, or MCP?”.

High-signal answers about skills, MCP servers, and Aescut

Getting Started

Skills And MCP Basics

Security And Trust

Installation

Aescut MCP

For Maintainers

Data And API

High-signal answers about skills, MCP servers, and Aescut

FAQ topics

Getting Started

Skills And MCP Basics

Security And Trust

Installation

Aescut MCP

For Maintainers

Data And API