{
  "markdown": "# Skillsmith\n\n**Shared skills, safe for production.**\n\nOnce more than one team is publishing agent skills, the problem stops being finding them and starts being managing them. Which team is this scoped to? Which version is installed where? Has it been flagged by a security scan? What happens to the ones nobody maintains anymore?\n\nSkillsmith is a registry for sharing, scanning, and tracking agent skills across teams. Skills are published to a registry scoped to your team and versioned immutably, so drift across installs is visible instead of silent. Flagged or suspicious skills are quarantined pending security review. Skills that go stale can be deprecated instead of quietly rotting in someone's repo.\n\n## Installation\n\n### Quick Setup (MCP)\n\nSkillsmith is **MCP-compatible** — pick the snippet for your agent.\nSMI-4580: snippets sourced from [`packages/cli/src/templates/mcp-server.template.snippets.ts`](packages/cli/src/templates/mcp-server.template.snippets.ts) so this README and the website docs cannot drift.\n\n<details>\n<summary><strong>Claude Code</strong> — <code>~/.claude/settings.json</code></summary>\n\n```json\n{\n  \"mcpServers\": {\n    \"@skillsmith/mcp-server\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@skillsmith/mcp-server\"],\n      \"env\": {\n        \"SKILLSMITH_API_KEY\": \"sk_live_...\"\n      }\n    }\n  }\n}\n```\n\nRestart Claude Code after editing settings.json.\n\n</details>\n\n<details>\n<summary><strong>Cursor</strong> — <code>~/.cursor/mcp.json</code></summary>\n\n```json\n{\n  \"mcpServers\": {\n    \"@skillsmith/mcp-server\": {\n      \"command\": \"<paste output of: which skillsmith-mcp (macOS/Linux) or where skillsmith-mcp (Windows)>\",\n      \"env\": {\n        \"SKILLSMITH_API_KEY\": \"sk_live_...\",\n        \"SKILLSMITH_CLIENT\": \"cursor\"\n      }\n    }\n  }\n}\n```\n\nCursor 2.4+ required, Node >=22.22 (Cursor's own bundled Node meets this). `SKILLSMITH_CLIENT` routes installs to `~/.cursor/skills` instead of the default `~/.claude/skills`.\n\n**Setup**: run `npm install -g @skillsmith/mcp-server`, then run `which skillsmith-mcp` (macOS/Linux) or `where skillsmith-mcp` (Windows) and paste that path into `command` above — Cursor's bundled Node cannot resolve packages via `npx` (a real `ENOENT` on a missing `Resources/app/resources/lib` directory), so pointing directly at the installed binary is the only form confirmed to work inside Cursor. Prefer to try `npx` first anyway? Replace `command` with `\"npx\"` and add `\"args\": [\"-y\", \"@skillsmith/mcp-server\"]` — simpler, but may hit the same `ENOENT`, plus `EBADENGINE` or `ENOTEMPTY` on repeated installs. After saving: enable the server in Cursor's Settings → MCP panel and start a new chat — a correctly-configured entry still shows disconnected until toggled on there — then reload the window.\n\n</details>\n\n<details>\n<summary><strong>GitHub Copilot (VS Code)</strong> — <code>.vscode/mcp.json</code> (workspace)</summary>\n\n```json\n{\n  \"mcpServers\": {\n    \"@skillsmith/mcp-server\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@skillsmith/mcp-server\"],\n      \"env\": {\n        \"SKILLSMITH_API_KEY\": \"sk_live_...\"\n      }\n    }\n  }\n}\n```\n\nVS Code 1.108+ required. Workspace-scoped (commit to repo if team-shared, or use user `settings.json` instead).\n\n</details>\n\n<details>\n<summary><strong>Windsurf</strong> — <code>~/.codeium/windsurf/mcp_config.json</code></summary>\n\n```json\n{\n  \"mcpServers\": {\n    \"@skillsmith/mcp-server\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@skillsmith/mcp-server\"],\n      \"env\": {\n        \"SKILLSMITH_API_KEY\": \"${env:SKILLSMITH_API_KEY}\"\n      }\n    }\n  }\n}\n```\n\nSupports `${env:VAR}` interpolation; export `SKILLSMITH_API_KEY` in your shell instead of inlining the secret.\n\n</details>\n\n<details>\n<summary><strong>Codex CLI</strong> — <code>~/.codex/config.toml</code> (TOML, not JSON)</summary>\n\n```toml\n[mcp_servers.