ThirdBrain skills-mcp
This server serves Agent Skills directories over MCP, letting clients search, browse, load, and pull skills on demand.
Exposes one or many SKILL.md libraries as namespaced MCP resources/tools (SEP-2640 skills extension, plus discovery tools for non-extension hosts).
Searches skills by task or keyword with ranked results and filters for library, category, and value chain.
Lists skills, libraries, categories, and catalog status; supports pagination and forced rescans.
Loads a skill's full instructions and file manifest via
get_skillor theuse-skillprompt.Reads individual skill files (text or base64-encoded binaries), with digests, MIME types, and risk flags.
Syncs skills from any SEP-2640 server to disk via
pull, verifying sha256 digests and supporting--sync,--keep-path,--dry-run, and--force.Serves skills from directories, .zip archives, or remote HTTPS URLs, with archive hardening, integrity pinning, and digest-keyed caching.
Applies provenance metadata, can withhold scripts (
--no-scripts), and labels scan-time lint findings to help hosts assess risk.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ThirdBrain skills-mcpFind a skill for creating a customer onboarding plan"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ThirdBrain skills-mcp
Library-agnostic MCP server that serves one or many directories of Agent Skills (SKILL.md
folders, flat or nested) over the Model Context Protocol, each library under its own namespace. Part of the ThirdBrain Business Operating Brain (BOB) tooling.
Built for the ThirdBrain BOB library (~400 skills) and verified against the GBL library (~400 skills).
Includes a pull client that syncs skills from any SEP-2640 server to disk with digest verification.
It implements the MCP Skills extension (SEP-2640)
for hosts that understand skill:// resources, and a small set of discovery tools for hosts
that do not yet, so skills are loaded on demand instead of being copied into every agent's
skills folder.
What it exposes
Surface | Purpose |
| Declares the extension ( |
| Skill entries: |
| One |
|
|
| Any bundled file (text, or base64 blob for binaries). |
| Children of a skill directory ( |
| Sent after a rescan detects changes. |
Tools |
|
Prompt |
|
The agent flow is progressive disclosure: search → get_skill → read_skill_file. Only the skill you pick enters context.
Related MCP server: Taproom
Install
git clone https://github.com/cbruyndoncx/ThirdBrain-skills-mcp.git
cd ThirdBrain-skills-mcp
npm install
npm run build
npm run test:unit # 66 unit tests (in-memory MCP client, fixtures under test/fixtures)
npm test # smoke test against the BOB library
npm run test:gbl # same test against the GBL library
npm run test:nested # nested-path fixture (skill://acme/billing/refunds/...)
npm run test:allOne server, several libraries (recommended)
claude mcp add --scope user skills -- node /path/to/ThirdBrain-skills-mcp/dist/index.js \
--lib bob=/mnt/d/OBS/brncx-skills/00-CORE/Agents/skills \
--lib gbl=/mnt/d/OBS/gbl-skills/00-CORE/Agents/skillsEach --lib NS=DIR becomes a namespace: URIs are skill://bob/ab-test-setup/SKILL.md,
tools accept a bare name when it is unique across libraries, or bob/period-in-review when the same
name exists in several. skills_list_libraries shows what is served; library=bob scopes search
and listing. The project .mcp.json uses this form.
One library, un-namespaced
node dist/index.js --root /path/to/skills --name bob # URIs: skill://<skill>/..., tools bob_*--name sets the MCP server name and the tool prefix. Running several single-library instances
side by side also works (different --name per instance).
Streamable HTTP instead of stdio:
node dist/index.js --lib bob=DIR --http 3939 # endpoint: http://127.0.0.1:3939/mcp (stateless)Pull skills from any SEP-2640 server
node dist/index.js pull --url http://127.0.0.1:3939/mcp --list
node dist/index.js pull --url http://127.0.0.1:3939/mcp ab-test-setup gbl/period-in-review --to ./skills
node dist/index.js pull --all --keep-path --to ./skills --command node dist/index.js --lib bob=DIRpull walks skills/list, reads every file with resources/read, verifies each sha256 digest
against the manifest, refuses paths outside the skill, and writes atomically. --keep-path keeps
the namespace as a folder; --force overwrites; --dry-run verifies without writing. --sync
updates an existing folder in place: files whose sha256 already matches are kept without a network
read, changed or missing ones are fetched, and files no longer in the skill are deleted, so a
re-run on an unchanged skill costs one skills/list and some local hashing. Without the CLI
installed, npx github:cbruyndoncx/ThirdBrain-skills-mcp pull ... builds and runs it.
