Skill directories compared

What to look for when you choose where to find and publish agent skills — verification, pinning, licenses, attribution and install options. A checklist, not a ranking.

There are several places to find agent skills and MCP servers today: GitHub repositories and "awesome" lists, vendor collections, and dedicated directories such as Denofy, skillsdirectory.com, mcpmarket.com or agenticskills.io. They differ in what they check and what they promise. This page does not rank them — features change quickly, and we do not publish numbers about other sites. Instead, here are the questions worth asking of any directory, with Denofy's answers so you can compare for yourself.

1. Is every version checked — and can you read the result?#

A badge is only useful if you can see what it is based on.

Denofy: every version runs through structure, compatibility, security and license checks. The full report (every finding with file, line, context and reason) is public, and a security grade from A to F summarises it.

2. Is what you install exactly what was checked?#

If a listing points to a branch, the content can change after the review.

Denofy: each version is pinned to a Git commit and stored as a tarball with a SHA-256. The CLI verifies the hash and re-runs the verifier locally; the manual download shows the hash too.

3. Are licenses and original authors respected?#

Copying a skill from someone else's repository without a license is not allowed, and users deserve to know who wrote it.

Denofy: imports require a free license (checked per folder), show "Original by … · imported by …" with the upstream link, and the real author can claim the package. Companies can verify their GitHub organisation and get an Official badge.

4. Which tools and package types are covered?#

Denofy: skills, Cursor rules, AGENTS.md snippets, subagents and slash commands for the tools listed in the CLI reference, installed into each tool's folder.

5. How do you install and update?#

Denofy: one command (npx @denofy/cli add <name>), manual steps or a ZIP with checksum, a lock file (denofy.lock) for teams, and denofy update / denofy sync.

6. Are rankings honest?#

Install counts are easy to inflate.

Denofy: bots are not recorded, CI installs are excluded, installs count distinct clients per day, and the ranking methodology is public.

Checklist to take with you#

Full verification report visible per version
Content pinned to a commit, checksum shown
License and original author shown; takedown and claim process
Clear install path for your tool, lock file for teams
Public methodology for rankings and grades