Skillsmith

Skillsmith

Shared skills, safe for production.

Once more than one team is publishing agent skills, the problem stops being finding them and starts being managing them. Which team is this scoped to? Which version is installed where? Has it been flagged by a security scan? What happens to the ones nobody maintains anymore?

Skillsmith is a registry for sharing, scanning, and tracking agent skills across teams. Skills are published to a registry scoped to your team and versioned immutably, so drift across installs is visible instead of silent. Flagged or suspicious skills are quarantined pending security review. Skills that go stale can be deprecated instead of quietly rotting in someone's repo.

Installation

Quick Setup (MCP)

Skillsmith is MCP-compatible — pick the snippet for your agent. SMI-4580: snippets sourced from packages/cli/src/templates/mcp-server.template.snippets.ts so this README and the website docs cannot drift.

Claude Code — ~/.claude/settings.json

{

"mcpServers": { "@skillsmith/mcp-server": { "command": "npx", "args": ["-y", "@skillsmith/mcp-server"], "env": { "SKILLSMITH_API_KEY": "sk_live_..." } } } }

Restart Claude Code after editing settings.json.

Cursor — ~/.cursor/mcp.json

{

"mcpServers": { "@skillsmith/mcp-server": { "command": " ", "env": { "SKILLSMITH_API_KEY": "sk_live_...", "SKILLSMITH_CLIENT": "cursor" } } } }

Cursor 2.4+ required, Node >=22.22 (Cursor's own bundled Node meets this). SKILLSMITH_CLIENT routes installs to ~/.cursor/skills instead of the default ~/.claude/skills.

Setup: run npm install -g @skillsmith/mcp-server, then run which skillsmith-mcp (macOS/Linux) or where skillsmith-mcp (Windows) and paste that path into command above — Cursor's bundled Node cannot resolve packages via npx (a real ENOENT on a missing Resources/app/resources/lib directory), so pointing directly at the installed binary is the only form confirmed to work inside Cursor. Prefer to try npx first anyway? Replace command with "npx" and add "args": ["-y", "@skillsmith/mcp-server"] — simpler, but may hit the same ENOENT, plus EBADENGINE or ENOTEMPTY on repeated installs. After saving: enable the server in Cursor's Settings → MCP panel and start a new chat — a correctly-configured entry still shows disconnected until toggled on there — then reload the window.

GitHub Copilot (VS Code) — .vscode/mcp.json (workspace)

{

"mcpServers": { "@skillsmith/mcp-server": { "command": "npx", "args": ["-y", "@skillsmith/mcp-server"], "env": { "SKILLSMITH_API_KEY": "sk_live_..." } } } }

VS Code 1.108+ required. Workspace-scoped (commit to repo if team-shared, or use user settings.json instead).

Windsurf — ~/.codeium/windsurf/mcp_config.json

{

"mcpServers": { "@skillsmith/mcp-server": { "command": "npx", "args": ["-y", "@skillsmith/mcp-server"], "env": { "SKILLSMITH_API_KEY": "${env:SKILLSMITH_API_KEY}" } } } }

Supports ${env:VAR} interpolation; export SKILLSMITH_API_KEY in your shell instead of inlining the secret.

Codex CLI — ~/.codex/config.toml (TOML, not JSON)

[mcp_servers.@skillsmith/mcp-server]

command = "npx" args = ["-y", "@skillsmith/mcp-server"]

[mcp_servers.@skillsmith/mcp-server.env] SKILLSMITH_API_KEY = "sk_live_..."

Codex reads ~/.agents/skills. When installing via CLI, pass --client agents.

Cross-agent (open standard) — ~/.agents/mcp.json

{

"mcpServers": { "@skillsmith/mcp-server": { "command": "npx", "args": ["-y", "@skillsmith/mcp-server"], "env": { "SKILLSMITH_API_KEY": "sk_live_..." } } } }

Read by any agent honouring the cross-agent skill convention.

After adding to your MCP client settings and restarting, you can search for skills immediately.

API Key Configuration (Optional)

For higher rate limits and usage tracking, authenticate with your API key.

Easiest — CLI login (interactive):

npm install -g @skillsmith/cli

skillsmith login

This opens skillsmith.app/account/cli-token in your browser. Generate a key, copy it, and paste it when prompted. The key is stored securely in your OS keyring.

MCP server config — add the key to your settings:

The per-client snippets above already include the env.SKILLSMITH_API_KEY slot — replace the sk_live_... placeholder with the value from skillsmith login.

Get your API key at skillsmith.app/account/cli-token.

Quota note: the monthly figure is a hard limit only where enforced. Edge functions hard-block on monthly quota for Community only, and only when ENFORCE_COMMUNITY_QUOTA is 'true'. The MCP server's own monthly quota counts only skill_suggest and the tier-gated tools, and hard-blocks them by default (SKILLSMITH_ENFORCE_MCP_QUOTA=false turns that off).

The MCP server falls back to a built-in public key when none is set, so keyless MCP use is Community-rate and shares one 30/min bucket per edge endpoint (search, get, recommend, …) with every other keyless client. The 10-call trial (100/min per IP) applies to direct HTTP requests that do not successfully authenticate, including ones with a malformed or expired credential; normal keyless MCP requests authenticate with the built-in key and never reach it. When enabled, a per-IP daily budget can also apply to that shared key (ENFORCE_ANON_BUDGET; off by default).

Note: Never paste API keys in chat. Configure via settings.json only.

CLI Installation (Development)

The CLI is available for local development:

# From the repository root

npm run build node packages/cli/dist/index.js search "testing"

The four questions

Once more than one team is publishing skills, these are the questions that matter:

1. Which team is this scoped to? Every skill in the registry is scoped to a team.
2. Which version is installed here? Versions are immutable; skill_diff (Individual tier) and skill_outdated report drift for what's installed on the machine you run them from.
3. Has it been flagged by the security scan? Skills pulled from the public index are scored automatically; flagged or suspicious ones are quarantined pending review — unflagged means it wasn't flagged, not that it was formally approved. Each skill carries one of eight trust tiers, from Official to Unverified (Security Guide).
4. What happens to the ones nobody maintains? Stale skills can be deprecated instead of quietly rotting in someone's repo.

How it works

• Publish — skills are published to a registry scoped to your team, versioned immutably.
• Version — every publish creates a new immutable version; nothing is overwritten in place.
• Drift detection — skill_diff (Individual tier) and skill_outdated show what's installed and where it has fallen behind, at the point you check.
• Deprecate — skills that go stale can be deprecated instead of quietly rotting in someone's repo.

Scopes and permissions

Skills are scoped to your team's registry. Team owners and admins control who can publish and manage skills; members install and search.

Start solo

Search, install, and manage skills for yourself, free. When your team needs the same skill, the registry is already there.

MCP Tools

Skillsmith registers 43 tools. 19 of the 43 work on the free Community tier. Higher tiers add version tracking, team features and enterprise controls. Tools above your tier return an upgrade message. Pricing.

Community (free)

Individual

Team

Enterprise

| rbac_create_policy | Bulk-set or clear permission overrides for