Configuration
Flag / env | Default | Meaning |
| one of these required | Single un-namespaced library: a directory searched recursively for |
| Namespaced library; repeatable. Cannot be mixed with | |
|
| MCP server name; also the default tool prefix. |
| name with | Tool-name prefix. |
| derived | Human title in |
|
| Directory names skipped during discovery. |
|
| Max discovery depth below root. |
| hidden | Serve skills with |
| 4 MiB | Files above this are not served. |
|
| Where |
| 256 MiB | Ceiling on bytes read from the network for a remote library. |
|
| Timeout for a single HTTP request when fetching a remote library. |
| Bearer token for private archive assets. | |
| 256 MiB | Total uncompressed size an archive library may extract to. |
|
| Max entries in an archive library. |
|
| Background rescan interval ( |
| Print catalog statistics as JSON and exit. |
BOB_SKILLS_* environment variables are still accepted as aliases.
Nested libraries: a skill's URI path is its directory path below root, prefixed by the namespace
when there is one (skill://acme/billing/refunds/SKILL.md, skill://bob/ab-test-setup/SKILL.md).
Tools accept the bare name (when unique across all libraries), <namespace>/<name>, or the full path.
Always ignored inside skills: .venv, node_modules, __pycache__, *.dist-info, .git,
dotfiles, and compiled artefacts (.pyc, .so, .whl, ...).
Archive libraries
A library root may be a .zip instead of a directory:
skills-mcp --lib bob=/srv/libraries/bob-skills.zip
skills-mcp --root ./my-skills.zipThe archive is a transport container, not served content. On the first scan it is extracted into
SKILLS_CACHE_DIR/<sha256-of-zip>/, and discovery, linting, digests and URIs then run over ordinary
files — nothing downstream knows an archive was involved. Because the cache is keyed by content
digest, a rescan of an unchanged archive costs a single stat; replacing the archive extracts the
new one and prunes the extraction it replaced.
Skills inside the archive are laid out exactly as in a directory library, so a wrapper directory
(as produced by git archive or GitHub's "Download ZIP") is fine — discovery descends into it.
Archives may not appear inside a library. A bundled payload.zip would be served as an opaque
base64 blob that the risk linter cannot read, so any skill containing one is refused and reported:
sneaky: bundles archive file(s) (notes.tgz, payload.zip); skills may not contain archives, skill not servedThis applies to directory libraries too, and covers .zip .tar .tgz .tar.gz .gz .bz2 .xz .7z .rar .jar .war .apk .iso .dmg .cab — renaming a zip to .tgz does not get past it. The count appears in
--stats as archiveSkillsRejected. One bad skill is withheld; the rest of the library still serves.
Remote (URL) libraries
A library may also be an https URL of a .zip, so a published release can be served without
checking anything out:
# pinned to a digest (recommended)
skills-mcp --lib sales='https://host/pack-sales-free-v2.7.0.zip#sha256=fac65d24...'
# or in the config file
{"libraries": [{"namespace": "sales", "url": "https://host/pack.zip", "sha256": "fac65d24..."}]}GitHub release assets work directly, including private ones — export GH_TOKEN and use the asset
API URL:
export GH_TOKEN=$(gh auth token)
skills-mcp --lib sales="https://api.github.com/repos/OWNER/REPO/releases/assets/<id>#sha256=<hex>"Integrity. The archive is verified before extraction: against the sha256 pinned in config, or
failing that a <url>.sha256 sidecar next to the asset. A mismatch is refused outright rather than
served. Pinning is stronger than the sidecar, since the sidecar travels the same wire as the zip.
