Guide
Everything you need to use agentcheck — validate your config, then find, install, and secure skills, MCP servers, and tools for Claude Code.
New to this? MCP is the Model Context Protocol — the open standard that lets an agent talk to outside tools (a database, GitHub, a browser). A skill is a markdown file that teaches your agent how to do a task; a subagent is a specialist it can delegate to; a slash command is a shortcut you type as /name.
1What agentcheck does
agentcheck lints and security-checks AI coding-agent configuration — Claude Code (CLAUDE.md, .claude/agents, .claude/commands, .claude/skills/**/SKILL.md, settings.json) and MCP (.mcp.json). It catches real misconfigurations and security problems (hardcoded secrets, dangerous hooks, curl | sh, over-broad permissions, prompt-injection) before they bite.
2Validate your config (the Validator)
Open the Validator, choose a File kind (or leave auto-detect on), paste or upload your config, and press Validate. Each finding shows line:col, the rule id (links to Rules), and a fixable badge where a safe autofix exists. Nothing is stored — it lints in memory and returns JSON.
From the command line, in your project:
npx @bacnguyenne/agentcheck # lint the whole project npx @bacnguyenne/agentcheck --fix # apply safe autofixes
3Find skills, MCP servers & tools (the Catalog)
The Catalog has 198 vetted building blocks — 104 skills, 24 MCP servers, and 70 tools. Search, filter by kind, and click Preview to read any item.
4Install — three ways
A) CLI (easiest) — installs to the right path; MCP servers merge into your .mcp.json instead of overwriting it:
npx @bacnguyenne/agentcheck add --list # browse every id npx @bacnguyenne/agentcheck add code-reviewer # a subagent npx @bacnguyenne/agentcheck add ship-feature # a workflow skill npx @bacnguyenne/agentcheck add mcp-github # merges into .mcp.json npx @bacnguyenne/agentcheck add mcp-github --dry-run # preview, write nothing npx @bacnguyenne/agentcheck add docx pptx xlsx # a whole bundle at once
B) Download .zip — on the Catalog, click Download .zip, then unzip into your project root. Files land in the correct structure (with a merged .mcp.json and a README):
unzip agentcheck-catalog.zip -d your-project
C) Copy & paste — open Preview on a card, copy, and paste into the file at the path shown.
5Where files go & how to enable
- skill → .claude/skills/<name>/SKILL.md
- subagent → .claude/agents/<name>.md
- slash command → .claude/commands/<name>.md
- MCP server → .mcp.json
Then restart Claude Code so it discovers them, and set any 🔑 env vars a server needs (each MCP card lists them).
6Security
Every catalog item carries a ✓ agentcheck badge — it passed agentcheck with zero errors: no hardcoded secrets, no remote-code-execution patterns, no over-broad tool/permission grants. Credentials are always ${ENV_VAR} references — you set them yourself; nothing secret is shipped. Re-check anything you add with npx @bacnguyenne/agentcheck.
7Use it from your agent (MCP)
agentcheck ships an MCP server so an agent can lint its own config. Run it with agentcheck mcp (or the agentcheck-mcp bin), and point your .mcp.json at it:
// .mcp.json
{ "mcpServers": { "agentcheck": { "command": "agentcheck", "args": ["mcp"] } } }