Menu

MCP

Your agent. Our radar.

Bring skill discovery into the tools you already use. Search the leaderboard and inspect a repository before you install it.

Available nowAPI key required

Use your own API key when connecting. All requests require authentication.

Connect your AIYour assistant. Our skill catalog.

Copy this prompt into your assistant to connect hotskills. You need an MCP key from your account; keep it out of the chat.

Read https://hotskills.dev/agent-setup/prompt.md and follow the hotskills connection setup for this assistant. Preserve existing settings, keep credentials private, and verify the connection with a read-only search. Do not install skills or cast votes.

Read instructionsGet your MCP key

Set the key privately

These Bash/zsh commands prompt for your key without displaying it or putting its value in the command history. Paste the full key only at that hidden terminal prompt, then press Enter. HOTSKILLS_API_KEY is the variable name; its value is your private key. On other shells or desktop apps, use their private environment or secret settings.

{
printf 'hotskills MCP key (hidden): '
IFS= read -r -s HOTSKILLS_API_KEY
printf '\n'
export HOTSKILLS_API_KEY
}

Launch the client from this same environment. A terminal export lasts only for that session and child processes; it does not configure an already running desktop app. Existing working bindings such as HOTSKILLS_MCP_KEY are valid if both the variable and client configuration use that same name. Do not print the value to troubleshoot.

Connect your client

Claude Code

After setting the private environment variable, run this command in Bash or zsh. Keep the single quotes and ${HOTSKILLS_API_KEY} reference exactly as shown: Claude resolves it when connecting. This adds a user-scoped server; preserve an existing working entry.

claude mcp add --scope user --transport http hotskills 'https://hotskills.dev/mcp' --header 'Authorization: Bearer ${HOTSKILLS_API_KEY}'
Official client documentation

Codex

After setting the private environment variable, add the HTTP server. HOTSKILLS_API_KEY is the variable NAME, not your key. In the Codex settings field for bearer-token environment variable, enter HOTSKILLS_API_KEY exactly; never paste the secret there. For TOML, use bearer_token_env_var = "HOTSKILLS_API_KEY". Preserve an existing working entry.

codex mcp add hotskills --url 'https://hotskills.dev/mcp' --bearer-token-env-var HOTSKILLS_API_KEY
Official client documentation

Cursor

Merge this server into your personal ~/.cursor/mcp.json without replacing other servers. Keep ${env:HOTSKILLS_API_KEY} literally: Cursor reads the variable from its own process environment. Fully quit Cursor and launch it from the environment containing the key; restarting from a desktop icon may not inherit a terminal variable.

{
    "mcpServers": {
        "hotskills": {
            "url": "https://hotskills.dev/mcp",
            "headers": {
                "Authorization": "Bearer ${env:HOTSKILLS_API_KEY}"
            }
        }
    }
}
Official client documentation

Verify the connection

Refresh or reopen the client after configuring it. Check that hotskills is connected and its tools are available in the current session. A saved configuration alone does not prove authentication. In Claude Code, inspect /mcp; use the MCP status view in your other client.

Use the hotskills MCP server to search for testing skills, with at most one result. Report whether the request succeeded. Do not install anything, run a scan or cast a vote.

An empty successful search is valid. check_skill is optional: inspect tools/list before using it. An advertised tool does not prove that its worker can finish a check. A separate HTTP test does not prove the client has loaded the tools.

Connection help

Environment variable not found
The bearer-token setting needs the name HOTSKILLS_API_KEY, never the secret itself. Set that variable in the environment of the client process. Check presence only; do not print configuration or credential values.
401 Unauthorized
Check that the variable is available to the client and contains a valid, active hotskills MCP key. GitHub sign-in belongs to Account; MCP uses the key, not your GitHub password or token. Do not start an unrelated OAuth flow.
Configured, but no tools appear
Refresh the MCP connection or reopen the client from the environment containing the key. Check which configuration scope is active and preserve other servers. Tools may not be loaded in an already open conversation.
429 or 503
429 means a request limit was reached; respect Retry-After. 503 means the service is temporarily unavailable. Do not repeatedly retry or create new keys to evade limits.
Lost or exposed key
Open Account, revoke the old key and create a new one. Update the private environment binding. The old full key cannot be displayed again.
Repository found, but no security report or install command
A repository can be listed before a current, complete catalog scan is published. Unknown security fields or a null installation command are not a clean security result. check_skill produces a separate private report; it does not fill or refresh the public catalog. Hot voting also requires an eligible repository. A done check can still contain complete=false for a skill: read its notes before relying on it.

What your agent can ask

search_skills
Find skill repositories for a task, agent or category.
get_skill
Read a repository overview, included skills and history.
trending
Compare repositories by recent growth.
install_command
Get installation instructions tied to a recorded commit.
security_report
Inspect automatic signals with links to source files.
vote_hot
Confirm or change your weekly community vote after explicit approval in your MCP client.
hot_this_week
Read the weekly community picks and archived weeks.
my_skills
Read your My skills list, with install commands pinned to the checked commit for the skills that are still safe to install.
save_skill
Add a skill to your My skills list after explicit approval in your MCP client.

Tools never change catalog data. The only writes are your weekly Hot vote and your own My skills list, always after your confirmation.

Check a skill with check_skill

An activated MCP server with check_skill enabled can run the engine used for hotskills security reports. Give it a public GitHub repository, or the selected files of a skill you are writing, to inspect its safety level, findings and analysis facts.

Checks require both an activated MCP server and the check_skill tool in its tools/list response. General MCP access alone does not enable checks.

Ask your agent

Check example-org/release-notes-skill with hotskills before I install it.

Your agent calls

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "check_skill",
    "arguments": { "repo": "example-org/release-notes-skill", "ref": "main" }
  }
}

Larger checks answer pending with a job id; your agent calls check_skill again with that job to read the report.

Checks use temporary private worker storage without executing the skill. Submitted material is not added to the catalog. Consumed reports are removed and jobs expire. Each key has hourly and daily check limits. Automated signals, not a guarantee.

Smokecheck, our command-line client and GitHub Action, calls this same remote tool with your key. It requires check_skill to be advertised and its workers to be running.

Read the Scanner guide for web, terminal and CI →

Start with a question

Find a skill for reviewing a pull request. Show its recent growth and security signals before suggesting an installation.

Hot this week

Each eligible GitHub account has one vote per week, Monday to Sunday in Europe/Rome. Change your choice during the week. Your agent must ask for explicit confirmation through MCP. Accounts must be at least 30 days old; you cannot vote for your own repository. Security and abuse checks apply. Paid placements never influence the result.

Hot votes