Caching. Downloads are keyed by content digest, the same key the extractor uses. A pinned URL that has already been fetched never touches the network again — the second start of the server above scans in ~80 ms. A remote library is fetched once per process; change the URL or the pin to pick up a new version.
Failure handling. If a refresh fails but a previous extraction is still cached, the cached copy keeps being served and a warning is recorded — a transient DNS blip during a background rescan will not empty a live library.
What is refused:
Check | Why |
Any scheme but | No plaintext downgrade mid-chain |
More than 5 redirects | Redirect loops |
| A token must not follow a redirect to another host. GitHub relies on this: it redirects asset URLs to a signed object store that must be called without the header |
| A lying or absent |
A digest that does not match the pin or sidecar | Tampering or corruption |
Query strings and fragments are stripped from anything logged, so credentials in a signed URL do not reach a log line.
What is rejected in an archive
The archive is treated as untrusted input. Extraction refuses, before writing anything to disk:
Check | Why |
Entry paths containing | Path traversal ("zip slip") |
Symlink entries | A link to |
Encrypted entries, compression methods other than stored/deflate, zip64 | Unparseable or unsupported |
Nested archives | Hide content from the linter |
More than | Resource exhaustion |
Entries over | Decompression bombs |
Compression ratio over 100:1 for entries above 1 MiB | Bombs, without flagging ordinary repetitive content |
The byte budget is enforced while inflating, not from the sizes declared in the central
directory, since those are attacker-controlled and may lie. A failed extraction leaves no partial
tree behind, and extracted files are always written non-executable (0644).
Runtime config file and hardening
node dist/index.js --config skills.json # re-read on every rescan (default 60 s) and on SIGHUP{ "libraries": [
{ "namespace": "bob", "root": "/mnt/d/OBS/brncx-skills/00-CORE/Agents/skills",
"title": "BOB – Business Operating Brain", "source": "brncx-skills", "version": "2026.09",
"metadata": { "channel": "stable" } },
{ "namespace": "gbl", "root": "../gbl-skills/00-CORE/Agents/skills", "noScripts": true } ],
"noScripts": false, "lint": true }Libraries from the file can be added, removed or re-pointed while the server runs; libraries given
on the command line stay fixed. Relative roots resolve against the file's directory. A broken edit is
logged and the previous set is kept. Changes trigger resources, tools and prompts
list_changed notifications. kill -HUP <pid> forces an immediate reload.
Library paths never leave the server. list_libraries, catalog_status, the initialize
instructions and skill output show what is loaded, not where it is: the optional title, source
(the vault, repository or team the library comes from), version and free-form string metadata
from the config file, the kind (directory, archive, url), and for archive and url
libraries the sha256 of the archive currently extracted. Warnings returned by catalog_status
have root paths replaced by <namespace>. Roots still appear in the server log and in --stats,
which are for the operator. Metadata fields are only available in the config file; a library given
as --lib NS=DIR shows its namespace and kind.
The server never executes anything. Three additional layers label or withhold risky content:
Layer | What it does | Where it shows up |
Provenance | Lifts |
|
| Drops executable files ( |
|
Scan-time linter ( | Regex rules over text files ≤ 512 KiB: | Catalog warnings, |
The linter labels, it does not block. On BOB + GBL (786 skills) it flags 28, almost all
curl … | sh install instructions for third-party tools; those are legitimate but worth knowing
before a host runs them. Rules live in src/lint.ts.
Bundled scripts
Skills may ship scripts (scripts/extract.py), and this server serves them like any other file.
What happens on the receiving side is up to the host; SEP-2640 sets the rules:
Fetched on demand, verified, cached. Hosts SHOULD cache skill files locally as they are read, not in bulk, and MUST verify each file against its
sha256digest fromskills/list/skills/get. The cache must be writable only by the host (or re-hashed on every use), live outside every local skill-discovery path, and be separated per server.Cached is not local. A cached script keeps its MCP origin, even after a restart or after the server is disconnected. It never gains the trust of a filesystem skill.
No execution without approval. Hosts MUST NOT run a script from an MCP-served skill, or any command its instructions direct the model to run, without explicit per-skill user approval. That approval is bound to the skill's file set and digests; any change revokes it.
No executable bits. Files travel one by one as resources, without mode bits or symlinks, so a script is run through its interpreter (
python scripts/extract.py), never as./extract.py.
Hosts without SEP-2640 support reach skills through the tools, so this server repeats those rules
to the model. The server instructions, get_skill and the use-skill prompt label every skill with
its source server (Source: <name> (MCP-served skill, not installed locally)). Every file in
get_skill carries its digest. When a skill bundles scripts, the text output also lists the
digests and tells the model to run scripts only from a verified local copy of the whole skill,
because scripts import or read their sibling files:
Copy the skill into a cache folder that no host scans for skills, preferably with
skills-mcp pull --sync --keep-path --to ~/.cache/skills-mcp-client/<server> <skill-path>(--urlor--commandas the client is configured). No file content passes through the conversation, digests are verified, and re-running it each session is cheap thanks to--sync. Only when the CLI cannot run:read_skill_fileper needed file, written byte-for-byte at its relative path and checked against the digests, never retyped.Show the user what will run and get their approval.
Run from
~/.cache/skills-mcp-client/<server>/<skill-path>/through the interpreter.
read_skill_file attaches a short version of these steps, with the digest, to every executable
file. Skill output (get_skill, read_skill_file, use-skill) only shows paths relative to the
skill folder, never where the skill lives on the server's disk.
For skill authors this means:
Reference scripts by path relative to the skill root, and show the interpreter in the command:
python scripts/extract.py input.pdf, not./scripts/extract.pyor an absolute path.Do not rely on a script's executable bit, on symlinks, or on files outside the skill directory.
Declare dependencies in
SKILL.md(or arequirements.txtin the skill), since.venvandnode_modulesare never served.Expect a host to ask the user before running anything, and write instructions that still make sense if the user says no.
pull into a cache folder, as above, keeps skills out of the host's reach as local skills. Pulled
with --to into a folder the host scans for skills, they become local skills instead: an explicit
install, not a cache. Pull only from servers you trust, or use --no-scripts on the serving side
to withhold scripts entirely.
Spec conformance notes
URIs are
skill://<skill-path>/<relative-path>; the last skill-path segment equals frontmattername. A warning is recorded when a directory name and its frontmatternamediffer.Digests are computed lazily and cached per file
mtime, soskills/listis cheap after the first call.SEP-2640 limits (512 files, 16 MiB per skill) are enforced/flagged: file lists are truncated at 512 and oversized skills are listed in
bob_catalog_status include_warnings=true. In BOB,visual-narrative,period-in-reviewandworkflow-videoexceed 16 MiB because of bundled media; strict hosts may refuse them, all others load fine.skills/getanswers for hidden (disabled) skills too, as the spec requires.
Layout
src/config.ts env/CLI configuration
src/frontmatter.ts SKILL.md frontmatter parsing
src/catalog.ts directory scan, file inventory, digests, change detection
src/archive.ts zip-backed libraries: strict extraction, path/bomb/symlink defences, digest cache
src/remote.ts remote libraries: https fetch, redirect/credential rules, digest verification
src/search.ts ranked keyword search over name/description/tags/body
src/server.ts MCP wiring: extension methods, resources, tools, prompt
src/lint.ts scan-time risk linter (labels, never blocks)
src/pull.ts client: sync skills from a SEP-2640 server with digest verification
src/index.ts entrypoint: `serve` (default; stdio or --http) and `pull`
test/unit/*.test.ts unit tests (config, frontmatter, catalog, search, server via InMemoryTransport, pull, hardening, archive, remote)
test/smoke.ts end-to-end test via a real MCP client (parametrised by root/name)
test/nested.mjs nested-path + duplicate-name test against test/fixtures/nestedAvailable Tools
7 toolsskills_catalog_statusskills catalog statusARead-only
Catalog statistics (libraries, skill count, files, last scan, frontmatter warnings). Pass refresh=true to force a rescan of the skills directories.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | ||
| include_warnings | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| root | No | |
| bytes | Yes | |
| files | Yes | |
| hidden | Yes | |
| scanMs | No | |
| skills | Yes | |
| warnings | No | |
| libraries | No | |
| scannedAt | Yes | |
| categories | No | |
| warningCount | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and idempotentHint=false, and the description adds useful behavioral context: refresh=true forces a rescan of skills directories. This goes beyond the schema and annotations by disclosing a potentially expensive or state-changing behavior within an otherwise read-only operation. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two brief sentences with no filler. The first sentence front-loads the core purpose and returned data, and the second adds the key behavioral option. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and annotations covering read-only behavior, the description is sufficient for an agent to understand the tool's role. The main gap is the undocumented include_warnings parameter, but given the low complexity and existing output schema, the description is still reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning. It explicitly explains refresh=true, but it does not explain include_warnings, which is only vaguely implied by the mention of frontmatter warnings. With two parameters and one undocumented, the description only partially compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as providing catalog statistics, listing specific data points (libraries, skill count, files, last scan, frontmatter warnings). It is easily distinguished from sibling tools that search, list, or fetch specific catalog items, though it does not explicitly name the verb 'get' or 'retrieve'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for inspecting catalog health and statistics rather than searching or listing resources, but it does not explicitly state when to prefer it over siblings or provide exclusions. The refresh hint gives one concrete usage scenario, but overall guidance is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_get_skillLoad a skills skillARead-onlyIdempotent
Load a skill's full SKILL.md instructions and its bundled file list. Follow the instructions as if the skill were installed. Use skills_read_skill_file for referenced files.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Skill name (when unique), '<library>/<name>', or the full skill path from search results | |
| include_frontmatter | No | Include the raw frontmatter metadata block |
Output Schema
| Name | Required | Description |
|---|---|---|
| uri | Yes | |
| name | Yes | |
| path | Yes | |
| files | Yes | |
| trust | No | |
| library | No | |
| category | No | |
| riskFlags | Yes | |
| rootOnDisk | No | |
| description | Yes | |
| frontmatter | No | |
| instructions | Yes | SKILL.md body without frontmatter |
| scriptsWithheld | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool read-only and idempotent, so the description's main behavioral addition is the directive to 'follow the instructions as if the skill were installed,' which is important context for how the returned content should be treated. It also discloses that the tool returns both SKILL.md content and a bundled file list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the core action, the behavioral directive to follow the instructions, and the sibling-tool routing. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with a full output schema and read-only/idempotent annotations, the description covers the essential behavior, the instruction-following expectation, and the only likely workflow question (how to read referenced files). Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both name formats and include_frontmatter semantics are documented in the schema. The description adds no extra parameter detail beyond naming the bundled file list, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Load a skill's full SKILL.md instructions and its bundled file list.' This clearly identifies the tool's function and distinguishes it from siblings like skills_read_skill_file by noting that referenced files are handled separately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context—load the full skill content and follow it as if installed—and explicitly routes referenced-file access to skills_read_skill_file. It does not spell out when to prefer this over search or list tools, but the distinction is implied well enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_list_categoriesList skills skill categoriesARead-onlyIdempotent
All categories with skill counts, plus value chains. Optionally scoped to one library.
