Nexus Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Nexus Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A local MCP server for Nexus Mods mod discovery, research, and downloading, backed by the v2 GraphQL API (api.nexusmods.com/v2/graphql) and the website's DownloadPopUp widget.
| Tool | Purpose |
|---|---|
search_games | Resolve game titles to domain names; browse most-modded games |
search_mods | Search mods by name/game/author/tag, sorted by endorsements etc. |
get_mod | Full mod details: description, requirements, tags, stats |
get_mod_files | A mod's downloadable files with versions and changelogs |
get_download_url | Get a pre-signed CDN download URL (needs API key or cookies) |
download_mod | Download a mod file to disk (needs API key or cookies) |
search_collections | Search curated mod lists |
get_collection | Collection metadata + full mod list (by slug, optional revision) |
get_user | User profile + their most-endorsed mods |
run_graphql | Escape hatch: any read-only GraphQL query (mutations rejected) |
Adult content is always included — there is no filtering toggle.
npm install
npm run buildRegister with Claude Code (local checkout):
claude mcp add nexus-mods -e NEXUS_MODS_API_KEY=<your key> -- node dist/index.jsOr run directly via npx (no checkout needed — the repo is public):
claude mcp add nexus-mods -e NEXUS_MODS_API_KEY=<your key> -- npx github:mbj733/nexus-mcpOr in Claude Desktop's claude_desktop_config.json:
{
"mcpServers": {
"nexus-mods": {
"command": "node",
"args": ["dist/index.js"],
"env": { "NEXUS_MODS_API_KEY": "<your key>" }
}
}
}Three options:
NEXUS_MODS_API_KEY — from nexusmods.com/users/myaccount?tab=api. Enables v1 REST download API + viewer-relative GraphQL fields.
Run the helper script once to log in:
node scripts/login.mjsThis launches Chrome, you log in, cookies are saved to ~/.nexus-mcp-cookies.json. The MCP server reads this file automatically.
The nexus-cli.mjs tool works completely independently:
node scripts/nexus-cli.mjs login # one-time login
node scripts/nexus-cli.mjs search skyrim "unofficial patch" # search mods
node scripts/nexus-cli.mjs download skyrim 266 # download mod
node scripts/nexus-cli.mjs download baldursgate3 1234 --dir ./modsCookies stored at ~/.nexus-mcp-cookies.json, auto-refreshed when expired.
npm run dev # run from source via tsx
node scripts/smoke.mjs # end-to-end smoke test (needs build)
node scripts/login.mjs # extract Nexus Mods cookies from Chrome
node scripts/nexus-cli.mjs login # standalone loginDomain terminology lives in CONTEXT.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.