Skip to main content
Glama

AutoVault

SKILL.md files already move through GitHub repos, team docs, public indexes, Slack threads, and agent-written drafts. AutoVault gives those files one canonical home: validate them at admission time, sign what passes, track where they came from, and render the right view for each agent without maintaining forks by hand.

AutoVault is a Node/TypeScript capability library, CLI, and MCP server. It has local stdio and remote Streamable HTTP MCP entry points, both backed by the same filesystem vault and SQLite capability index.

It does not execute skills through the MCP server. The server validates and serves skill content; the host agent decides how to use that content inside its own tool sandbox. The separate user-invoked autovault skill <action> CLI can run signed bin: actions from installed skills, and that surface is documented under Security Model.

Docs and public site: https://autovault.dev

Why AutoVault

The SKILL.md format is intentionally plain. The hard part is everything around it:

  • Skill drift - the same skill gets copy-pasted into Claude Code, Codex, Cursor, and project folders with no upstream tracking.

  • Supply-chain risk - remote skill bytes should be treated like untrusted package contents until they pass a gate.

  • Duplicate explosion - agents can author near-identical skills unless new proposals are deduplicated before storage.

  • Platform mismatch - one agent says read, another says file_read, and a third expects a different filesystem tool name.

  • Scope leakage - local dev skills should not silently show up in prod or in another client's project.

AutoVault's answer is deliberately simple: keep one canonical skill folder, record provenance, sign the admitted content, and sync or serve agent-specific views from that source.

Related MCP server: skilldb-mcp

Quick Start

Requirements:

  • Node.js >=22.0.0

  • curl, tar, and npm

  • macOS 13+, Linux x64/arm64, or Windows through WSL2

Install the local vault:

curl -fsSL https://autovault.sh | sh
export PATH="$HOME/.autovault/bin:$PATH"
autovault --version
autovault doctor
autovault setup --review
autovault skill list

Install with Homebrew:

brew install autoworks-ai/tap/autovault
autovault setup

Install the packaged CLI/library directly from npm:

npm install -g @autoworks-ai/autovault
autovault setup --review
autovault doctor

Manual source install:

git clone https://github.com/autoworks-ai/autovault.git
cd autovault
npm ci
npm run build
node scripts/bootstrap-skills.mjs
node dist/cli.js doctor

The shell installer builds the app under ~/.autovault/app, preserves ~/.autovault as user-owned vault storage, installs the autovault CLI shim, and bootstraps bundled skills unless AUTOVAULT_NO_BOOTSTRAP=1 is set. By default it installs the latest stable release; set AUTOVAULT_REF=main only when you explicitly want the unreleased main branch.

What Ships Today

AutoVault supports:

  • local filesystem storage under AUTOVAULT_STORAGE_PATH

  • a SQLite capability index for callers, profiles, tool groups, aliases, context rules, and MCP servers

  • per-agent and tag-filtered profile symlink generation

  • vault-local skill transforms that render agent-specific variants without forking upstream SKILL.md

  • install, update, proposal, bulk-import, removal, resource-read, and drift-check workflows

  • enrolled pull-sync for signed upstream skill releases over file catalogs and HTTPS catalogs (catalog.json + bundles/<bundle_hash>.json), including device enrollment, metadata-only update checks, local approval policy, bundle verification, and revocation state

  • source adapters for GitHub, agentskills, arbitrary HTTPS URLs, local bundles, and inline MCP-proposed content

  • three-tier deduplication for proposals

  • Ed25519 signatures and manifest checks for stored skills and executable resources

  • local stdio MCP and remote Streamable HTTP MCP at /mcp with OAuth-backed bearer auth

The npm package and Homebrew formula are live. The shell installer is still the easiest local bootstrap path because it provisions ~/.autovault, installs the CLI shim, and seeds bundled skills in one pass.