| Name | Required | Description | Default |
|---|---|---|---|
| library | No | Optional library filter (single-library server: ignored). |
Output Schema
| Name | Required | Description |
|---|---|---|
| categories | Yes | |
| totalSkills | Yes | |
| valueChains | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral detail beyond annotations: it returns all categories, includes skill counts, and also includes value chains. The read-only and idempotent annotations already cover safety, so the description's additional output-scope details are valuable without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it states the primary output immediately, then adds the optional scoping. Every sentence earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with one optional parameter, a strong output schema, and annotations covering read-only/idempotent behavior, the description fully covers what an agent needs to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the only parameter, library, and the schema already explains it as an optional filter with a single-library-server caveat. The description's mention of optional library scoping adds nothing beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all categories with skill counts and value chains, with optional library scoping. This distinguishes it from sibling tools like skills_list_skills or skills_search_skills by focusing on category-level aggregation rather than individual skill retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the context clear: use this tool when you need a category overview with counts and value chains. It does not explicitly name alternatives or provide exclusionary guidance, but the distinction from siblings is evident from the resource type it targets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_list_librariesList skills librariesARead-onlyIdempotent
Skill libraries served by this server, with namespace, root directory and skill counts. Namespaces are the first segment of skill:// URIs.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| libraries | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint: false. The description adds useful context by specifying the output contents (namespace, root directory, skill counts) and explaining that namespaces are the first segment of skill:// URIs. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence conveys the resource type, scope, output details, and a useful naming convention. There is no filler, and every phrase adds meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only tool with an output schema, the description fully covers what the tool returns and how namespaces relate to URIs. An agent has enough information to select and invoke this tool correctly without additional details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters and 100% schema description coverage, the baseline is 4. There are no parameter semantics to document, so the description does not need to compensate for any parameter gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('skill libraries') and clearly indicates what the result contains: namespace, root directory, and skill counts. This distinguishes it from sibling tools like skills_list_skills, which would list individual skills rather than libraries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied: call this when you need an inventory of skill libraries and their namespaces/root directories. However, there is no explicit statement of when to prefer this over alternatives such as skills_list_skills or skills_list_categories, nor any when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_list_skillsList skills skillsARead-onlyIdempotent
Compact catalog listing (name + one-line description), optionally filtered by library and/or category (see skills_list_categories). Paginated with cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| cursor | No | Opaque cursor from a previous call | |
| library | No | Optional library filter (single-library server: ignored). | |
| category | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| total | Yes | |
| skills | Yes | |
| nextCursor | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the safety profile is covered. The description adds useful behavioral context: results are compact name+description entries, pagination uses a cursor, and filtering is optional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tight sentence that front-loads the core purpose, then states filters and pagination. Every clause adds useful information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with an output schema, annotations, and a simple parameter set, the description covers output shape, filtering options, and pagination. It is sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 50% schema description coverage, the description compensates by clarifying that library and category are optional filters and that pagination uses a cursor. It does not add meaning for the limit parameter, though the schema's default/min/max constraints provide partial guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists skills as a compact catalog, with name and one-line description, and that filters by library/category are available. It distinguishes itself from get_skill and read_skill_file through the 'catalog listing' framing, though it does not explicitly contrast itself with skills_search_skills.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for browsing/enumerating skills and points to skills_list_categories for category context, which is helpful. However, it never explicitly says when to use this list tool instead of skills_search_skills or get_skill, leaving the routing decision partly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_read_skill_fileRead a skills skill fileARead-onlyIdempotent
Read a file bundled with a skill, by skill name/path and relative path (e.g. 'references/troubleshooting.md', 'scripts/run.py'). Binary files are returned base64-encoded.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| path | Yes | Path relative to the skill directory |
Output Schema
| Name | Required | Description |
|---|---|---|
| uri | Yes | |
| path | Yes | |
| size | Yes | |
| text | No | |
| base64 | No | |
| digest | Yes | |
| mimeType | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint, idempotentHint, and openWorldHint, covering safety. The description adds useful behavioral detail beyond annotations: binary files are returned base64-encoded, which materially affects how an agent consumes the response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: purpose, parameter behavior, examples, and special return encoding are all included efficiently. Information is front-loaded and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with strong annotations and an output schema, the description is nearly complete. The only gap is the exact format or scope of the 'name' param, which keeps it from being fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50% and the description partially compensates by explaining relative paths with examples. However, the 'name' parameter remains somewhat ambiguous ('skill name/path'), and the description does not clearly specify whether it accepts a name, a path, or both.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and a clear resource ('a file bundled with a skill'), and explains the addressing scheme with concrete examples. This clearly differentiates it from sibling tools like skills_get_skill, skills_search_skills, and skills_list_skills.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the description and examples, but there is no explicit guidance on when to use this tool versus alternatives like skills_get_skill. For a small sibling group, an explicit 'when to use' statement would strengthen the definition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_search_skillsSearch skills skillsARead-onlyIdempotent
Ranked search over the skills skill library by task, keyword, or trigger phrase. Returns name, description, category. Call this first, then skills_get_skill to load one.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | What you need to do, e.g. 'A/B test sample size', 'level 10 meeting', 'invoice reconciliation' | |
| library | No | Optional library filter (single-library server: ignored). | |
| category | No | Optional exact category filter (see skills_list_categories) | |
| value_chain | No | Optional value-chain filter, e.g. 'infrastructure' |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | No | |
| results | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds meaningful behavioral detail: results are ranked, and the return surface is name/description/category. This is useful context beyond the structured annotations and schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry the core purpose, query semantics, return fields, and the recommended workflow. There is no filler, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with an output schema, rich parameter descriptions, and readOnly/idempotent annotations, the description is complete. It tells the agent what to search on, what will be returned, and how to proceed to the next step. No critical missing context prevents correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high (80%), so the schema already documents parameters well. The description adds value by clarifying what kinds of query terms are expected ('task, keyword, or trigger phrase'), which is a semantic cue not fully captured by the schema's 'What you need to do' phrasing. It does not need to repeat every parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Ranked search'), a clear resource ('the skills skill library'), and the input modalities ('by task, keyword, or trigger phrase'). It also differentiates from siblings by prescribing the follow-up flow to skills_get_skill. The awkward title does not undermine the clarity of the description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly tells the agent when to use this tool first in a workflow ('Call this first, then skills_get_skill to load one'). It provides clear context for using search as an entry point, but it does not explicitly state when to prefer a sibling like skills_list_skills instead, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.2.0- First observed
skills_catalog_status - First observed
skills_get_skill - First observed
skills_list_categories - First observed
skills_list_libraries - First observed
skills_list_skills - First observed
skills_read_skill_file - First observed
skills_search_skills
TDQS
Scored across 7 tools
Each tool has a distinct responsibility: search, list skills, list libraries, list categories, load a skill, read a bundled file, and check catalog status. Search and list are clearly differentiated by ranked querying versus catalog enumeration, and get vs read file are separated by skill-level vs file-level access.
Tools consistently use a skills_ prefix with snake_case and a mostly verb_noun pattern (search_skills, list_skills, get_skill, read_skill_file). The only minor deviation is skills_catalog_status, which is noun-based rather than verb-based, but the overall pattern remains predictable.
Seven tools is well-scoped for a skills library server: discovery, retrieval, browsing metadata, and status management are all covered without unnecessary redundancy. Each tool earns its place in the workflow.
The tool surface covers the full skill-consumption workflow: discover skills via search or listing, navigate libraries and categories, load the full SKILL.md, read referenced files, and verify catalog health. No significant gaps are apparent for the stated purpose of serving skills.
Maintenance
Related MCP Connectors
Search and discover Agent Skills from the skills.sh registry. Powered by HAPI MCP server.
Governed AI agent skills — one library, distributed to devs and exposed to remote agents over MCP.
Search, fetch, lint, and install Agent Skills (SKILL.md) from the SkillMD registry.
A registry of 5,900+ peer-authored skills any MCP agent can search and load on demand.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to discover, install, and manage SKILL.md skills from a Git-backed registry via MCP tools for search, install, and list operations.4 npm1MIT
- AlicenseNot gradedqualityBmaintenanceDiscovers and manages portable agent capabilities (skills and MCP servers) from configurable collections, providing search, inspection, and local installation via CLI and MCP tools.1MIT
- AlicenseNot gradedqualityBmaintenanceEnables managing a canonical library of agent skills and MCP servers, syncing them across multiple development harnesses, and adding, importing, or configuring them through MCP tools.14 npmMIT
- AlicenseNot gradedqualityAmaintenanceEnables MCP-capable agents to search, inspect, lint, and safely install Agent Skills from the skillmd registry mid-conversation.01MIT