@skillsmith/mcp-server]\ncommand = \"npx\"\nargs = [\"-y\", \"@skillsmith/mcp-server\"]\n\n[mcp_servers.@skillsmith/mcp-server.env]\nSKILLSMITH_API_KEY = \"sk_live_...\"\n```\n\nCodex reads `~/.agents/skills`. When installing via CLI, pass `--client agents`.\n\n</details>\n\n<details>\n<summary><strong>Cross-agent (open standard)</strong> — <code>~/.agents/mcp.json</code></summary>\n\n```json\n{\n  \"mcpServers\": {\n    \"@skillsmith/mcp-server\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@skillsmith/mcp-server\"],\n      \"env\": {\n        \"SKILLSMITH_API_KEY\": \"sk_live_...\"\n      }\n    }\n  }\n}\n```\n\nRead by any agent honouring the cross-agent skill convention.\n\n</details>\n\nAfter adding to your MCP client settings and restarting, you can search for skills immediately.\n\n### API Key Configuration (Optional)\n\nFor higher rate limits and usage tracking, authenticate with your API key.\n\n**Easiest — CLI login (interactive):**\n\n```bash\nnpm install -g @skillsmith/cli\nskillsmith login\n```\n\nThis opens [skillsmith.app/account/cli-token](https://skillsmith.app/account/cli-token) in your browser. Generate a key, copy it, and paste it when prompted. The key is stored securely in your OS keyring.\n\n**MCP server config — add the key to your settings:**\n\nThe per-client snippets above already include the `env.SKILLSMITH_API_KEY` slot — replace the `sk_live_...` placeholder with the value from `skillsmith login`.\n\nGet your API key at [skillsmith.app/account/cli-token](https://skillsmith.app/account/cli-token).\n\n| Tier | Rate Limit | Cost |\n|------|------------|------|\n| Trial | 10 total | Free |\n| Community | 30/min | Free |\n| Individual | 60/min | $9.99/mo |\n| Team | 120/min | $25/user/mo |\n| Enterprise | 300/min | Custom |\n\n> **Note:** Never paste API keys in chat. Configure via settings.json only.\n\n### CLI Installation (Development)\n\nThe CLI is available for local development:\n\n```bash\n# From the repository root\nnpm run build\nnode packages/cli/dist/index.js search \"testing\"\n```\n\n## The four questions\n\nOnce more than one team is publishing skills, these are the questions that matter:\n\n1. **Which team is this scoped to?** Every skill in the registry is scoped to a team.\n2. **Which version is installed here?** Versions are immutable; `skill_diff` and `skill_outdated` report drift for what's installed on the machine you run them from.\n3. **Has it been flagged by the security scan?** Skills pulled from the public index are scored automatically; flagged or suspicious ones are quarantined pending review — unflagged means it wasn't flagged, not that it was formally approved. Skills carry one of five trust tiers, from Official to Unverified ([Security Guide](docs/internal/security/skill-security-guide.md)).\n4. **What happens to the ones nobody maintains?** Stale skills can be deprecated instead of quietly rotting in someone's repo.\n\n## How it works\n\n- **Publish** — skills are published to a registry scoped to your team, versioned immutably.\n- **Version** — every publish creates a new immutable version; nothing is overwritten in place.\n- **Drift detection** — `skill_diff` and `skill_outdated` show what's installed and where it has fallen behind, at the point you check.\n- **Deprecate** — skills that go stale can be deprecated instead of quietly rotting in someone's repo.\n\n## Scopes and permissions\n\nSkills are scoped to your team's registry. Team owners and admins control who can publish and manage skills; members install and search.\n\n## Start solo\n\nSearch, install, and manage skills for yourself, free. When your team needs the same skill, the registry is already there.