Distribution:

CLI Surface

The CLI is the local operator surface:

autovault add <source-or-path> [--source github|agentskills|url|local] [--provenance <value>] [--version <v>] [--agent <agent>] [--sync-profiles|--no-sync-profiles] [--discover|--no-discover] [--link agent=/path/to/skills] [--dry-run] [--yes] [--quiet] [--verbose] [--json]
autovault add-local <path> [--source <provenance>] [--sync-profiles|--no-sync-profiles] [--discover|--no-discover] [--link agent=/path/to/skills] [--json]
autovault remove <skill-name> [--discover|--no-discover] [--link agent=/path/to/skills] [--json]
autovault sync-profiles [--discover|--no-discover] [--link agent=/path/to/skills] [--json]
autovault profiles list [--json]
autovault setup [--json] [--review] [--advanced]
autovault doctor [skill-name] [--clean] [--repair] [--json]
autovault audit-repo --repo /path/to/repo [--format json|markdown]
autovault import-autohub --tool-filters /path/tool-filters.json [--mcp-servers /path/mcp-servers.json] [--reset] [--json]
autovault link [slug|catalog-url|directory] [--json] [--no-browser]
autovault resolve --caller <id> --platform <name> [--channel <id>] --query <text> [--json]
autovault serve [--help]
autovault ui [--port <n>] [--no-open]
autovault skill list [--json]
autovault skill search <query> [--top-k N] [--json]
autovault skill which <name> [<action>]
autovault skill <action> <name>

Human-readable output is the default. Use --json or --format json only for scripts and other machine consumers.

autovault sync-profiles discovers existing ~/.claude/skills, ~/.codex/skills, and ~/.cursor/skills directories by default. Use --no-discover to refresh only configured or explicitly linked roots. sync-profiles --help prints subcommand usage without touching profile state.

autovault ui starts a loopback-only browser dashboard for local skill metadata edits, named profile management, profile sync, update checks, deletion, signed upstream update installs, enrolled-client revocation, and permission-group visibility. It serves the packaged React assets and uses the same /api/v1 management API shape as remote AutoVault.

autovault link with no argument starts a Cloud device pairing: the CLI prints a short confirmation code, opens the browser, and polls until the owner confirms the code. The slug is no longer something a human types. autovault link <slug|catalog-url|directory> remains the fallback for older Cloud enrollments and local catalogs (init stays a compatibility alias). Humans who already know a Cloud slug can still type autovault link acme; the client expands that to https://autovault.dev/v/<slug>/catalog.json. On a TTY the command waits for owner confirm/admit; --json and non-TTY runs return pending immediately, and a later autovault link --json completes pairing once the owner has confirmed. Override the Cloud origin with AUTOVAULT_CLOUD_ORIGIN. Pairing POSTs a self-signed device key to /api/devices/pair and polls /api/devices/token. Slug enrollment POSTs to /v/<slug>/devices and lands pending until the owner admits the device. Signed releases are discovered from catalog.json and bundles/<bundle_hash>.json and re-verified (release signature, bundle hash, per-file SHA-256) before install. Device requests are signed with X-AutoVault-Device / -Timestamp / -Signature. Beta limitation: if the live catalog public_key drifts from the key pinned at enrollment, readCatalog hard-fails and every device must re-enroll.

Common flows:

# Inspect vault health and integrity.
autovault doctor
autovault doctor --clean
autovault doctor --repair

# Add a known skill from any supported source.
autovault add ./path/to/your-skill --sync-profiles
autovault add ./path/to/your-skill/SKILL.md --sync-profiles
autovault add https://github.com/org/repo/tree/main/skills/your-skill
autovault add owner/repo:skills/your-skill/SKILL.md
autovault add my-skill --source agentskills
autovault add https://example.com/SKILL.md --source url

# Search installed skills locally.
autovault skill search code-review --top-k 5

# Link this machine to AutoVault Cloud, or a local test catalog.
autovault link
autovault link acme
autovault link ./path/to/upstream-catalog
autovault ui

# Remove a vaulted skill and refresh managed profile links.
autovault remove skill-author

autovault add is the canonical terminal path for known skills from local bundles, GitHub repositories, agentskills slugs, or HTTPS URLs. Existing installer scripts can keep using add-local as a compatibility alias for local bundles; there, --source still means local provenance. For new local adds, omit provenance and AutoVault records the normalized absolute bundle directory. Local writes sync generated profiles and discover known host roots by default; use --no-sync-profiles or --no-discover for an explicit opt-out. If a remote skill omits AutoVault-specific agents frontmatter, pass --agent codex (repeatable) for profile sync, or --no-sync-profiles for a vault-only install.

Doctor JSON and rendered state

autovault doctor --json includes report-level render state alongside the ordinary skill integrity results:

  • render.index is absent, ok, or corrupt.

  • render.orphans lists live managed symlinks with no backing index entry.

  • render.unverifiable lists render entries owned by skills that are no longer installed.

  • Every skill has render.kind: ok, skipped, or error.

  • Every skill has a plugin_shadows array. Each collision records category plugin-shadowed, evidence cached_collision, advisory: true, the host, plugin identifier, and cached SKILL.md path; plugin_scan records whether the bounded cache scan was incomplete and why. summary.plugin_shadowed counts affected vaulted skills.

skipped means that skill has no machine-local render entry; it is not an ordinary doctor error. Automation consumers that require an installed and verified rendered bundle must positively assert render.kind == "ok" rather than relying on the process exit code.

Plugin shadows are advisory warnings, not signature failures: a collision means a cached plugin copy exists, not that the host is actively injecting it. The Cursor and Claude Code cache scan is bounded by directory depth, SKILL.md count, and file size; an incomplete scan is reported explicitly and may under-report collisions. skillOverrides does not apply to plugin skills; AutoVault never uninstalls or changes host plugins.

autovault setup is the first-run adoption wizard. It scans the vault, bundled skills, and discovered native roots such as ~/.claude/skills, ~/.codex/skills, and ~/.cursor/skills, then asks how to adopt each skill. Run it from a real terminal; without a TTY the installer defers setup and tells you to rerun the wizard manually.

MCP Tool Surface

MCP hosts can spawn the local stdio server with node dist/index.js, while remote clients connect to dist/remote.js at /mcp.

Registered tools:

  • get_skill - search by query or fetch by exact name, optionally rendering for an agent and including packaged resources.

  • add_skill - install a known skill from github, agentskills, url, or local.

  • propose_skill - submit newly authored SKILL.md bytes for validation, security scan, deduplication, signing, and storage.

  • bulk_import - import every immediate child directory containing a SKILL.md.

  • update_skill - refresh from the recorded source or replace from a new source, local bundle, or inline bytes.

  • delete_skill - remove an installed skill and its vault-local transforms, then refresh generated profiles and prune managed consumer links. Existing host roots are discovered by default; the input also accepts optional discover_profile_roots and profile_roots fields.

  • check_updates - compare installed skills against upstream source state and report drift or transform-review work.

Tool handlers return plain objects. src/mcp/server.ts wraps and serializes them into the MCP content[0].text envelope. Remote mode applies an additional policy layer for scopes and skill visibility.

Library Surface

The source package exports the same helpers used by the CLI and MCP server:

  • resolveCapabilities() / resolve_capabilities()

  • syncProfiles() and discoverProfileRoots()

  • addSkill(), updateSkill(), deleteSkill(), installSkill(), addLocalSkill(), proposeSkill(), and bulkImport()

  • proposeSkillTransform(), listSkillTransforms(), removeSkillTransform(), and renderSkillForAgent()

  • auditRepo()

  • importAutohubCapabilities() / ensureAutohubSeeded()

Unknown callers fail closed. Register callers explicitly or map unknown users to a restricted caller such as guest.

Validation Gate

Every install, update, proposal, and bulk import runs through the same validation path:

  1. Repair and normalize frontmatter formatting.

  2. Parse YAML frontmatter with gray-matter.

  3. Validate schema with zod.

  4. Scan content against the denylist in scripts/security/patterns.json.

  5. Cross-check declared capabilities against observed behavior.

  6. Deduplicate exact, near-exact, and functionally similar proposals.

  7. Write the skill, source sidecar, signed manifest, and Ed25519 signature.

In strict mode (AUTOVAULT_SECURITY_STRICT=true, the default), denylist hits block writes. In non-strict mode they become warnings.

Storage Layout

Default storage is ~/.autovault; override it with AUTOVAULT_STORAGE_PATH.

$AUTOVAULT_STORAGE_PATH/
  autovault.sqlite             # capability index
  .signing-key.json            # Ed25519 keypair, mode 0600
  skills/
    <name>/
      SKILL.md
      .autovault-source.json   # source, hash, timestamps
      .autovault-signature     # detached Ed25519 signature, mode 0600
      .autovault-manifest      # signed manifest for declared resources/bin
      <resources...>
  transforms/
    <base-skill>/<transform>/
      TRANSFORM.md
      BASE_SKILL.md
      .autovault-transform.json
      .autovault-manifest
  rendered/
    <agent>/<skill>/            # generated variants
  profiles/
    <agent>/<skill-name> -> ../../skills/<skill-name> or ../../rendered/<agent>/<skill-name>
    <named-profile>/<skill-name> -> ../../skills/<skill-name> or ../../rendered/<agent>/<skill-name>
  profiles.config.json
  cloud-sync/
    upstreams.json             # enrolled upstream/device metadata, mode 0600

Skills are plain files. Back them up like dotfiles:

tar -czf autovault-backup-$(date +%F).tgz -C "$HOME" .autovault

Skill Transforms

Transforms let a workspace or agent adjust a skill without editing the upstream SKILL.md. AutoVault stores the transform under the vault, appends transform instructions to the base skill at render time, applies declared capability metadata overrides, and materializes generated variants under rendered/.

Example TRANSFORM.md:

---
name: perplexity
base: research-skill
description: Use Perplexity instead of the default web search path.
targets:
  agents: [codex]
priority: 100
capability_overrides:
  network: true
  tools:
    add: [mcp__perplexity__search]
    remove: [web_search]
metadata:
  version: "1.0.0"
---

Use `mcp__perplexity__search` instead of `web_search` for research.

When the base skill changes, check_updates continues rendering the transform but returns transform_reviews with the pinned old base so the delta can be reviewed.

Remote Deploy

Remote mode is for a shared or managed vault. It serves Streamable HTTP MCP at /mcp, uses OAuth for client registration/login/token issuance, and stores the vault under the mounted AUTOVAULT_STORAGE_PATH.

npm run build
AUTOVAULT_MODE=remote \
AUTOVAULT_PUBLIC_URL=http://localhost:3000 \
AUTOVAULT_ADMIN_EMAIL=admin@example.com \
AUTOVAULT_ADMIN_PASSWORD=replace-with-a-long-random-password \
npm run start:remote

Docker:

AUTOVAULT_ADMIN_EMAIL=admin@example.com \
AUTOVAULT_ADMIN_PASSWORD=replace-with-a-long-random-password \
docker compose up --build

Remote mode cannot create symlinks on client machines. sync-profiles is local-only because a remote MCP server has no filesystem access to ~/.codex/skills, ~/.claude/skills, or other host roots. Remote clients should discover and read skills directly through get_skill.

Configuration

Runtime environment:

Variable

Default

Purpose

AUTOVAULT_MODE

local

local for stdio/library use, remote for HTTP MCP.

AUTOVAULT_STORAGE_PATH

~/.autovault

Root path for installed skills.

AUTOVAULT_DB_PATH

$AUTOVAULT_STORAGE_PATH/autovault.sqlite

SQLite capability index.

AUTOVAULT_PROFILE_LINKS

unset

Comma-separated agent=/skills/root links for profile sync.

AUTOVAULT_PROFILE_CONFIG_PATH

$AUTOVAULT_STORAGE_PATH/profiles.config.json

Optional named profile config.

AUTOVAULT_SKILL_INSTALL

prefer-autovault

Vendor routing: prefer-autovault, both, native, native-only, or off.

AUTOVAULT_SECURITY_STRICT

true

Block denylist hits when true; warn when false.

AUTOVAULT_SEARCH_MODE

text

Search backend. Metadata text search is the current implementation.

AUTOVAULT_LOG_LEVEL

info

debug, info, warn, or error.

AUTOVAULT_LOG_DIAGNOSTICS

unset

Set to 1 to let structured diagnostic logs pass through public CLI output suppression.

AUTOVAULT_PUBLIC_URL

required in remote mode

Public origin for OAuth metadata and callbacks.

AUTOVAULT_HTTP_PORT

3000

HTTP port when PORT is not injected by the platform.

AUTOVAULT_ALLOWED_ORIGINS

unset

Optional CORS allowlist for remote mode.

AUTOVAULT_ADMIN_EMAIL

required until owner exists

First remote owner email.

AUTOVAULT_ADMIN_PASSWORD

required until owner exists

First remote owner password, at least 12 characters.

GITHUB_TOKEN

unset

Optional GitHub API rate-limit headroom.

AUTOVAULT_AGENTSKILLS_BASE

https://agentskills.io/api/v1

Override the agentskills API base.

Installer-only environment:

Variable

Default

Purpose

AUTOVAULT_HOME

~/.autovault

Install root for app, shim, and default storage.

AUTOVAULT_BIN_DIR

$AUTOVAULT_HOME/bin

Directory for the autovault shim.

AUTOVAULT_REF

latest stable release

GitHub branch or tag downloaded by autovault.sh; use main for the unreleased branch.

AUTOVAULT_TARBALL_URL

derived from AUTOVAULT_REF

Fully override the source archive URL.

AUTOVAULT_NO_BOOTSTRAP

0

Set to 1 to skip bundled-skill bootstrap.

Security Model

AutoVault has two execution surfaces with different boundaries.

The MCP servers (dist/index.js over stdio and dist/remote.js over Streamable HTTP) are storage-and-validation services. They never execute skill content. Remote sources are treated as untrusted input and must pass schema, security, capability, dedup, signing, and path-safety checks before any write. All diagnostics go to stderr so stdout stays reserved for stdio MCP framing. Remote mode additionally requires OAuth bearer tokens and filters skill visibility for non-owner users.

The autovault skill <action> CLI is a user-invoked execution surface for skills that declare signed bin: actions. It runs the script as the invoking user, with that user's filesystem and network access. Before execution, the CLI hard-fails if the signed manifest, SKILL.md, or declared bin resources have been changed post-install.

Important limits:

  • The trust root is the keypair at $AUTOVAULT_STORAGE_PATH/.signing-key.json. Treat storage-root write access as full vault compromise.

  • autovault doctor --clean removes only ignored OS/editor metadata such as .DS_Store, Thumbs.db, desktop.ini, and AppleDouble ._* files.

  • Unknown hidden files, symlinks, special files, unsigned helpers, and changed signed files remain integrity failures.

  • The CLI requires an interactive TTY for bin actions as defense in depth, but a pseudo-terminal can satisfy that check. The hard boundary is validation plus manifest signing, not proof of a human at the keyboard.

For the full model and accepted risks, read docs/THREAT-MODEL.md.

Development

npm ci
npm run build
npm test
node scripts/smoke.mjs
node scripts/remote-smoke.mjs
node scripts/probe.mjs

The smoke, probe, and remote-smoke scripts require npm run build first because they spawn compiled files from dist/.

Fresh Installer Sandbox

Use this when you want to walk through the shell installer like a new user without touching your real ~/.autovault, shell profile, or installed skills. The recipe packages the current development checkout, including uncommitted files, and points the installer at that local archive.

SANDBOX="$(mktemp -d -t autovault-fresh.XXXXXX)"
FRESH_HOME="$SANDBOX/home"
ARCHIVE="$SANDBOX/autovault-dev.tgz"
mkdir -p "$FRESH_HOME"

tar \
  --exclude ./.git \
  --exclude ./node_modules \
  --exclude ./dist \
  -czf "$ARCHIVE" \
  -C "$(dirname "$PWD")" "$(basename "$PWD")"

HOME="$FRESH_HOME" \
AUTOVAULT_HOME="$FRESH_HOME/.autovault" \
AUTOVAULT_BIN_DIR="$FRESH_HOME/.autovault/bin" \
AUTOVAULT_TARBALL_URL="file://$ARCHIVE" \
AUTOVAULT_REF=dev \
sh scripts/install.sh --verbose

After install, keep the sandboxed HOME and PATH on commands you want to run from the new-user perspective:

HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault --version
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault doctor
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault skill list
HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault ui --no-open --port 0

To skip the setup wizard during install and run it manually:

HOME="$FRESH_HOME" \
AUTOVAULT_HOME="$FRESH_HOME/.autovault" \
AUTOVAULT_BIN_DIR="$FRESH_HOME/.autovault/bin" \
AUTOVAULT_TARBALL_URL="file://$ARCHIVE" \
AUTOVAULT_REF=dev \
AUTOVAULT_NO_SETUP=1 \
sh scripts/install.sh --verbose

HOME="$FRESH_HOME" PATH="$FRESH_HOME/.autovault/bin:$PATH" autovault setup --review

Remove the whole sandbox when finished:

rm -rf "$SANDBOX"

Architecture map:

  • src/index.ts - local stdio MCP entry point

  • src/remote.ts - remote Streamable HTTP MCP entry point

  • src/mcp/ - tool registration and serialization

  • src/tools/ - MCP tool handlers

  • src/cli/ - local operator CLI and UI

  • src/library.ts - public ESM exports

  • src/capabilities/ - SQLite schema, resolver, AutoHub import

  • src/profiles/ - profile discovery, filtering, and symlink sync

  • src/validation/ - frontmatter repair, schema, security, dedup

  • src/sources/ - source adapters

  • src/storage/ - filesystem storage, locks, manifests, signing

  • src/util/ - shared helpers

Release and operations docs:

Roadmap

Likely next areas:

  • stronger key storage for signature enforcement

  • semantic search via local embeddings

  • additional source adapters such as ClawHub, LobeHub, and Tessl

  • local mirror helper for permitted remote skills

  • secret resolver design, without storing secret values in the vault

Available Tools

7 tools
add_skillA

Add a known skill from a source. For GitHub, agentskills, and URL sources, pass source plus identifier; remote bytes are fetched and validated before storage. Remote skills without agents frontmatter need target_agents for profile sync, or sync_profiles: false for vault-only install. For local bundles, pass source: "local" and skill_dir; identifier can override local provenance like CLI add-local --source, otherwise the normalized bundle root is recorded. Caller-authored SKILL.md bytes should use propose_skill, not add_skill.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYes
verboseNo
versionNo
skill_dirNo
identifierNo
profile_rootsNo
sync_profilesNo
target_agentsNo
discover_profile_rootsNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the behavioral burden. It discloses that remote bytes are fetched and validated before storage, explains profile sync behavior, and notes how local provenance is handled. It could go further by covering return values or idempotency, but the core side effects are clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but organized by source type and front-loaded with the main purpose. Every sentence adds operational detail, though the reference to 'CLI add-local --source' adds a mild assumption that could be clarified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 9 parameters, nested objects, no output schema, and no annotations, so the description has a heavy burden. It covers the main remote and local branches well, but omits return behavior, error cases, and several unexplained parameters, leaving the definition only partially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It meaningfully explains source, identifier, skill_dir, target_agents, and sync_profiles. However, verbose, version, profile_roots, and discover_profile_roots are left entirely unexplained, leaving notable gaps for an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Add a known skill from a source.' It then distinguishes itself from propose_skill by explicitly stating that caller-authored SKILL.md bytes should use propose_skill, not add_skill, which helps an agent pick the right tool among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete when-to-use guidance per source type: remote sources need source plus identifier, local bundles need source: 'local' and skill_dir. It also explains profile sync conditions and points to propose_skill as the correct alternative for caller-authored SKILL.md bytes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bulk_importB

Import every immediate child directory under source_dir that contains a SKILL.md. Each child is validated and deduped like propose_skill; agents fills missing agents frontmatter for migration bundles, resources can be inferred from bundled files, and profile sync runs once at the end. Returns compact sync counts by default; pass verbose: true for full per-profile sync detail.

ParametersJSON Schema
NameRequiredDescriptionDefault
agentsNo
verboseNo
source_dirYes
profile_rootsNo
sync_profilesNo
discover_profile_rootsNo
allow_synthesized_frontmatterNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses validation, dedup, agents filling, resource inference, and profile sync. However, it does not mention side effects (e.g., whether source files are modified), authentication needs, or error handling, leaving gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph with no wasted words. It front-loads the core action and adds details sequentially. Could be slightly improved with bullet points for clarity, but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool complexity (7 params, no output schema, no annotations), the description provides adequate but not complete context. It explains main behavior and a few parameters, but leaves many details about error handling, prerequisites, and return behavior implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate. It explains source_dir, agents, and verbose, adding meaningful context. However, four parameters (allow_synthesized_frontmatter, sync_profiles, profile_roots, discover_profile_roots) remain unexplained, so coverage is only partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (import) and resource (immediate child directories containing SKILL.md). It also distinguishes behavior from sibling propose_skill by referencing it, but does not explicitly differentiate from other siblings like add_skill or update_skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use bulk_import versus alternative tools. It mentions 'like propose_skill' but lacks any when-to-use or when-not-to-use instructions, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_updatesA

Detect upstream drift for skills installed from github, agentskills, url, or bundled inline sources. Compares each skill's stored content hash against the current source state. Non-bundled inline skills are reported as unchecked.

ParametersJSON Schema
NameRequiredDescriptionDefault
skillNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description covers main behaviors: hash comparison, handling of sources, and reporting of unchecked inline skills. Does not explicitly state it is read-only but implies it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two focused sentences, front-loaded with purpose, every sentence adds value, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers drift detection mechanism and special case for inline skills, but lacks output format details (no output schema), leaving the return structure unclear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The optional 'skill' parameter is not explained in the description, leaving ambiguity about whether it filters or specifies which skills to check, despite 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects upstream drift for skills by comparing content hashes, distinguishing it from sibling tools like update_skill or delete_skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies use before updating but lacks explicit when-to-use or when-not-to-use guidance relative to siblings like update_skill or propose_skill.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_skillA

Delete an installed skill from the vault and refresh generated profiles. Existing host skill roots are discovered by default so managed consumer links are pruned; pass discover_profile_roots: false to opt out. This also removes vault-local transforms for that skill.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
profile_rootsNo
discover_profile_rootsNo

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, and it does so thoroughly. It explains default host root discovery, the pruning of managed consumer links, the opt-out via discover_profile_roots: false, and the additional removal of vault-local transforms. This gives an agent a strong mental model of side effects beyond the basic delete action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no filler: the primary action and immediate effect come first, the configurable discovery behavior follows, and the additional transform removal closes it out. Every sentence earns its place and the structure is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with no annotations and no output schema, the description covers the key behavioral surfaces well: what is deleted, what is refreshed, what is pruned, and how to opt out. The main missing piece is a clearer explanation of the profile_roots parameter's shape and purpose, which prevents this from being fully complete for advanced usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds useful meaning for discover_profile_roots by explaining its default and the opt-out behavior, and 'name' is self-evident. However, the profile_roots object parameter is never explicitly explained or mapped to the 'host skill roots' concept, leaving a significant gap for an optional but non-trivial parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Delete an installed skill from the vault', and immediately distinguishes this from all sibling tools whose names describe add/get/update/propose actions. The secondary effect of refreshing generated profiles is also stated, so an agent knows exactly what action is performed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose is unambiguous: deleting a skill is clearly the inverse of add_skill or update_skill, so the usage context is clear from the first sentence. It does not explicitly name alternatives or exclusion conditions, but the tool's destructive role among these siblings is obvious and the description gives actionable context for when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_skillA

Find and load installed skills. Pass name for an exact skill, or query to search and load the best match while returning alternates. Set include_resources to inline packaged resource/bin file contents; otherwise resources are returned as metadata only. Pass agent to render the generated variant with matching AutoVault transforms applied.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
agentNo
queryNo
top_kNo
include_resourcesNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries full burden. It discloses that query returns best match and alternates, include_resources controls inlining, and agent applies AutoVault transforms. However, it does not mention behavior if both name and query are provided, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences cover the main functionality efficiently. The structure mixes parameter explanations within usage, but no word wasted. Could be more organized by grouping parameter descriptions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 0% schema description, no output schema, and no annotations, the description covers the two modes and most parameters. However, it misses the top_k parameter, does not describe the output format, and lacks error behavior. Adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage, so description must compensate. It explains name, query, include_resources, and agent clearly, but omits top_k completely despite its exclusiveMinimum and maximum constraints. 4 out of 5 parameters are described, but the missing one is a gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb (Find/load) and resource (installed skills). It distinguishes between exact match by name and search by query, and mentions optional parameters. Among siblings focused on mutation, it stands out as the retrieval tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use name vs query, but lacks explicit guidance on when to use this tool over siblings like propose_skill or delete_skill. No prerequisites or when-not conditions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

propose_skillA

Submit a newly authored SKILL.md to AutoVault. Runs validation, security scan, capability cross-check, and three-tier deduplication (exact content hash → near-exact similarity → functional overlap). Use when the user asks to save a conversationally created skill, or after you've drafted one in response to a workflow the user wants reused. Always prefer this over writing skill files directly to disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
checkNo
verboseNo
skill_mdYes
resourcesNo
source_sessionNo
allow_synthesized_frontmatterNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses that the tool runs validation, security scan, capability cross-check, and three-tier deduplication. This reveals significant behavioral traits beyond a simple save, such as potential rejection or merging. It does not, however, specify error behavior or what happens on duplicate detection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at four sentences, with the primary action and key checks in the first sentence. Every sentence adds value, and the structure is front-loaded for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (6 parameters, no output schema), the description lacks parameter explanations and output details. While core usage is clear, an agent cannot reliably construct calls without parameter semantics or understand return values, which is a significant gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and the description explains none of the 6 parameters beyond 'SKILL.md' for skill_md. Terms like resources, source_session, and allow_synthesized_frontmatter remain undefined, leaving the agent without guidance on how to populate them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool submits a SKILL.md to AutoVault and lists the specific checks performed (validation, security scan, etc.). It distinguishes itself from alternatives by explicitly recommending it over writing skill files directly to disk, implying it is for new skills, contrasting with siblings like update_skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use when saving a conversationally created skill or after drafting one for reuse. It also advises preferring this over direct file writes. However, it does not explicitly exclude use cases for updating existing skills, where update_skill might be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_skillA

