Skip to main content
Glama

ThirdBrain skills-mcp

Library-agnostic MCP server that serves one or many directories of Agent Skills (SKILL.md folders, flat or nested) over the Model Context Protocol, each library under its own namespace. Part of the ThirdBrain Business Operating Brain (BOB) tooling. Built for the ThirdBrain BOB library (~400 skills) and verified against the GBL library (~400 skills). Includes a pull client that syncs skills from any SEP-2640 server to disk with digest verification.

It implements the MCP Skills extension (SEP-2640) for hosts that understand skill:// resources, and a small set of discovery tools for hosts that do not yet, so skills are loaded on demand instead of being copied into every agent's skills folder.

What it exposes

Surface

Purpose

capabilities.extensions["io.modelcontextprotocol/skills"]

Declares the extension (directoryRead: true).

skills/list (paginated) / skills/get

Skill entries: uri, verbatim frontmatter, resources[] with sha256 digests and sizes.

resources/list

One text/markdown resource per skill (skill://<name>/SKILL.md), extra frontmatter under _meta with the io.modelcontextprotocol.skills/ prefix.

resources/templates/list

skill://{+skillPath}/SKILL.md and skill://{+skillPath}/{+path}.

resources/read

Any bundled file (text, or base64 blob for binaries).

resources/directory/read

Children of a skill directory (inode/directory).

notifications/resources/list_changed

Sent after a rescan detects changes.

Tools

<prefix>_search_skills, _list_skills, _list_libraries, _list_categories, _get_skill, _read_skill_file, _catalog_status. All declare outputSchema and return structuredContent; search/list/categories take a library filter.

Prompt

use-skill(skill, task?) injects a skill's instructions into the conversation.

The agent flow is progressive disclosure: search → get_skill → read_skill_file. Only the skill you pick enters context.

Related MCP server: Taproom

Install

git clone https://github.com/cbruyndoncx/ThirdBrain-skills-mcp.git
cd ThirdBrain-skills-mcp
npm install
npm run build
npm run test:unit   # 66 unit tests (in-memory MCP client, fixtures under test/fixtures)
npm test            # smoke test against the BOB library
npm run test:gbl    # same test against the GBL library
npm run test:nested # nested-path fixture (skill://acme/billing/refunds/...)
npm run test:all
claude mcp add --scope user skills -- node /path/to/ThirdBrain-skills-mcp/dist/index.js \
  --lib bob=/mnt/d/OBS/brncx-skills/00-CORE/Agents/skills \
  --lib gbl=/mnt/d/OBS/gbl-skills/00-CORE/Agents/skills

Each --lib NS=DIR becomes a namespace: URIs are skill://bob/ab-test-setup/SKILL.md, tools accept a bare name when it is unique across libraries, or bob/period-in-review when the same name exists in several. skills_list_libraries shows what is served; library=bob scopes search and listing. The project .mcp.json uses this form.

One library, un-namespaced

node dist/index.js --root /path/to/skills --name bob     # URIs: skill://<skill>/..., tools bob_*

--name sets the MCP server name and the tool prefix. Running several single-library instances side by side also works (different --name per instance).

Streamable HTTP instead of stdio:

node dist/index.js --lib bob=DIR --http 3939   # endpoint: http://127.0.0.1:3939/mcp (stateless)

Pull skills from any SEP-2640 server

node dist/index.js pull --url http://127.0.0.1:3939/mcp --list
node dist/index.js pull --url http://127.0.0.1:3939/mcp ab-test-setup gbl/period-in-review --to ./skills
node dist/index.js pull --all --keep-path --to ./skills --command node dist/index.js --lib bob=DIR

pull walks skills/list, reads every file with resources/read, verifies each sha256 digest against the manifest, refuses paths outside the skill, and writes atomically. --keep-path keeps the namespace as a folder; --force overwrites; --dry-run verifies without writing. --sync updates an existing folder in place: files whose sha256 already matches are kept without a network read, changed or missing ones are fetched, and files no longer in the skill are deleted, so a re-run on an unchanged skill costs one skills/list and some local hashing. Without the CLI installed, npx github:cbruyndoncx/ThirdBrain-skills-mcp pull ... builds and runs it.

Configuration

Flag / env

Default

Meaning

--root / SKILLS_ROOT

one of these required

Single un-namespaced library: a directory searched recursively for SKILL.md folders, or a .zip of one.

--lib NS=DIR / SKILLS_LIBS="a=/x,b=/y.zip"

Namespaced library; repeatable. Cannot be mixed with --root. A .zip root is allowed.

--name / SKILLS_NAME

skills

MCP server name; also the default tool prefix.

--prefix / SKILLS_TOOL_PREFIX

name with -_

Tool-name prefix.

--title / SKILLS_TITLE

derived

Human title in initialize.

--exclude / SKILLS_EXCLUDE

_archive,_audit

Directory names skipped during discovery.

--depth / SKILLS_DEPTH

4

Max discovery depth below root.

--show-disabled / SKILLS_HIDE_DISABLED=false

hidden

Serve skills with disable-model-invocation: true.

SKILLS_MAX_FILE_BYTES

4 MiB

Files above this are not served.

SKILLS_CACHE_DIR

~/.cache/skills-mcp

Where .zip libraries are extracted and downloaded, keyed by content digest.

SKILLS_MAX_DOWNLOAD_BYTES

256 MiB

Ceiling on bytes read from the network for a remote library.

SKILLS_FETCH_TIMEOUT_MS

60000

Timeout for a single HTTP request when fetching a remote library.

SKILLS_FETCH_TOKEN / GH_TOKEN / GITHUB_TOKEN

Bearer token for private archive assets.

SKILLS_MAX_ARCHIVE_BYTES

256 MiB

Total uncompressed size an archive library may extract to.

SKILLS_MAX_ARCHIVE_ENTRIES

8192

Max entries in an archive library.

SKILLS_RESCAN_SECONDS

60

Background rescan interval (0 disables). <prefix>_catalog_status refresh=true forces one.

--stats

Print catalog statistics as JSON and exit.

BOB_SKILLS_* environment variables are still accepted as aliases.

Nested libraries: a skill's URI path is its directory path below root, prefixed by the namespace when there is one (skill://acme/billing/refunds/SKILL.md, skill://bob/ab-test-setup/SKILL.md). Tools accept the bare name (when unique across all libraries), <namespace>/<name>, or the full path.

Always ignored inside skills: .venv, node_modules, __pycache__, *.dist-info, .git, dotfiles, and compiled artefacts (.pyc, .so, .whl, ...).

Archive libraries

A library root may be a .zip instead of a directory:

skills-mcp --lib bob=/srv/libraries/bob-skills.zip
skills-mcp --root ./my-skills.zip

The archive is a transport container, not served content. On the first scan it is extracted into SKILLS_CACHE_DIR/<sha256-of-zip>/, and discovery, linting, digests and URIs then run over ordinary files — nothing downstream knows an archive was involved. Because the cache is keyed by content digest, a rescan of an unchanged archive costs a single stat; replacing the archive extracts the new one and prunes the extraction it replaced.

Skills inside the archive are laid out exactly as in a directory library, so a wrapper directory (as produced by git archive or GitHub's "Download ZIP") is fine — discovery descends into it.

Archives may not appear inside a library. A bundled payload.zip would be served as an opaque base64 blob that the risk linter cannot read, so any skill containing one is refused and reported:

sneaky: bundles archive file(s) (notes.tgz, payload.zip); skills may not contain archives, skill not served

This applies to directory libraries too, and covers .zip .tar .tgz .tar.gz .gz .bz2 .xz .7z .rar .jar .war .apk .iso .dmg .cab — renaming a zip to .tgz does not get past it. The count appears in --stats as archiveSkillsRejected. One bad skill is withheld; the rest of the library still serves.

Remote (URL) libraries

A library may also be an https URL of a .zip, so a published release can be served without checking anything out:

# pinned to a digest (recommended)
skills-mcp --lib sales='https://host/pack-sales-free-v2.7.0.zip#sha256=fac65d24...'

# or in the config file
{"libraries": [{"namespace": "sales", "url": "https://host/pack.zip", "sha256": "fac65d24..."}]}

GitHub release assets work directly, including private ones — export GH_TOKEN and use the asset API URL:

export GH_TOKEN=$(gh auth token)
skills-mcp --lib sales="https://api.github.com/repos/OWNER/REPO/releases/assets/<id>#sha256=<hex>"

Integrity. The archive is verified before extraction: against the sha256 pinned in config, or failing that a <url>.sha256 sidecar next to the asset. A mismatch is refused outright rather than served. Pinning is stronger than the sidecar, since the sidecar travels the same wire as the zip.

Caching. Downloads are keyed by content digest, the same key the extractor uses. A pinned URL that has already been fetched never touches the network again — the second start of the server above scans in ~80 ms. A remote library is fetched once per process; change the URL or the pin to pick up a new version.

Failure handling. If a refresh fails but a previous extraction is still cached, the cached copy keeps being served and a warning is recorded — a transient DNS blip during a background rescan will not empty a live library.

What is refused:

Check

Why

Any scheme but https, on the initial URL and every redirect

No plaintext downgrade mid-chain

More than 5 redirects

Redirect loops

Authorization on a cross-host redirect

A token must not follow a redirect to another host. GitHub relies on this: it redirects asset URLs to a signed object store that must be called without the header

content-length over the cap, or the body exceeding it mid-stream

A lying or absent content-length cannot smuggle a huge body onto disk

A digest that does not match the pin or sidecar

Tampering or corruption

Query strings and fragments are stripped from anything logged, so credentials in a signed URL do not reach a log line.

What is rejected in an archive

The archive is treated as untrusted input. Extraction refuses, before writing anything to disk:

Check

Why

Entry paths containing .., absolute paths, drive letters, backslashes

Path traversal ("zip slip")

Symlink entries

A link to ~/.ssh/id_rsa would otherwise be served verbatim

Encrypted entries, compression methods other than stored/deflate, zip64

Unparseable or unsupported

Nested archives

Hide content from the linter

More than SKILLS_MAX_ARCHIVE_ENTRIES entries

Resource exhaustion

Entries over SKILLS_MAX_FILE_BYTES × 16, or a total over SKILLS_MAX_ARCHIVE_BYTES

Decompression bombs

Compression ratio over 100:1 for entries above 1 MiB

Bombs, without flagging ordinary repetitive content

The byte budget is enforced while inflating, not from the sizes declared in the central directory, since those are attacker-controlled and may lie. A failed extraction leaves no partial tree behind, and extracted files are always written non-executable (0644).

Runtime config file and hardening

node dist/index.js --config skills.json          # re-read on every rescan (default 60 s) and on SIGHUP
{ "libraries": [
    { "namespace": "bob", "root": "/mnt/d/OBS/brncx-skills/00-CORE/Agents/skills",
      "title": "BOB – Business Operating Brain", "source": "brncx-skills", "version": "2026.09",
      "metadata": { "channel": "stable" } },
    { "namespace": "gbl", "root": "../gbl-skills/00-CORE/Agents/skills", "noScripts": true } ],
  "noScripts": false, "lint": true }

Libraries from the file can be added, removed or re-pointed while the server runs; libraries given on the command line stay fixed. Relative roots resolve against the file's directory. A broken edit is logged and the previous set is kept. Changes trigger resources, tools and prompts list_changed notifications. kill -HUP <pid> forces an immediate reload.

Library paths never leave the server. list_libraries, catalog_status, the initialize instructions and skill output show what is loaded, not where it is: the optional title, source (the vault, repository or team the library comes from), version and free-form string metadata from the config file, the kind (directory, archive, url), and for archive and url libraries the sha256 of the archive currently extracted. Warnings returned by catalog_status have root paths replaced by <namespace>. Roots still appear in the server log and in --stats, which are for the operator. Metadata fields are only available in the config file; a library given as --lib NS=DIR shows its namespace and kind.

The server never executes anything. Three additional layers label or withhold risky content:

Layer

What it does

Where it shows up

Provenance

Lifts origin, origin-repo, risk, outbound, outbound_targets, gate_required, dev-status, pricing-tier, license, allowed-tools from frontmatter

_meta["io.modelcontextprotocol.skills/<field>"] on resources, trust in search/list/get_skill output, Provenance: line in get_skill text

--no-scripts (global) / "noScripts": true (per library)

Drops executable files (.sh .bash .zsh .ps1 .bat .cmd .py .js .mjs .cjs .ts .rb .pl .php) from manifests, resources/read and read_skill_file

scriptsWithheld count, _meta[".../scripts-withheld"], catalog status

Scan-time linter (--no-lint to disable)

Regex rules over text files ≤ 512 KiB: pipe-to-shell, remote-exec, eval-decode, base64-blob, destructive-rm, world-writable, sensitive-path, credential-literal, env-exfil, prompt-injection, reverse-shell

Catalog warnings, _meta[".../risk-flags"], riskFlags in search/list results, per-finding file:line in get_skill plus a ⚠ Risk flags banner in its text

The linter labels, it does not block. On BOB + GBL (786 skills) it flags 28, almost all curl … | sh install instructions for third-party tools; those are legitimate but worth knowing before a host runs them. Rules live in src/lint.ts.

Bundled scripts

Skills may ship scripts (scripts/extract.py), and this server serves them like any other file. What happens on the receiving side is up to the host; SEP-2640 sets the rules:

  • Fetched on demand, verified, cached. Hosts SHOULD cache skill files locally as they are read, not in bulk, and MUST verify each file against its sha256 digest from skills/list / skills/get. The cache must be writable only by the host (or re-hashed on every use), live outside every local skill-discovery path, and be separated per server.

  • Cached is not local. A cached script keeps its MCP origin, even after a restart or after the server is disconnected. It never gains the trust of a filesystem skill.

  • No execution without approval. Hosts MUST NOT run a script from an MCP-served skill, or any command its instructions direct the model to run, without explicit per-skill user approval. That approval is bound to the skill's file set and digests; any change revokes it.

  • No executable bits. Files travel one by one as resources, without mode bits or symlinks, so a script is run through its interpreter (python scripts/extract.py), never as ./extract.py.

Hosts without SEP-2640 support reach skills through the tools, so this server repeats those rules to the model. The server instructions, get_skill and the use-skill prompt label every skill with its source server (Source: <name> (MCP-served skill, not installed locally)). Every file in get_skill carries its digest. When a skill bundles scripts, the text output also lists the digests and tells the model to run scripts only from a verified local copy of the whole skill, because scripts import or read their sibling files:

  1. Copy the skill into a cache folder that no host scans for skills, preferably with skills-mcp pull --sync --keep-path --to ~/.cache/skills-mcp-client/<server> <skill-path> (--url or --command as the client is configured). No file content passes through the conversation, digests are verified, and re-running it each session is cheap thanks to --sync. Only when the CLI cannot run: read_skill_file per needed file, written byte-for-byte at its relative path and checked against the digests, never retyped.

  2. Show the user what will run and get their approval.

  3. Run from ~/.cache/skills-mcp-client/<server>/<skill-path>/ through the interpreter.

read_skill_file attaches a short version of these steps, with the digest, to every executable file. Skill output (get_skill, read_skill_file, use-skill) only shows paths relative to the skill folder, never where the skill lives on the server's disk.

For skill authors this means:

  • Reference scripts by path relative to the skill root, and show the interpreter in the command: python scripts/extract.py input.pdf, not ./scripts/extract.py or an absolute path.

  • Do not rely on a script's executable bit, on symlinks, or on files outside the skill directory.

  • Declare dependencies in SKILL.md (or a requirements.txt in the skill), since .venv and node_modules are never served.

  • Expect a host to ask the user before running anything, and write instructions that still make sense if the user says no.

pull into a cache folder, as above, keeps skills out of the host's reach as local skills. Pulled with --to into a folder the host scans for skills, they become local skills instead: an explicit install, not a cache. Pull only from servers you trust, or use --no-scripts on the serving side to withhold scripts entirely.

Spec conformance notes

  • URIs are skill://<skill-path>/<relative-path>; the last skill-path segment equals frontmatter name. A warning is recorded when a directory name and its frontmatter name differ.

  • Digests are computed lazily and cached per file mtime, so skills/list is cheap after the first call.

  • SEP-2640 limits (512 files, 16 MiB per skill) are enforced/flagged: file lists are truncated at 512 and oversized skills are listed in bob_catalog_status include_warnings=true. In BOB, visual-narrative, period-in-review and workflow-video exceed 16 MiB because of bundled media; strict hosts may refuse them, all others load fine.

  • skills/get answers for hidden (disabled) skills too, as the spec requires.

Layout

src/config.ts       env/CLI configuration
src/frontmatter.ts  SKILL.md frontmatter parsing
src/catalog.ts      directory scan, file inventory, digests, change detection
src/archive.ts      zip-backed libraries: strict extraction, path/bomb/symlink defences, digest cache
src/remote.ts       remote libraries: https fetch, redirect/credential rules, digest verification
src/search.ts       ranked keyword search over name/description/tags/body
src/server.ts       MCP wiring: extension methods, resources, tools, prompt
src/lint.ts         scan-time risk linter (labels, never blocks)
src/pull.ts         client: sync skills from a SEP-2640 server with digest verification
src/index.ts        entrypoint: `serve` (default; stdio or --http) and `pull`
test/unit/*.test.ts unit tests (config, frontmatter, catalog, search, server via InMemoryTransport, pull, hardening, archive, remote)
test/smoke.ts       end-to-end test via a real MCP client (parametrised by root/name)
test/nested.mjs     nested-path + duplicate-name test against test/fixtures/nested

Available Tools

7 tools
skills_catalog_statusskills catalog statusA
Read-only

Catalog statistics (libraries, skill count, files, last scan, frontmatter warnings). Pass refresh=true to force a rescan of the skills directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNo
include_warningsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
rootNo
bytesYes
filesYes
hiddenYes
scanMsNo
skillsYes
warningsNo
librariesNo
scannedAtYes
categoriesNo
warningCountYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and idempotentHint=false, and the description adds useful behavioral context: refresh=true forces a rescan of skills directories. This goes beyond the schema and annotations by disclosing a potentially expensive or state-changing behavior within an otherwise read-only operation. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two brief sentences with no filler. The first sentence front-loads the core purpose and returned data, and the second adds the key behavioral option. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering read-only behavior, the description is sufficient for an agent to understand the tool's role. The main gap is the undocumented include_warnings parameter, but given the low complexity and existing output schema, the description is still reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It explicitly explains refresh=true, but it does not explain include_warnings, which is only vaguely implied by the mention of frontmatter warnings. With two parameters and one undocumented, the description only partially compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as providing catalog statistics, listing specific data points (libraries, skill count, files, last scan, frontmatter warnings). It is easily distinguished from sibling tools that search, list, or fetch specific catalog items, though it does not explicitly name the verb 'get' or 'retrieve'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for inspecting catalog health and statistics rather than searching or listing resources, but it does not explicitly state when to prefer it over siblings or provide exclusions. The refresh hint gives one concrete usage scenario, but overall guidance is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

skills_get_skillLoad a skills skillA
Read-onlyIdempotent

Load a skill's full SKILL.md instructions and its bundled file list. Follow the instructions as if the skill were installed. Use skills_read_skill_file for referenced files.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSkill name (when unique), '<library>/<name>', or the full skill path from search results
include_frontmatterNoInclude the raw frontmatter metadata block

Output Schema

ParametersJSON Schema
NameRequiredDescription
uriYes
nameYes
pathYes
filesYes
trustNo
libraryNo
categoryNo
riskFlagsYes
rootOnDiskNo
descriptionYes
frontmatterNo
instructionsYesSKILL.md body without frontmatter
scriptsWithheldNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool read-only and idempotent, so the description's main behavioral addition is the directive to 'follow the instructions as if the skill were installed,' which is important context for how the returned content should be treated. It also discloses that the tool returns both SKILL.md content and a bundled file list.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: the core action, the behavioral directive to follow the instructions, and the sibling-tool routing. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with a full output schema and read-only/idempotent annotations, the description covers the essential behavior, the instruction-following expectation, and the only likely workflow question (how to read referenced files). Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: both name formats and include_frontmatter semantics are documented in the schema. The description adds no extra parameter detail beyond naming the bundled file list, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Load a skill's full SKILL.md instructions and its bundled file list.' This clearly identifies the tool's function and distinguishes it from siblings like skills_read_skill_file by noting that referenced files are handled separately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context—load the full skill content and follow it as if installed—and explicitly routes referenced-file access to skills_read_skill_file. It does not spell out when to prefer this over search or list tools, but the distinction is implied well enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

skills_list_categoriesList skills skill categoriesA
Read-onlyIdempotent

All categories with skill counts, plus value chains. Optionally scoped to one library.

ParametersJSON Schema
NameRequiredDescriptionDefault
libraryNoOptional library filter (single-library server: ignored).

Output Schema

ParametersJSON Schema
NameRequiredDescription
categoriesYes
totalSkillsYes
valueChainsYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral detail beyond annotations: it returns all categories, includes skill counts, and also includes value chains. The read-only and idempotent annotations already cover safety, so the description's additional output-scope details are valuable without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: it states the primary output immediately, then adds the optional scoping. Every sentence earns its place with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with one optional parameter, a strong output schema, and annotations covering read-only/idempotent behavior, the description fully covers what an agent needs to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the only parameter, library, and the schema already explains it as an optional filter with a single-library-server caveat. The description's mention of optional library scoping adds nothing beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all categories with skill counts and value chains, with optional library scoping. This distinguishes it from sibling tools like skills_list_skills or skills_search_skills by focusing on category-level aggregation rather than individual skill retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the context clear: use this tool when you need a category overview with counts and value chains. It does not explicitly name alternatives or provide exclusionary guidance, but the distinction from siblings is evident from the resource type it targets.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

skills_list_librariesList skills librariesA
Read-onlyIdempotent

Skill libraries served by this server, with namespace, root directory and skill counts. Namespaces are the first segment of skill:// URIs.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
librariesYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and openWorldHint: false. The description adds useful context by specifying the output contents (namespace, root directory, skill counts) and explaining that namespaces are the first segment of skill:// URIs. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence conveys the resource type, scope, output details, and a useful naming convention. There is no filler, and every phrase adds meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless, read-only tool with an output schema, the description fully covers what the tool returns and how namespaces relate to URIs. An agent has enough information to select and invoke this tool correctly without additional details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema description coverage, the baseline is 4. There are no parameter semantics to document, so the description does not need to compensate for any parameter gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('skill libraries') and clearly indicates what the result contains: namespace, root directory, and skill counts. This distinguishes it from sibling tools like skills_list_skills, which would list individual skills rather than libraries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied: call this when you need an inventory of skill libraries and their namespaces/root directories. However, there is no explicit statement of when to prefer this over alternatives such as skills_list_skills or skills_list_categories, nor any when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

skills_list_skillsList skills skillsA
Read-onlyIdempotent

Compact catalog listing (name + one-line description), optionally filtered by library and/or category (see skills_list_categories). Paginated with cursor.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
cursorNoOpaque cursor from a previous call
libraryNoOptional library filter (single-library server: ignored).
categoryNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalYes
skillsYes
nextCursorNo

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the safety profile is covered. The description adds useful behavioral context: results are compact name+description entries, pagination uses a cursor, and filtering is optional.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, tight sentence that front-loads the core purpose, then states filters and pagination. Every clause adds useful information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with an output schema, annotations, and a simple parameter set, the description covers output shape, filtering options, and pagination. It is sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 50% schema description coverage, the description compensates by clarifying that library and category are optional filters and that pagination uses a cursor. It does not add meaning for the limit parameter, though the schema's default/min/max constraints provide partial guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists skills as a compact catalog, with name and one-line description, and that filters by library/category are available. It distinguishes itself from get_skill and read_skill_file through the 'catalog listing' framing, though it does not explicitly contrast itself with skills_search_skills.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for browsing/enumerating skills and points to skills_list_categories for category context, which is helpful. However, it never explicitly says when to use this list tool instead of skills_search_skills or get_skill, leaving the routing decision partly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

skills_read_skill_fileRead a skills skill fileA
Read-onlyIdempotent

Read a file bundled with a skill, by skill name/path and relative path (e.g. 'references/troubleshooting.md', 'scripts/run.py'). Binary files are returned base64-encoded.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
pathYesPath relative to the skill directory

Output Schema

ParametersJSON Schema
NameRequiredDescription
uriYes
pathYes
sizeYes
textNo
base64No
digestYes
mimeTypeYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, idempotentHint, and openWorldHint, covering safety. The description adds useful behavioral detail beyond annotations: binary files are returned base64-encoded, which materially affects how an agent consumes the response.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: purpose, parameter behavior, examples, and special return encoding are all included efficiently. Information is front-loaded and every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read tool with strong annotations and an output schema, the description is nearly complete. The only gap is the exact format or scope of the 'name' param, which keeps it from being fully self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% and the description partially compensates by explaining relative paths with examples. However, the 'name' parameter remains somewhat ambiguous ('skill name/path'), and the description does not clearly specify whether it accepts a name, a path, or both.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Read') and a clear resource ('a file bundled with a skill'), and explains the addressing scheme with concrete examples. This clearly differentiates it from sibling tools like skills_get_skill, skills_search_skills, and skills_list_skills.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the description and examples, but there is no explicit guidance on when to use this tool versus alternatives like skills_get_skill. For a small sibling group, an explicit 'when to use' statement would strengthen the definition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

skills_search_skillsSearch skills skillsA
Read-onlyIdempotent

Ranked search over the skills skill library by task, keyword, or trigger phrase. Returns name, description, category. Call this first, then skills_get_skill to load one.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
queryYesWhat you need to do, e.g. 'A/B test sample size', 'level 10 meeting', 'invoice reconciliation'
libraryNoOptional library filter (single-library server: ignored).
categoryNoOptional exact category filter (see skills_list_categories)
value_chainNoOptional value-chain filter, e.g. 'infrastructure'

Output Schema

ParametersJSON Schema
NameRequiredDescription
hintNo
resultsYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds meaningful behavioral detail: results are ranked, and the return surface is name/description/category. This is useful context beyond the structured annotations and schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry the core purpose, query semantics, return fields, and the recommended workflow. There is no filler, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only search tool with an output schema, rich parameter descriptions, and readOnly/idempotent annotations, the description is complete. It tells the agent what to search on, what will be returned, and how to proceed to the next step. No critical missing context prevents correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is high (80%), so the schema already documents parameters well. The description adds value by clarifying what kinds of query terms are expected ('task, keyword, or trigger phrase'), which is a semantic cue not fully captured by the schema's 'What you need to do' phrasing. It does not need to repeat every parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Ranked search'), a clear resource ('the skills skill library'), and the input modalities ('by task, keyword, or trigger phrase'). It also differentiates from siblings by prescribing the follow-up flow to skills_get_skill. The awkward title does not undermine the clarity of the description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly tells the agent when to use this tool first in a workflow ('Call this first, then skills_get_skill to load one'). It provides clear context for using search as an entry point, but it does not explicitly state when to prefer a sibling like skills_list_skills instead, so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv1.2.0
    • First observedskills_catalog_status
    • First observedskills_get_skill
    • First observedskills_list_categories
    • First observedskills_list_libraries
    • First observedskills_list_skills
    • First observedskills_read_skill_file
    • First observedskills_search_skills

TDQS

A4.2/5.0

Scored across 7 tools

Disambiguation5/5

Each tool has a distinct responsibility: search, list skills, list libraries, list categories, load a skill, read a bundled file, and check catalog status. Search and list are clearly differentiated by ranked querying versus catalog enumeration, and get vs read file are separated by skill-level vs file-level access.

Naming Consistency4/5

Tools consistently use a skills_ prefix with snake_case and a mostly verb_noun pattern (search_skills, list_skills, get_skill, read_skill_file). The only minor deviation is skills_catalog_status, which is noun-based rather than verb-based, but the overall pattern remains predictable.

Tool Count5/5

Seven tools is well-scoped for a skills library server: discovery, retrieval, browsing metadata, and status management are all covered without unnecessary redundancy. Each tool earns its place in the workflow.

Completeness5/5

The tool surface covers the full skill-consumption workflow: discover skills via search or listing, navigate libraries and categories, load the full SKILL.md, read referenced files, and verify catalog health. No significant gaps are apparent for the stated purpose of serving skills.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to discover, install, and manage SKILL.md skills from a Git-backed registry via MCP tools for search, install, and list operations.
    4 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Discovers and manages portable agent capabilities (skills and MCP servers) from configurable collections, providing search, inspection, and local installation via CLI and MCP tools.
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables managing a canonical library of agent skills and MCP servers, syncing them across multiple development harnesses, and adding, importing, or configuring them through MCP tools.
    14 npm
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables MCP-capable agents to search, inspect, lint, and safely install Agent Skills from the skillmd registry mid-conversation.
    0
    1
    MIT