AutoVault
AutoVault is a skill management service that validates, stores, retrieves, and maintains SKILL.md capability files in a local-first vault — without executing skill content itself.
get_skill— Find and load installed skills by exact name or fuzzy query; optionally render agent-specific variants (with transforms applied) and inline packaged resource/binary file contents.add_skill— Install a skill from supported sources (github,agentskills,url, orlocalbundle), with validation, security checks, and agent profile sync.propose_skill— Submit newly authoredSKILL.mdcontent through the full validation pipeline: schema check, security scan, capability cross-check, three-tier deduplication (exact hash → near-exact similarity → functional overlap), signing, and storage.bulk_import— Import multiple skills from a directory, applying the same validation and deduplication pipeline to each, then syncing profiles once at the end.update_skill— Refresh an installed skill from its recorded upstream source, a new source, a local bundle, or inline bytes, with re-validation enforced.delete_skill— Remove an installed skill and all its vault-local transforms, then refresh agent profile links.check_updates— Detect upstream drift by comparing each installed skill's stored content hash against its current source state.
Key characteristics: All write operations enforce strict validation. Skill transforms allow agent-specific rendering without altering the original SKILL.md. Provenance is tracked via Ed25519 signing. In remote mode, OAuth handles authentication and per-user skill visibility.
Allows installing, updating, and auditing skills sourced from GitHub repositories.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AutoVaultlist my installed skills"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AutoVault
SKILL.md files already move through GitHub repos, team docs, public indexes,
Slack threads, and agent-written drafts. AutoVault gives those files one
canonical home: validate them at admission time, sign what passes, track where
they came from, and render the right view for each agent without maintaining
forks by hand.
AutoVault is a Node/TypeScript capability library, CLI, and MCP server. It has local stdio and remote Streamable HTTP MCP entry points, both backed by the same filesystem vault and SQLite capability index.
It does not execute skills through the MCP server. The server validates and
serves skill content; the host agent decides how to use that content inside its
own tool sandbox. The separate user-invoked autovault skill <action> CLI can
run signed bin: actions from installed skills, and that surface is documented
under Security Model.
Docs and public site: https://autovault.dev
Why AutoVault
The SKILL.md format is intentionally plain. The hard part is everything around it:
Skill drift - the same skill gets copy-pasted into Claude Code, Codex, Cursor, and project folders with no upstream tracking.
Supply-chain risk - remote skill bytes should be treated like untrusted package contents until they pass a gate.
Duplicate explosion - agents can author near-identical skills unless new proposals are deduplicated before storage.
Platform mismatch - one agent says
read, another saysfile_read, and a third expects a different filesystem tool name.Scope leakage - local dev skills should not silently show up in prod or in another client's project.
AutoVault's answer is deliberately simple: keep one canonical skill folder, record provenance, sign the admitted content, and sync or serve agent-specific views from that source.
Related MCP server: skilldb-mcp
Quick Start
Requirements:
Node.js
>=22.0.0curl,tar, andnpmmacOS 13+, Linux x64/arm64, or Windows through WSL2
Install the local vault:
curl -fsSL https://autovault.sh | sh
export PATH="$HOME/.autovault/bin:$PATH"
autovault --version
autovault doctor
autovault setup --review
autovault skill listInstall with Homebrew:
brew install autoworks-ai/tap/autovault
autovault setupInstall the packaged CLI/library directly from npm:
npm install -g @autoworks-ai/autovault
autovault setup --review
autovault doctorManual source install:
git clone https://github.com/autoworks-ai/autovault.git
cd autovault
npm ci
npm run build
node scripts/bootstrap-skills.mjs
node dist/cli.js doctorThe shell installer builds the app under ~/.autovault/app, preserves
~/.autovault as user-owned vault storage, installs the autovault CLI shim,
and bootstraps bundled skills unless AUTOVAULT_NO_BOOTSTRAP=1 is set. By
default it installs the latest stable release; set AUTOVAULT_REF=main only
when you explicitly want the unreleased main branch.
What Ships Today
AutoVault supports:
local filesystem storage under
AUTOVAULT_STORAGE_PATHa SQLite capability index for callers, profiles, tool groups, aliases, context rules, and MCP servers
per-agent and tag-filtered profile symlink generation
vault-local skill transforms that render agent-specific variants without forking upstream
SKILL.mdinstall, update, proposal, bulk-import, removal, resource-read, and drift-check workflows
enrolled pull-sync for signed upstream skill releases over file catalogs and HTTPS catalogs (
catalog.json+bundles/<bundle_hash>.json), including device enrollment, metadata-only update checks, local approval policy, bundle verification, and revocation statesource adapters for GitHub,
agentskills, arbitrary HTTPS URLs, local bundles, and inline MCP-proposed contentthree-tier deduplication for proposals
Ed25519 signatures and manifest checks for stored skills and executable resources
local stdio MCP and remote Streamable HTTP MCP at
/mcpwith OAuth-backed bearer auth
The npm package and Homebrew formula are live. The shell installer is still the
easiest local bootstrap path because it provisions ~/.autovault, installs the
CLI shim, and seeds bundled skills in one pass.
Distribution:
Source and releases: https://github.com/autoworks-ai/autovault
NPM package page: https://www.npmjs.com/package/@autoworks-ai/autovault
Homebrew tap: https://github.com/autoworks-ai/homebrew-tap
Container image:
ghcr.io/autoworks-ai/autovault:<tag>
CLI Surface
The CLI is the local operator surface:
autovault add <source-or-path> [--source github|agentskills|url|local] [--provenance <value>] [--version <v>] [--agent <agent>] [--sync-profiles|--no-sync-profiles] [--discover|--no-discover] [--link agent=/path/to/skills] [--dry-run] [--yes] [--quiet] [--verbose] [--json]
autovault add-local <path> [--source <provenance>] [--sync-profiles|--no-sync-profiles] [--discover|--no-discover] [--link agent=/path/to/skills] [--json]
autovault remove <skill-name> [--discover|--no-discover] [--link agent=/path/to/skills] [--json]
autovault sync-profiles [--discover|--no-discover] [--link agent=/path/to/skills] [--json]
autovault profiles list [--json]
autovault setup [--json] [--review] [--advanced]
autovault doctor [skill-name] [--clean] [--repair] [--json]
autovault audit-repo --repo /path/to/repo [--format json|markdown]
autovault import-autohub --tool-filters /path/tool-filters.json [--mcp-servers /path/mcp-servers.json] [--reset] [--json]
autovault link [slug|catalog-url|directory] [--json] [--no-browser]
autovault resolve --caller <id> --platform <name> [--channel <id>] --query <text> [--json]
autovault serve [--help]
autovault ui [--port <n>] [--no-open]
autovault skill list [--json]
autovault skill search <query> [--top-k N] [--json]
autovault skill which <name> [<action>]
autovault skill <action> <name>Human-readable output is the default. Use --json or --format json only
for scripts and other machine consumers.
autovault sync-profiles discovers existing ~/.claude/skills,
~/.codex/skills, and ~/.cursor/skills directories by default. Use
--no-discover to refresh only configured or explicitly linked roots.
sync-profiles --help prints subcommand usage without touching profile state.
autovault ui starts a loopback-only browser dashboard for local skill
metadata edits, named profile management, profile sync, update checks, deletion,
signed upstream update installs, enrolled-client revocation, and
permission-group visibility. It serves the packaged React assets and uses the
same /api/v1 management API shape as remote AutoVault.
autovault link with no argument starts a Cloud device pairing: the CLI
prints a short confirmation code, opens the browser, and polls until the
owner confirms the code. The slug is no longer something a human types.
autovault link <slug|catalog-url|directory> remains the fallback for older
Cloud enrollments and local catalogs (init stays a compatibility alias).
Humans who already know a Cloud slug can still type autovault link acme;
the client expands that to https://autovault.dev/v/<slug>/catalog.json.
On a TTY the command waits for owner confirm/admit; --json and non-TTY
runs return pending immediately, and a later autovault link --json
completes pairing once the owner has confirmed. Override the Cloud origin with
AUTOVAULT_CLOUD_ORIGIN. Pairing POSTs a self-signed device key to
/api/devices/pair and polls /api/devices/token. Slug enrollment POSTs
to /v/<slug>/devices and lands pending until the owner admits the
device. Signed releases are discovered from catalog.json and
bundles/<bundle_hash>.json and re-verified (release signature, bundle
hash, per-file SHA-256) before install. Device requests are signed with
X-AutoVault-Device / -Timestamp / -Signature. Beta limitation: if the live
catalog public_key drifts from the key pinned at enrollment, readCatalog
hard-fails and every device must re-enroll.
Common flows:
# Inspect vault health and integrity.
autovault doctor
autovault doctor --clean
autovault doctor --repair
# Add a known skill from any supported source.
autovault add ./path/to/your-skill --sync-profiles
autovault add ./path/to/your-skill/SKILL.md --sync-profiles
autovault add https://github.com/org/repo/tree/main/skills/your-skill
autovault add owner/repo:skills/your-skill/SKILL.md
autovault add my-skill --source agentskills
autovault add https://example.com/SKILL.md --source url
# Search installed skills locally.
autovault skill search code-review --top-k 5
# Link this machine to AutoVault Cloud, or a local test catalog.
autovault link
autovault link acme
autovault link ./path/to/upstream-catalog
autovault ui
# Remove a vaulted skill and refresh managed profile links.
autovault remove skill-authorautovault add is the canonical terminal path for known skills from local
bundles, GitHub repositories, agentskills slugs, or HTTPS URLs. Existing
installer scripts can keep using add-local as a compatibility alias for
local bundles; there, --source still means local provenance. For new local
adds, omit provenance and AutoVault records the normalized absolute bundle
directory. Local writes sync generated profiles and discover known host roots
by default; use --no-sync-profiles or --no-discover for an explicit opt-out.
If a remote skill omits AutoVault-specific agents frontmatter, pass
--agent codex (repeatable) for profile sync, or --no-sync-profiles for a
vault-only install.
Doctor JSON and rendered state
autovault doctor --json includes report-level render state alongside the
ordinary skill integrity results:
render.indexisabsent,ok, orcorrupt.render.orphanslists live managed symlinks with no backing index entry.render.unverifiablelists render entries owned by skills that are no longer installed.Every skill has
render.kind:ok,skipped, orerror.Every skill has a
plugin_shadowsarray. Each collision records categoryplugin-shadowed, evidencecached_collision,advisory: true, the host, plugin identifier, and cachedSKILL.mdpath;plugin_scanrecords whether the bounded cache scan was incomplete and why.summary.plugin_shadowedcounts affected vaulted skills.
skipped means that skill has no machine-local render entry; it is not an
ordinary doctor error. Automation consumers that require an installed and
verified rendered bundle must positively assert render.kind == "ok" rather
than relying on the process exit code.
Plugin shadows are advisory warnings, not signature failures: a collision means
a cached plugin copy exists, not that the host is actively injecting it. The
Cursor and Claude Code cache scan is bounded by directory depth, SKILL.md
count, and file size; an incomplete scan is reported explicitly and may
under-report collisions. skillOverrides does not apply to plugin skills;
AutoVault never uninstalls or changes host plugins.
autovault setup is the first-run adoption wizard. It scans the vault, bundled
skills, and discovered native roots such as ~/.claude/skills,
~/.codex/skills, and ~/.cursor/skills, then asks how to adopt each skill.
Run it from a real terminal; without a TTY the installer defers setup and tells
you to rerun the wizard manually.
MCP Tool Surface
MCP hosts can spawn the local stdio server with node dist/index.js, while
remote clients connect to dist/remote.js at /mcp.
Registered tools:
get_skill- search by query or fetch by exact name, optionally rendering for an agent and including packaged resources.add_skill- install a known skill fromgithub,agentskills,url, orlocal.propose_skill- submit newly authored SKILL.md bytes for validation, security scan, deduplication, signing, and storage.bulk_import- import every immediate child directory containing aSKILL.md.update_skill- refresh from the recorded source or replace from a new source, local bundle, or inline bytes.delete_skill- remove an installed skill and its vault-local transforms, then refresh generated profiles and prune managed consumer links. Existing host roots are discovered by default; the input also accepts optionaldiscover_profile_rootsandprofile_rootsfields.check_updates- compare installed skills against upstream source state and report drift or transform-review work.
Tool handlers return plain objects. src/mcp/server.ts wraps and serializes
them into the MCP content[0].text envelope. Remote mode applies an additional
policy layer for scopes and skill visibility.
Library Surface
The source package exports the same helpers used by the CLI and MCP server:
resolveCapabilities()/resolve_capabilities()syncProfiles()anddiscoverProfileRoots()addSkill(),updateSkill(),deleteSkill(),installSkill(),addLocalSkill(),proposeSkill(), andbulkImport()proposeSkillTransform(),listSkillTransforms(),removeSkillTransform(), andrenderSkillForAgent()auditRepo()importAutohubCapabilities()/ensureAutohubSeeded()
Unknown callers fail closed. Register callers explicitly or map unknown users to
a restricted caller such as guest.
Validation Gate
Every install, update, proposal, and bulk import runs through the same validation path:
Repair and normalize frontmatter formatting.
Parse YAML frontmatter with
gray-matter.Validate schema with
zod.Scan content against the denylist in
scripts/security/patterns.json.Cross-check declared capabilities against observed behavior.
Deduplicate exact, near-exact, and functionally similar proposals.
Write the skill, source sidecar, signed manifest, and Ed25519 signature.
In strict mode (AUTOVAULT_SECURITY_STRICT=true, the default), denylist hits
block writes. In non-strict mode they become warnings.
Storage Layout
Default storage is ~/.autovault; override it with
AUTOVAULT_STORAGE_PATH.
$AUTOVAULT_STORAGE_PATH/
autovault.sqlite # capability index
.signing-key.json # Ed25519 keypair, mode 0600
skills/
<name>/
SKILL.md
.autovault-source.json # source, hash, timestamps
.autovault-signature # detached Ed25519 signature, mode 0600
.autovault-manifest # signed manifest for declared resources/bin
<resources...>
transforms/
<base-skill>/<transform>/
TRANSFORM.md
BASE_SKILL.md
.autovault-transform.json
.autovault-manifest
rendered/
<agent>/<skill>/ # generated variants
profiles/
<agent>/<skill-name> -> ../../skills/<skill-name> or ../../rendered/<agent>/<skill-name>
<named-profile>/<skill-name> -> ../../skills/<skill-name> or ../../rendered/<agent>/<skill-name>
profiles.config.json
cloud-sync/
upstreams.json # enrolled upstream/device metadata, mode 0600Skills are plain files. Back them up like dotfiles:
tar -czf autovault-backup-$(date +%F).tgz -C "$HOME" .autovaultSkill Transforms
Transforms let a workspace or agent adjust a skill without editing the upstream
SKILL.md. AutoVault stores the transform under the vault, appends transform
instructions to the base skill at render time, applies declared capability
metadata overrides, and materializes generated variants under rendered/.
Example TRANSFORM.md:
---
name: perplexity
base: research-skill
description: Use Perplexity instead of the default web search path.
targets:
agents: [codex]
priority: 100
capability_overrides:
network: true
tools:
add: [mcp__perplexity__search]
remove: [web_search]
metadata:
version: "1.0.0"
---
Use `mcp__perplexity__search` instead of `web_search` for research.When the base skill changes, check_updates continues rendering the transform
but returns transform_reviews with the pinned old base so the delta can be
reviewed.
Remote Deploy
Remote mode is for a shared or managed vault. It serves Streamable HTTP MCP at
/mcp, uses OAuth for client registration/login/token issuance, and stores the
vault under the mounted AUTOVAULT_STORAGE_PATH.
npm run build
AUTOVAULT_MODE=remote \
AUTOVAULT_PUBLIC_URL=http://localhost:3000 \
AUTOVAULT_ADMIN_EMAIL=admin@example.com \
AUTOVAULT_ADMIN_PASSWORD=replace-with-a-long-random-password \
npm run start:remoteDocker:
AUTOVAULT_ADMIN_EMAIL=admin@example.com \
AUTOVAULT_ADMIN_PASSWORD=replace-with-a-long-random-password \
docker compose up --buildRemote mode cannot create symlinks on client machines. sync-profiles is
local-only because a remote MCP server has no filesystem access to
~/.codex/skills, ~/.claude/skills, or other host roots. Remote clients
should discover and read skills directly through get_skill.
Configuration
Runtime environment:
Variable | Default | Purpose |
|
|
|
|
| Root path for installed skills. |
|
| SQLite capability index. |
| unset | Comma-separated |
|
| Optional named profile config. |
|
| Vendor routing: |
|
| Block denylist hits when true; warn when false. |
|
| Search backend. Metadata text search is the current implementation. |
|
|
|
| unset | Set to |
| required in remote mode | Public origin for OAuth metadata and callbacks. |
|
| HTTP port when |
| unset | Optional CORS allowlist for remote mode. |
| required until owner exists | First remote owner email. |
| required until owner exists | First remote owner password, at least 12 characters. |
| unset | Optional GitHub API rate-limit headroom. |
|
| Override the agentskills API base. |
Installer-only environment:
Variable | Default | Purpose |
|
| Install root for app, shim, and default storage. |
|
| Directory for the |
| latest stable release | GitHub branch or tag downloaded by |
| derived from | Fully override the source archive URL. |
|
| Set to |
Security Model
AutoVault has two execution surfaces with different boundaries.
The MCP servers (dist/index.js over stdio and dist/remote.js over
Streamable HTTP) are storage-and-validation services. They never execute skill
content. Remote sources are treated as untrusted input and must pass schema,
security, capability, dedup, signing, and path-safety checks before any write.
All diagnostics go to stderr so stdout stays reserved for stdio MCP framing.
Remote mode additionally requires OAuth bearer tokens and filters skill
visibility for non-owner users.
The autovault skill <action> CLI is a user-invoked execution surface for
skills that declare signed bin: actions. It runs the script as the invoking
user, with that user's filesystem and network access. Before execution, the CLI
hard-fails if the signed manifest, SKILL.md, or declared bin resources have
been changed post-install.
Important limits:
The trust root is the keypair at
$AUTOVAULT_STORAGE_PATH/.signing-key.json. Treat storage-root write access as full vault compromise.autovault doctor --cleanremoves only ignored OS/editor metadata such as.DS_Store,Thumbs.db,desktop.ini, and AppleDouble._*files.Unknown hidden files, symlinks, special files, unsigned helpers, and changed signed files remain integrity failures.
The CLI requires an interactive TTY for bin actions as defense in depth, but a pseudo-terminal can satisfy that check. The hard boundary is validation plus manifest signing, not proof of a human at the keyboard.
For the full model and accepted risks, read
docs/THREAT-MODEL.md.
Development
npm ci
npm run build
npm test
node scripts/smoke.mjs
node scripts/remote-smoke.mjs
node scripts/probe.mjsThe smoke, probe, and remote-smoke scripts require npm run build first because
they spawn compiled files from dist/.
Fresh Installer Sandbox
Use this when you want to walk through the shell installer like a new user
without touching your real ~/.autovault, shell profile, or installed skills.
The recipe packages the current development checkout, including uncommitted
files, and points the installer at that local archive.
SANDBOX="$(mktemp -d -t autovault-fresh.XXXXXX)"
FRESH_HOME="$SANDBOX/home"
ARCHIVE="$SANDBOX/autovault-dev.tgz"
mkdir -p "$FRESH_HOME"
tar \
--exclude ./.git \
--exclude ./node_modules \
--exclude ./dist \
-czf "$ARCHIVE" \
-C "$(dirname "$PWD")" "$(basename "$PWD")"
HOME="$FRESH_HOME" \
AUTOVAULT_HOME="$FRESH_HOME/.autovault" \
AUTOVAULT_BIN_DIR="$FRESH_HOME/.autovault/bin" \
AUTOVAULT_TARBALL_URL="file://$ARCHIVE" \
AUTOVAULT_REF=dev \
sh scripts/install.sh --verboseAfter install, keep the sandboxed HOME and PATH on commands you want to run
from the new-user perspective:
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault --version
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault doctor
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault skill list
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault ui --no-open --port 0To skip the setup wizard during install and run it manually:
HOME="$FRESH_HOME" \
AUTOVAULT_HOME="$FRESH_HOME/.autovault" \
AUTOVAULT_BIN_DIR="$FRESH_HOME/.autovault/bin" \
AUTOVAULT_TARBALL_URL="file://$ARCHIVE" \
AUTOVAULT_REF=dev \
AUTOVAULT_NO_SETUP=1 \
sh scripts/install.sh --verbose
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault setup --reviewRemove the whole sandbox when finished:
rm -rf "$SANDBOX"Architecture map:
src/index.ts- local stdio MCP entry pointsrc/remote.ts- remote Streamable HTTP MCP entry pointsrc/mcp/- tool registration and serializationsrc/tools/- MCP tool handlerssrc/cli/- local operator CLI and UIsrc/library.ts- public ESM exportssrc/capabilities/- SQLite schema, resolver, AutoHub importsrc/profiles/- profile discovery, filtering, and symlink syncsrc/validation/- frontmatter repair, schema, security, dedupsrc/sources/- source adapterssrc/storage/- filesystem storage, locks, manifests, signingsrc/util/- shared helpers
Release and operations docs:
Roadmap
Likely next areas:
stronger key storage for signature enforcement
semantic search via local embeddings
additional source adapters such as ClawHub, LobeHub, and Tessl
local mirror helper for permitted remote skills
secret resolver design, without storing secret values in the vault
Available Tools
7 toolsadd_skillA
Add a known skill from a source. For GitHub, agentskills, and URL sources, pass source plus identifier; remote bytes are fetched and validated before storage. Remote skills without agents frontmatter need target_agents for profile sync, or sync_profiles: false for vault-only install. For local bundles, pass source: "local" and skill_dir; identifier can override local provenance like CLI add-local --source, otherwise the normalized bundle root is recorded. Caller-authored SKILL.md bytes should use propose_skill, not add_skill.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | ||
| verbose | No | ||
| version | No | ||
| skill_dir | No | ||
| identifier | No | ||
| profile_roots | No | ||
| sync_profiles | No | ||
| target_agents | No | ||
| discover_profile_roots | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the behavioral burden. It discloses that remote bytes are fetched and validated before storage, explains profile sync behavior, and notes how local provenance is handled. It could go further by covering return values or idempotency, but the core side effects are clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but organized by source type and front-loaded with the main purpose. Every sentence adds operational detail, though the reference to 'CLI add-local --source' adds a mild assumption that could be clarified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 9 parameters, nested objects, no output schema, and no annotations, so the description has a heavy burden. It covers the main remote and local branches well, but omits return behavior, error cases, and several unexplained parameters, leaving the definition only partially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It meaningfully explains source, identifier, skill_dir, target_agents, and sync_profiles. However, verbose, version, profile_roots, and discover_profile_roots are left entirely unexplained, leaving notable gaps for an agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and resource: 'Add a known skill from a source.' It then distinguishes itself from propose_skill by explicitly stating that caller-authored SKILL.md bytes should use propose_skill, not add_skill, which helps an agent pick the right tool among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete when-to-use guidance per source type: remote sources need source plus identifier, local bundles need source: 'local' and skill_dir. It also explains profile sync conditions and points to propose_skill as the correct alternative for caller-authored SKILL.md bytes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bulk_importB
Import every immediate child directory under source_dir that contains a SKILL.md. Each child is validated and deduped like propose_skill; agents fills missing agents frontmatter for migration bundles, resources can be inferred from bundled files, and profile sync runs once at the end. Returns compact sync counts by default; pass verbose: true for full per-profile sync detail.
| Name | Required | Description | Default |
|---|---|---|---|
| agents | No | ||
| verbose | No | ||
| source_dir | Yes | ||
| profile_roots | No | ||
| sync_profiles | No | ||
| discover_profile_roots | No | ||
| allow_synthesized_frontmatter | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses validation, dedup, agents filling, resource inference, and profile sync. However, it does not mention side effects (e.g., whether source files are modified), authentication needs, or error handling, leaving gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with no wasted words. It front-loads the core action and adds details sequentially. Could be slightly improved with bullet points for clarity, but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool complexity (7 params, no output schema, no annotations), the description provides adequate but not complete context. It explains main behavior and a few parameters, but leaves many details about error handling, prerequisites, and return behavior implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate. It explains source_dir, agents, and verbose, adding meaningful context. However, four parameters (allow_synthesized_frontmatter, sync_profiles, profile_roots, discover_profile_roots) remain unexplained, so coverage is only partial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (import) and resource (immediate child directories containing SKILL.md). It also distinguishes behavior from sibling propose_skill by referencing it, but does not explicitly differentiate from other siblings like add_skill or update_skill.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use bulk_import versus alternative tools. It mentions 'like propose_skill' but lacks any when-to-use or when-not-to-use instructions, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_updatesA
Detect upstream drift for skills installed from github, agentskills, url, or bundled inline sources. Compares each skill's stored content hash against the current source state. Non-bundled inline skills are reported as unchecked.
| Name | Required | Description | Default |
|---|---|---|---|
| skill | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description covers main behaviors: hash comparison, handling of sources, and reporting of unchecked inline skills. Does not explicitly state it is read-only but implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences, front-loaded with purpose, every sentence adds value, no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers drift detection mechanism and special case for inline skills, but lacks output format details (no output schema), leaving the return structure unclear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The optional 'skill' parameter is not explained in the description, leaving ambiguity about whether it filters or specifies which skills to check, despite 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool detects upstream drift for skills by comparing content hashes, distinguishing it from sibling tools like update_skill or delete_skill.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies use before updating but lacks explicit when-to-use or when-not-to-use guidance relative to siblings like update_skill or propose_skill.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_skillA
Delete an installed skill from the vault and refresh generated profiles. Existing host skill roots are discovered by default so managed consumer links are pruned; pass discover_profile_roots: false to opt out. This also removes vault-local transforms for that skill.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| profile_roots | No | ||
| discover_profile_roots | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, and it does so thoroughly. It explains default host root discovery, the pruning of managed consumer links, the opt-out via discover_profile_roots: false, and the additional removal of vault-local transforms. This gives an agent a strong mental model of side effects beyond the basic delete action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler: the primary action and immediate effect come first, the configurable discovery behavior follows, and the additional transform removal closes it out. Every sentence earns its place and the structure is easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no annotations and no output schema, the description covers the key behavioral surfaces well: what is deleted, what is refreshed, what is pruned, and how to opt out. The main missing piece is a clearer explanation of the profile_roots parameter's shape and purpose, which prevents this from being fully complete for advanced usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds useful meaning for discover_profile_roots by explaining its default and the opt-out behavior, and 'name' is self-evident. However, the profile_roots object parameter is never explicitly explained or mapped to the 'host skill roots' concept, leaving a significant gap for an optional but non-trivial parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Delete an installed skill from the vault', and immediately distinguishes this from all sibling tools whose names describe add/get/update/propose actions. The secondary effect of refreshing generated profiles is also stated, so an agent knows exactly what action is performed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose is unambiguous: deleting a skill is clearly the inverse of add_skill or update_skill, so the usage context is clear from the first sentence. It does not explicitly name alternatives or exclusion conditions, but the tool's destructive role among these siblings is obvious and the description gives actionable context for when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_skillA
Find and load installed skills. Pass name for an exact skill, or query to search and load the best match while returning alternates. Set include_resources to inline packaged resource/bin file contents; otherwise resources are returned as metadata only. Pass agent to render the generated variant with matching AutoVault transforms applied.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| agent | No | ||
| query | No | ||
| top_k | No | ||
| include_resources | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description carries full burden. It discloses that query returns best match and alternates, include_resources controls inlining, and agent applies AutoVault transforms. However, it does not mention behavior if both name and query are provided, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences cover the main functionality efficiently. The structure mixes parameter explanations within usage, but no word wasted. Could be more organized by grouping parameter descriptions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 0% schema description, no output schema, and no annotations, the description covers the two modes and most parameters. However, it misses the top_k parameter, does not describe the output format, and lacks error behavior. Adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, so description must compensate. It explains name, query, include_resources, and agent clearly, but omits top_k completely despite its exclusiveMinimum and maximum constraints. 4 out of 5 parameters are described, but the missing one is a gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb (Find/load) and resource (installed skills). It distinguishes between exact match by name and search by query, and mentions optional parameters. Among siblings focused on mutation, it stands out as the retrieval tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use name vs query, but lacks explicit guidance on when to use this tool over siblings like propose_skill or delete_skill. No prerequisites or when-not conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
propose_skillA
Submit a newly authored SKILL.md to AutoVault. Runs validation, security scan, capability cross-check, and three-tier deduplication (exact content hash → near-exact similarity → functional overlap). Use when the user asks to save a conversationally created skill, or after you've drafted one in response to a workflow the user wants reused. Always prefer this over writing skill files directly to disk.
| Name | Required | Description | Default |
|---|---|---|---|
| check | No | ||
| verbose | No | ||
| skill_md | Yes | ||
| resources | No | ||
| source_session | No | ||
| allow_synthesized_frontmatter | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses that the tool runs validation, security scan, capability cross-check, and three-tier deduplication. This reveals significant behavioral traits beyond a simple save, such as potential rejection or merging. It does not, however, specify error behavior or what happens on duplicate detection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at four sentences, with the primary action and key checks in the first sentence. Every sentence adds value, and the structure is front-loaded for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, no output schema), the description lacks parameter explanations and output details. While core usage is clear, an agent cannot reliably construct calls without parameter semantics or understand return values, which is a significant gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and the description explains none of the 6 parameters beyond 'SKILL.md' for skill_md. Terms like resources, source_session, and allow_synthesized_frontmatter remain undefined, leaving the agent without guidance on how to populate them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool submits a SKILL.md to AutoVault and lists the specific checks performed (validation, security scan, etc.). It distinguishes itself from alternatives by explicitly recommending it over writing skill files directly to disk, implying it is for new skills, contrasting with siblings like update_skill.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use when saving a conversationally created skill or after drafting one for reuse. It also advises preferring this over direct file writes. However, it does not explicitly exclude use cases for updating existing skills, where update_skill might be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_skillA
Update an installed skill. With only name, AutoVault refreshes the recorded GitHub/agentskills/URL source. To update from a new source, pass source and identifier; to update from a local bundle, pass source: "local", skill_dir, and identifier; to explicitly replace from caller-held bytes, pass source: "inline" and skill_md. For SKILL.md-only inline edits, pass reuse_existing_resources: true to validate against the currently installed signed resources. Updates return compact sync counts by default; pass verbose: true for full sync detail. Updates refuse candidates whose frontmatter name does not match name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| source | No | ||
| verbose | No | ||
| version | No | ||
| skill_md | No | ||
| resources | No | ||
| skill_dir | No | ||
| identifier | No | ||
| profile_roots | No | ||
| sync_profiles | No | ||
| discover_profile_roots | No | ||
| reuse_existing_resources | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It discloses key behaviors: refreshing source with only name, rejecting mismatched frontmatter, default compact sync counts, and the verbose option. It does not cover side effects or auth requirements, but for an update operation the transparency is relatively high.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph covering numerous update modes and flags without excessive verbosity. It front-loads the main purpose. Each clause adds value, but the density could be slightly improved by splitting into bullet points for easier scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 12 parameters, nested objects, no output schema, the description is fairly complete for the main use cases. However, details on resources, sync profiles, profile_roots, and discover_profile_roots are missing, which may leave agents uncertain about those parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description adds meaning to many parameters (name, source, identifier, skill_dir, skill_md, reuse_existing_resources, verbose). However, parameters like resources, sync_profiles, profile_roots, discover_profile_roots, and version are not explained. The coverage is about 7/12 (58%), providing moderate compensation but with gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update an installed skill' and distinguishes various update modes (refresh, new source, local, inline). It is specific about the verb and resource, and the sibling tools (add_skill, delete_skill) provide contrast, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use different parameter combinations (e.g., just name for refresh, source+identifier for new source, etc.) and flags like verbose and reuse_existing_resources. However, it does not explicitly contrast when to use this tool over siblings like add_skill, but the update context is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.5.0- Changed
add_skill1 field changed- added
Input schema / properties / target_agentsAdded value: +{ + "items": { + "type": "string" + }, + "type": "array" +}
- Changed
delete_skill2 fields changed- added
Input schema / properties / discover_profile_rootsAdded value: +{ + "type": "boolean" +} - added
Input schema / properties / profile_rootsAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "propertyNames": { + "type": "string" + }, + "type": "object" +}
7 tool updates
v0.4.0- First observed
add_skill - First observed
bulk_import - First observed
check_updates - First observed
delete_skill - First observed
get_skill - First observed
propose_skill - First observed
update_skill
TDQS
Scored across 7 tools
Each tool targets a distinct lifecycle action—get, add, propose, update, delete, bulk import, and update checking—with clear boundaries. Even the similar add_skill and propose_skill are explicitly separated by whether the skill is sourced from an existing location or newly authored.
Most tools follow a consistent verb_noun pattern with snake_case: get_skill, add_skill, update_skill, delete_skill, propose_skill. bulk_import and check_updates deviate slightly from the *_skill suffix but still use the same imperative style and are immediately understandable.
Seven tools is well-scoped for a skill vault server. Each tool covers a meaningful operation without redundancy, and the count is neither bloated nor too thin.
The toolset covers the full skill lifecycle: create/add, read/search, update, delete, and upstream change detection. A minor gap is the lack of a dedicated list/export tool, though get_skill with a query and alternates partially covers discovery.
Maintenance
Related MCP Connectors
Official MCP server for subfeed.app — the cloud for agents. 15+ tools for AI agents to register, build, and deploy other agents. Zero human required. Start here: subfeed.app/skill.md
Shared long-term memory vault for AI agents with 20 MCP tools.
- UnifAPIOAuthcom.unifapi
Hosted MCP server for live public-data APIs and Skills for AI agents.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Related MCP Servers
- AlicenseAqualityAmaintenanceA universal MCP server that enables any LLM or AI agent to access expert skills from your local filesystem.368 npm39MIT
- AlicenseNot gradedqualityCmaintenanceMCP server for SkillDB that enables AI assistants to search, load, and manage AI agent skills directly.51 npmMIT
- AlicenseNot gradedqualityDmaintenanceA production-ready MCP server that equips AI agents with dynamic, persistent, and executable skills. It enables secure script execution and progressive disclosure to reduce context window usage.7 npmMIT
- AlicenseNot gradedqualityDmaintenanceA powerful MCP server that brings the skills.sh ecosystem directly to your AI agents, enabling effortless discovery, installation, and management of skills.1MIT