Update an installed skill. With only name, AutoVault refreshes the recorded GitHub/agentskills/URL source. To update from a new source, pass source and identifier; to update from a local bundle, pass source: "local", skill_dir, and identifier; to explicitly replace from caller-held bytes, pass source: "inline" and skill_md. For SKILL.md-only inline edits, pass reuse_existing_resources: true to validate against the currently installed signed resources. Updates return compact sync counts by default; pass verbose: true for full sync detail. Updates refuse candidates whose frontmatter name does not match name.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
sourceNo
verboseNo
versionNo
skill_mdNo
resourcesNo
skill_dirNo
identifierNo
profile_rootsNo
sync_profilesNo
discover_profile_rootsNo
reuse_existing_resourcesNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full burden. It discloses key behaviors: refreshing source with only name, rejecting mismatched frontmatter, default compact sync counts, and the verbose option. It does not cover side effects or auth requirements, but for an update operation the transparency is relatively high.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph covering numerous update modes and flags without excessive verbosity. It front-loads the main purpose. Each clause adds value, but the density could be slightly improved by splitting into bullet points for easier scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 12 parameters, nested objects, no output schema, the description is fairly complete for the main use cases. However, details on resources, sync profiles, profile_roots, and discover_profile_roots are missing, which may leave agents uncertain about those parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description adds meaning to many parameters (name, source, identifier, skill_dir, skill_md, reuse_existing_resources, verbose). However, parameters like resources, sync_profiles, profile_roots, discover_profile_roots, and version are not explained. The coverage is about 7/12 (58%), providing moderate compensation but with gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Update an installed skill' and distinguishes various update modes (refresh, new source, local, inline). It is specific about the verb and resource, and the sibling tools (add_skill, delete_skill) provide contrast, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use different parameter combinations (e.g., just name for refresh, source+identifier for new source, etc.) and flags like verbose and reuse_existing_resources. However, it does not explicitly contrast when to use this tool over siblings like add_skill, but the update context is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.5.0
    • Changedadd_skill1 field changed
      • addedInput schema / properties / target_agents
        Added value: +{
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
    • Changeddelete_skill2 fields changed
      • addedInput schema / properties / discover_profile_roots
        Added value: +{
        +  "type": "boolean"
        +}
      • addedInput schema / properties / profile_roots
        Added value: +{
        +  "additionalProperties": {
        +    "type": "string"
        +  },
        +  "propertyNames": {
        +    "type": "string"
        +  },
        +  "type": "object"
        +}
  2. 7 tool updatesv0.4.0
    • First observedadd_skill
    • First observedbulk_import
    • First observedcheck_updates
    • First observeddelete_skill
    • First observedget_skill
    • First observedpropose_skill
    • First observedupdate_skill

TDQS

A3.9/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinct lifecycle action—get, add, propose, update, delete, bulk import, and update checking—with clear boundaries. Even the similar add_skill and propose_skill are explicitly separated by whether the skill is sourced from an existing location or newly authored.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern with snake_case: get_skill, add_skill, update_skill, delete_skill, propose_skill. bulk_import and check_updates deviate slightly from the *_skill suffix but still use the same imperative style and are immediately understandable.

Tool Count5/5

Seven tools is well-scoped for a skill vault server. Each tool covers a meaningful operation without redundancy, and the count is neither bloated nor too thin.

Completeness4/5

The toolset covers the full skill lifecycle: create/add, read/search, update, delete, and upstream change detection. A minor gap is the lack of a dedicated list/export tool, though get_skill with a query and alternates partially covers discovery.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers