No red flags found in any of the 11 categories — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
by superdesigndev · MCP Server · ★ 64
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
🔒 Is tools-registry safe to install? View the security audit →
Treg (Tool-Registry) Stop pasting API keys & skills into agent contexts and Slack DMs. Treg is your team's shared registry of skills, CLIs, endpoints, and secrets. Agents call Stripe, PostHog, directly - auth injected server-side, every call logged. Nothing to paste, nothing to leak. Built for the Superdesign team, live at treg.superdesign.dev - anyone can self-host. tool = something the registry calls for you with the org's credential. Two kinds: endpoint - an upstream + credential bindings (each binding injects one secret into the request; a request can carry several, e.g. an OAuth bearer and a header). CLI - a vendor binary (, , , ...) run with the credential injected. skill / bundle = a recipe () + its secrets + its tool(s), registered together. The one rule: the proxy relays, never models the upstream, and injects auth server-side — so it survives upstream API changes and callers never hold keys. Part 1 · Using the registry Visit treg.superdesign.dev (hosted on Render) — the dashboard, sign-in, and every URL below live there. Quickstart Same flow as the dashboard's Getting started guide: bash install the CLI — also points it at the registry curl -fsSL https://treg.superdesign
| Stars | 64 |
| Forks | 6 |
| Language | Python |
| Category | MCP Server |
| Quality Score | 67.5860175705601/100 |
| Open Issues | 3 |
| Last Updated | 2026-08-11 |
| Created | 2026-07-15 |
| Platforms | cli, mcp, python |
| Est. Tokens | ~17k |
Looking for a tools-registry alternative? If you're comparing tools-registry with other mcp server tools, these 6 projects are the closest alternatives on Agent Skills Hub — ranked by topic overlap, star count, and community traction.
Credential gateway for AI agents. Log in once via Oauth2 or API Key. Every agent stays authenticated — headles
Advanced Claude Code CLI toolkit - agents, hooks, skills, MCP servers, phased development, site intelligence d
Lightweight agent orchestration dev tool that lives in your repo
MCP-native security automation workbench (SDK + CLI + MCP) — authorized testing + static AI/MCP attack-surface
All-in-one MCP server that can connect your AI agents to any native endpoint, powered by UTCP
The open-source suite of software for working with your agents
Explore other popular mcp server tools:
tools-registry is Shared Skill & Secret vault for your team and agents, without leaking keys. Join community here: https://discord.gg/6mQYYfFMAn. It is categorized as a MCP Server with 64 GitHub stars.
tools-registry is primarily written in Python. It covers topics such as agents, api-keys, cli.
You can find installation instructions and usage details in the tools-registry GitHub repository at github.com/superdesigndev/tools-registry. The project has 64 stars and 6 forks, indicating an active community.
The top alternatives to tools-registry on Agent Skills Hub include authsome, claude-cli-advanced-starter-pack, sudocode. Each offers a different approach to the same problem space — compare them side-by-side by stars, quality score, and community activity.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: