Name: Skyelight
Author: plastrlab

Skyelight MCP

Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply.

Grade A Remote or local · Streamable HTTP · stdio API key 18 tools v1.0.0

No reviews yet by plastrlabnpm 3,769 Runs on your machine or at its publisher’s address — not through us

93/100

trust score

downloads a day

local

or remote

downloads in 30d

What it does

Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'SKYELIGHT_API_URL=${SKYELIGHT_API_URL}' --env 'SKYELIGHT_API_TOKEN=${SKYELIGHT_API_TOKEN}' --transport stdio skyelight-mcp '--' npx -y @skyelight/mcp

# 2 — ask your agent for something these tools do
#   list_workspaces, list_projects, list_items and 15 more

It needs SKYELIGHT_API_URL, SKYELIGHT_API_TOKEN: this reads them from your environment, so export them first.

Skyelight costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

plastrlab1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one can run either way — at an address its publisher runs, or as a process under your own user, with your files and your network — and this marketplace is in the path of neither.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads SKYELIGHT_API_URL (The Skyelight server. Use https://app.skyelight.ai), SKYELIGHT_API_TOKEN (A personal token (sky_...) from Skyelight account settings, API Keys) from your environment each time it starts the server, so the value stays out of its config: export them in your shell profile (macOS, Linux), or run setx SKYELIGHT_API_URL …, setx SKYELIGHT_API_TOKEN … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'SKYELIGHT_API_URL=${SKYELIGHT_API_URL}' --env 'SKYELIGHT_API_TOKEN=${SKYELIGHT_API_TOKEN}' --transport stdio skyelight-mcp '--' npx -y @skyelight/mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Or connect to its publisher’s address

Its publisher also runs it at https://app.skyelight.ai/mcp: nothing to start on your machine, and this marketplace is not in the path.

claude mcp add --scope user --transport http skyelight-mcp https://app.skyelight.ai/mcp

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: SKYELIGHT_API_URL — The Skyelight server. Use https://app.skyelight.ai.; SKYELIGHT_API_TOKEN — A personal token (sky_...) from Skyelight account settings, API Keys.. You set them in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

18 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

Workspaces you can reach, with the role you hold in each, and who you are. Use when you do not know what exists yet, to find which workspace a project belongs to, or to learn your own user id.

No parameter schema on file.

Projects you can reach, newest activity first, across every workspace unless one is named. Start here when no project is bound — list_items needs a project id and this is where one comes from.

Parameter	Type	Required	Notes
workspaceId	string	no	Narrow to one workspace. Optional.

List feedback items (bugs, ideas, comments) people left on a Skyelight project. Returns a summary of the project plus matching items. Start here to see what is outstanding. An item's hand-off (investigate, plan, fix) is set by the team and binding: on investigate or plan, reply on the thread and…

Parameter	Type	Required	Notes
projectId	string	no	Project to read. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids.
page	string	no	Only items on one page, e.g. "/checkout".
type	string	no	Item type, e.g. "bug", "idea", "feedback".
status	string	no	Defaults to everything. "deferred" is work someone put off until later — outstanding, but deliberately not now.
assignee	string	no	A user id, "me" for whoever this connection belongs to, or "none" for unassigned items.
task	string	no	Only items a person handed to an agent with this task (Hand off in the app), or "none" for items with no hand-off. Combine with assignee to find your own. Investigate and plan mean reply on the thread
limit	number	no	Max items (default 50).

Find items whose thread mentions some text. Searches replies as well as the original message, so an item someone already diagnosed in a reply still turns up.

Parameter	Type	Required	Notes
query	string	yes	Text to look for.
projectId	string	no	Project to search. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids.
status	string	no	—
limit	number	no	—

Report back on an item: what you found, what you changed, a link to the PR. Posts as a reply on the thread the feedback was left on, so the person who reported it sees the answer where they asked. Use this when you finish work on an item, and when you get stuck.

Parameter	Type	Required	Notes
itemId	string	yes	Item id from list_items.
body	string	yes	What you found or changed, in plain language for the person who reported it.
mentions	array	no	People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them.
links	array	no	Optional links — a PR, a commit, a deploy.

Open a new thread on a page, as the person whose connection you are using. Only available on a person's own connection — an agent reporting what it found or changed uses post_update on the thread it was working, so the answer lands where the question was asked.

Parameter	Type	Required	Notes
url	string	yes	Full URL of the page this is about.
body	string	yes	What you want to say.
selector	string	no	CSS selector for the element, if there is one.
projectId	string	no	Optional if a project is bound.
pageTitle	string	no	—
mentions	array	no	People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them.
assignee	string	no	Who should take it: a name, email or id from list_members, or "me".

Share something with Skyelight for review, and get a link people can pin feedback on. Two ways: - code: one file Skyelight hosts at its own link with the review badge on it. A whole HTML page, or one React component with an export default (Tailwind classes and npm imports work; local imports such…

Parameter	Type	Required	Notes
code	string	no	For Skyelight to host: the complete file, never a summary or an excerpt. Or give url.
url	string	no	Where the app is deployed, e.g. https://my-app.lovable.app. Or give code.
name	string	no	What it is, in a few words. Names the hosted link and, when no project is given, a new project.
kind	string	no	With code; worked out from it when left out.
projectId	string	no	Optional: the project to put it in. Left out, a new project is made for it.
prototypeId	string	no	With code: to publish a new version of a prototype published before.
workspaceId	string	no	When you are in more than one workspace and give no project, from list_workspaces.
source	string	no	With code: where it was made, shown as its logo in Skyelight: "claude", "claude-code", "openai" (ChatGPT), "cursor", "windsurf", "v0", "lovable" or "other". Name yourself.

The people in a workspace: name, email, role and id. Call it when you are asked to tell, ask or hand something to someone by name, then pass their name or id to assign, or in mentions on create_item or post_update.

Parameter	Type	Required	Notes
projectId	string	no	Optional if a project is bound.
workspaceId	string	no	Instead of a project, from list_workspaces.

Hand an item to a person, who is notified the way an assignment in the app notifies them. Pass null as the assignee to unassign it. Only owners, admins and collaborators can assign; a resolved item has to be reopened first.

Parameter	Type	Required	Notes
itemId	string	yes	Item id from list_items.
assignee	string/null	yes	A name, email or id from list_members, "me", or null to unassign.

Move an item to open, deferred or resolved. Use it to close the loop after you have fixed something and said so — post_update first, so the person who reported it reads what changed, then set_status. "deferred" is for work that is real but not now.

Parameter	Type	Required	Notes
itemId	string	yes	Item id from list_items.
status	string	yes	—

Everything needed to work one item: the whole thread in order, the page and URL it is on, the anchor identifying the element the person pointed at, and the pictures — what the page looked like when it was pinned, plus anything people attached — returned as images you can look at rather than links…

Parameter	Type	Required	Notes
itemId	string	yes	Item id from list_items.

Everything needed to write an accurate project review or hand-off document: the shape of the work, every resolved thread and how it ended, what was deferred and why, what is still open, and the longest conversations quoted in full, which is where decisions were made. Every entry carries its item…

Parameter	Type	Required	Notes
projectId	string	no	Project to review. Optional if a project is bound.
section	string	no	Omit for the overview (all counts, first rows of each section). Name one to read it in full, a page at a time.
offset	number	no	With section: where to start, from the previous result's 'more' line.

What changed on a project since you last looked: new threads, new replies grouped by thread, what was resolved or deferred, and what was assigned to you or mentioned you. Call it at the start of a session. Without since it reads from your bookmark and moves it forward; with since it reads that…

Parameter	Type	Required	Notes
projectId	string	no	Optional if a project is bound.
since	string	no	Optional. A date or time ("2026-09-01", an ISO time) to read from instead of your bookmark.

Feedback by the code that rendered it, from the file and line the Skyelight build plugin stamps on each element. Pass a file (a path or just its name) or a component to see every thread about it before you edit it; pass neither to get the hot spots, every stamped file ranked by outstanding feedback.

Parameter	Type	Required	Notes
projectId	string	no	Optional if a project is bound.
file	string	no	A source path or file name, e.g. "src/components/PricingTable.tsx" or "PricingTable.tsx".
line	number	no	Optional. Threads nearest this line come first.
component	string	no	A component name, e.g. "PricingTable".
status	string	no	—
limit	number	no	—

Has this already been reported? Pass the text you are about to report (and the page, if you know it) before create_item, or an itemId to find what an existing thread duplicates. Returns likely matches with why each matched: shared words, same page, same element, same source file. If two are the…

Parameter	Type	Required	Notes
projectId	string	no	Optional if a project is bound or itemId is given.
text	string	no	What someone is about to report.
itemId	string	no	Instead of text: find duplicates of this item.
page	string	no	Optional. A page path or URL, e.g. "/checkout".
selector	string	no	Optional. CSS selector of the element.
includeResolved	boolean	no	Default true: a resolved match may mean it came back. false to skip them.
limit	number	no	Max matches (default 5).

Fold duplicate items into one, the way merging works in the app: the duplicates leave the list and count as extra reports on the item they were merged into. Use it only when find_similar and the threads themselves show they are the same problem. Owners, admins and collaborators can merge.

Parameter	Type	Required	Notes
itemId	string	yes	The item to keep. The others fold into it.
duplicateIds	array	yes	Items that report the same problem.

The decisions a project made in its threads, quoted: every thread resolved or deferred after a discussion, with the conversation, plus types people corrected and where outcomes keep recurring. Also returns the project's existing rules, so you can tell what is new. Use it to write a decision log,…

Parameter	Type	Required	Notes
projectId	string	no	Optional if a project is bound.
since	string	no	Optional. Only decisions after this date ("2026-09-01").
limit	number	no	Decisions per page (default 15, at most 30).
offset	number	no	Where to start, from the previous result's 'more' line.

Keep a rule the team agreed on ("sentence case in every button", "the brand gray stays, do not raise contrast bugs on it") in the project's context, under Rules learned. The classifier reads that context, and every agent reads it through decision_log, so it shapes future threads. Cite the threads…

Parameter	Type	Required	Notes
projectId	string	no	Optional if a project is bound.
rule	string	yes	The rule, in one plain sentence.
sourceItemIds	array	no	Items the rule came from.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source is public; its licence metadata reads NOASSERTION rather than naming a licence
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Skyelight or to call it, at any volume.

ATrust score 93 / 100

Release 1.0.0 · scanned 28 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings1 threat · 0 capability

Capabilityhigh

Coveragesource

Verificationrepo

Surface digeste5ff41239e20cf0e32435a1494e0a705b9a67a8ed08c8fc31b6d674d2669d439

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfacenot available

Implementation sourceread

Package metadataread

Live transportnot available

No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
No per-tool rows for this release — see the note below.

can execute shell commands or code

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digeste5ff41239e20cf0e

Scanned2026-10-28

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.