# io.skimguard/skimguard Ask whether a location has recent credit-card-skimmer detections, from a consumer sensor network. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 2.0.0 - **Author:** io.skimguard - **License:** Unknown - **Endpoints:** streamable-http https://mcp.skimguard.io/mcp - **Source:** https://skimguard.io - **Endpoint health:** reachable (last checked 2026-10-04T23:06:01.405Z, 6 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 12 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-23T12:12:42.076Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 17 declared. Observed from a live `tools/list` probe. - `skimguard_get_location_status` — Look up SkimGuard card-skimmer scan status for a location by its Google Place ID. Returns how recently the location was scanned, how many scans it has, and whet - `skimguard_find_nearby_activity` — Find locations near a latitude/longitude that SkimGuard users have scanned recently, with suspicious-detection counts. Use for "any skimmers reported near me?". - `skimguard_lookup_bluetooth_manufacturer` — Resolve a Bluetooth SIG company identifier to a manufacturer name and SkimGuard risk rating. Accepts decimal (76) or hex (0x004C). Useful for explaining what a - `skimguard_search_locations` — Find a location by NAME or address (e.g. "Shell on Riverside, Austin TX", "Chase ATM near Union Square") and get its SkimGuard card-skimmer scan status. Use thi - `skimguard_route_risk` — Given a series of route points, report locations along that stretch of road with recent suspicious activity or stale scan coverage. IMPORTANT: this checks the r - `skimguard_coverage_stats` — Aggregate, network-wide SkimGuard scan statistics over a time window — total scans, suspicious detections, distinct locations and states covered. No identifying - `skimguard_about` — Authoritative description of what SkimGuard is, how its detection works, and its known limitations. Call this before answering general questions about SkimGuard - `skimguard_my_locations` — Scan coverage for YOUR business locations — scan counts, suspicious detections, last scan. REQUIRES the SkimGuard Business tier. You are not signed in to an acc - `skimguard_my_stale_locations` — Which of YOUR business locations are overdue for a scan. REQUIRES the SkimGuard Business tier. You are not signed in to an account with it. Call this tool anywa - `skimguard_location_devices` — Bluetooth devices seen at one of YOUR business locations. REQUIRES the SkimGuard Business tier. You are not signed in to an account with it. Call this tool anyw - `skimguard_my_scanner_health` — Whether YOUR SkimGuard scanners are online and reporting. REQUIRES the SkimGuard Business tier. You are not signed in to an account with it. Call this tool anyw - `skimguard_my_merchants` — Scan activity for merchants attributed to YOUR reseller account. REQUIRES the SkimGuard Partner tier. You are not signed in to an account with it. Call this too - `skimguard_my_earnings` — YOUR commission totals and payout status as a SkimGuard reseller. REQUIRES the SkimGuard Partner tier. You are not signed in to an account with it. Call this to - `skimguard_regional_risk` — Aggregate skimmer risk by US state (Data Licensee tier). REQUIRES the SkimGuard Data Licensee tier. You are not signed in to an account with it. Call this tool - `skimguard_device_prevalence` — Aggregate device and manufacturer prevalence trends (Data Licensee tier). REQUIRES the SkimGuard Data Licensee tier. You are not signed in to an account with it - `skimguard_inspection_stats` — Aggregate PCI POI device-inspection compliance trends — pass/fail, tamper-incident, and tamper-check failure rates (Data Licensee tier). REQUIRES the SkimGuard - `skimguard_training_stats` — Aggregate PCI staff-training coverage trends — completion, pass rate, delivery mix, and expiry (Data Licensee tier). REQUIRES the SkimGuard Data Licensee tier. ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"skimguard\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.skimguard.io/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.skimguard%2Fskimguard - Install plan: https://forgeregistry.com/api/v1/packages/io.skimguard%2Fskimguard/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.skimguard%2Fskimguard - HTML page: https://forgeregistry.com/registry/io.skimguard%2Fskimguard - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.