\n\n## MCP Tools\n\n| Tool | Description |\n|------|-------------|\n| `search` | Search skills with filters (query, category, trust tier, min score) |\n| `get_skill` | Get detailed skill information including install command |\n| `install_skill` | Install a skill to your local environment |\n| `uninstall_skill` | Remove an installed skill |\n| `recommend` | Get contextual skill recommendations |\n| `validate` | Validate a skill's structure and quality |\n| `compare` | Compare multiple skills side-by-side |\n\n**Local-first by design.** Skillsmith caches the registry in a local SQLite database at `~/.skillsmith/skills.db`, shared across the MCP server, the CLI, and the VS Code extension. Search is FTS5 (SQLite's built-in keyword search) by default; semantic search is opt-in (`SKILLSMITH_USE_HNSW=true`) and runs over local ONNX embeddings (an open ML model format that runs on CPU — no API call). [Inside the Local Skill Database](https://skillsmith.app/blog/inside-the-local-skill-database) walks through the schema, the FTS5 / HNSW search paths, and how `sync` (a Team+ tier feature) keeps the cache fresh.\n\n## Architecture\n\nSkillsmith uses the Model Context Protocol (MCP):\n\n```text\n┌─────────────────────────────────────────────────────┐\n│  MCP Client (Claude Code, Cursor, etc.)               │\n│  ┌─────────────────────────────────────────────────┐│\n│  │  Skillsmith MCP Server                          ││\n│  │  └── @skillsmith/mcp-server                     ││\n│  │      ├── search, get_skill, compare             ││\n│  │      ├── install_skill, uninstall_skill         ││\n│  │      └── recommend, validate                    ││\n│  └─────────────────────────────────────────────────┘│\n│                          │                           │\n│                          ▼                           │\n│  ┌─────────────────────────────────────────────────┐│\n│  │  ~/.skillsmith/skills.db (SQLite + FTS5)        ││\n│  │  ~/.claude/skills/ (installed skills)           ││\n│  └─────────────────────────────────────────────────┘│\n└─────────────────────────────────────────────────────┘\n```\n\n## Usage\n\nOnce configured, your MCP client can use Skillsmith tools:\n\n```text\n\"Search for testing skills\"\n→ Uses search tool to find testing-related skills\n\n\"Show me details for community/jest-helper\"\n→ Uses get_skill tool to retrieve full skill information\n\n\"Install the jest-helper skill\"\n→ Uses install_skill tool to add it to ~/.claude/skills\n\n\"Compare jest-helper and vitest-helper\"\n→ Uses compare tool to show side-by-side comparison\n```\n\n### CLI Usage (Development)\n\n```bash\n# From the repository, after building\nnode packages/cli/dist/index.js search \"testing\" --tier verified --min-score 80\nnode packages/cli/dist/index.js get community/jest-helper\nnode packages/cli/dist/index.js install community/jest-helper\n```\n\n## Documentation\n\n### Public\n\n- [**Security Guide**](https://skillsmith.app/docs/security) - Understanding skill trust, safety, and protections\n- [5-Minute Setup](https://skillsmith.app/docs/quickstart) - Quick start guide\n- [Configuration Guide](https://skillsmith.app/docs/getting-started) - Complete setup and usage\n- [Status](https://www.skillsmith.app/status) - Live status and uptime history for Skillsmith's core services\n\n### Internal\n\nInternal documentation is in a private submodule at `docs/internal/`. Access requires repository membership. Run `git submodule update --init` after cloning.\n\n- [Engineering Standards](docs/internal/architecture/standards.md) - Code quality policies (requires repository access)\n- [ADR Index](docs/internal/adr/index.md) - Architecture Decision Records (requires repository access)\n- [Security Checklist](docs/internal/security/checklists/code-review.md) - Security review guidelines (requires repository access)\n- [Phase Retrospectives](docs/internal/retros/) - Phase learnings (requires repository access)\n\n## Development\n\nSkillsmith uses **Docker-first development**. All commands run inside Docker to ensure consistent native module support across all platforms.\n\n### Prerequisites\n\n- **Docker Desktop** (v24+) or Docker Engine with Docker Compose\n- **Git** (for cloning the repository)\n- **Node.js** (optional, only for local tooling outside Docker)\n\n### Quick Start\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/smith-horn/skillsmith.git\ncd skillsmith\n\n# 2. Create your local environment file\ncp .env.example .env\n\n# 3. Start the development container\ndocker compose --profile dev up -d\n\n# 4. Install dependencies (first time only)\ndocker exec skillsmith-dev-1 npm install\n\n# 5. Build and test\ndocker exec skillsmith-dev-1 npm run build\ndocker exec skillsmith-dev-1 npm test\n```\n\n### Running Commands in Docker\n\nAll npm commands should be run inside the Docker container:\n\n| Command | Docker Command |\n|---------|----------------|\n| Build | `docker exec skillsmith-dev-1 npm run build` |\n| Test | `docker exec skillsmith-dev-1 npm test` |\n| Lint | `docker exec skillsmith-dev-1 npm run lint` |\n| Typecheck | `docker exec skillsmith-dev-1 npm run typecheck` |\n| Audit | `docker exec skillsmith-dev-1 npm run audit:standards` |\n\n### Container Management\n\n```bash\n# Start development container\ndocker compose --profile dev up -d\n\n# Check container status\ndocker ps | grep skillsmith\n\n# View container logs\ndocker logs skillsmith-dev-1\n\n# Stop container\ndocker compose --profile dev down\n\n# Restart after Dockerfile changes\ndocker compose --profile dev down\ndocker compose --profile dev build --no-cache\ndocker compose --profile dev up -d\n```\n\n### After Pulling Changes\n\nWhen you pull changes that modify `package.json` or `package-lock.json`:\n\n```bash\ndocker exec skillsmith-dev-1 npm install\ndocker exec skillsmith-dev-1 npm run build\n```\n\n### Troubleshooting\n\n#### Container won't start\n\n```bash\ndocker compose --profile dev down\ndocker volume rm skillsmith_node_modules\ndocker compose --profile dev up -d\ndocker exec skillsmith-dev-1 npm install\n```\n\n#### Native module errors (`ERR_DLOPEN_FAILED`)\n\nNative modules like `better-sqlite3` and `onnxruntime-node` may need rebuilding:\n\n```bash\ndocker exec skillsmith-dev-1 npm rebuild\n```\n\n#### Tests fail with shared library errors\n\nIf you see errors about `ld-linux-aarch64.so.1` or similar, ensure you're running inside Docker (not locally):\n\n```bash\n# Wrong - don't run locally\nnpm test\n\n# Correct - run in Docker\ndocker exec skillsmith-dev-1 npm test\n```\n\n### Why Docker?\n\nSkillsmith uses native Node.js modules (`better-sqlite3`, `onnxruntime-node`) that require **glibc**. Docker provides a consistent Debian-based environment with glibc, avoiding compatibility issues on systems using musl libc (like Alpine Linux).\n\nFor the full technical decision, see [ADR-002: Docker with glibc for Native Module Compatibility](docs/internal/adr/002-docker-glibc-requirement.md).\n\nSee [CLAUDE.md](CLAUDE.md) for full development workflow and skill configuration.\n\n## Tech Stack\n\n- **Runtime**: Node.js >=22.22 (Docker with glibc)\n- **Protocol**: MCP (Model Context Protocol)\n- **Database**: SQLite with FTS5\n- **Embeddings**: all-MiniLM-L6-v2 via onnxruntime-node\n- **Testing**: Vitest\n- **CI/CD**: GitHub Actions\n\n## License\n\nSkillsmith is source-available under the [Elastic License 2.0](LICENSE).\n\n**You CAN:**\n\n- Use Skillsmith for personal or internal business purposes\n- Modify the source code for your own use\n- Self-host for your team\n- Contribute bug fixes and improvements\n\n**You CANNOT:**\n\n- Offer Skillsmith as a managed service to third parties\n- Circumvent license key enforcement features\n\nFor the full license text, see the [LICENSE](LICENSE) file.\n\n## Author\n\nSmith Horn Group Ltd\n\n---\n\n_Skillsmith is not affiliated with Anthropic. Claude and Claude Code are trademarks of Anthropic._\n",
  "bytes": 15130,
  "sha": "0d8eb0794846234bcc6c8a95b16d9b24d14ec79e94741bfafc263fe09cd91e4a",
  "repo_slug": "smith-horn/skillsmith",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_smith_horn_skillsmith_e599ac1a/readme"
}