Skillsmith MCP
A skill registry for teams with security scanning and versioning; the MCP server finds and installs skills on request.
- 78 ★ on the repository
- Last commit
Extended access
Why this level
- The agent installs skills to disk and they change agent behavior; check the trust tier before installing.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/skillsmithDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent installs skills to disk and they change agent behavior; check the trust tier before installing.
This is third-party code. Review the repository files before installing.
What it does
Skillsmith is a registry for sharing agent skills across teams, scanning them and tracking versions. Skills are published to a team-scoped registry and versioned immutably, so drift between installs is visible. The `@skillsmith/mcp-server` package connects to Claude Code, Cursor, Codex and other clients. The agent calls `search` with filters for category, trust tier and score, `get_skill` for details and the install command, and `install_skill` and `uninstall_skill` to add or remove skills. Skills land in `~/.claude/skills`, and Cursor or Codex are selected with `SKILLSMITH_CLIENT` or a CLI flag. An API key from the account page raises rate limits and `skillsmith login` issues it.
Who it is for. Teams publishing skills for several people who want to know which version is installed where and what was scanned.
Good fit when
- An agent finds a skill for a task and installs it into the client directory.
- Team skills are published to a private registry with pinned versions.
- Before installing you look at the trust tier and the security scan score.
- One skill set is laid out for Claude Code, Cursor and Codex.
Not a fit when
- You only want a browsing catalog with no installs or API.
- Organization policy forbids access to an external registry.
- Cursor has no suitable Node.js, and 22.22 or newer is required.
Example request
Find a pull request review skill with a high security score, show its details and install it after my confirmation.MCP
- Transport
- stdio
- Authentication
- key is optional
Environment variables
SKILLSMITH_API_KEYsecret- Skillsmith API key for higher rate limits
SKILLSMITH_CLIENT- Install target client, such as `cursor` or `agents`
Limitations
Node.js is required, and Cursor needs version 22.22 or newer. The API key is optional but raises limits; keep it in the `SKILLSMITH_API_KEY` environment variable rather than a settings file. Tier limits are listed in the README and the free tier is capped. The license is marked NOASSERTION, so confirm terms before commercial use. For Cursor you paste the `skillsmith-mcp` path into the config manually after `npm install -g @skillsmith/mcp-server`.
How to disable. Remove the `@skillsmith/mcp-server` entry from the client config and delete installed skills with `uninstall_skill` or by hand from `~/.claude/skills`. Revoke the API key in your account.
FAQ
How do I connect Skillsmith to Claude Code?
Add an `mcpServers` entry to `~/.claude/settings.json` with command `npx` and args `-y @skillsmith/mcp-server`, then restart Claude Code. The API key is optional.
Which tools does the server have?
`search` finds skills with filters, `get_skill` returns details and the install command, `install_skill` and `uninstall_skill` add and remove skills and `skill_compare` compares options.
Where are skills installed?
By default in `~/.claude/skills`. For Cursor, `SKILLSMITH_CLIENT=cursor` routes installs to `~/.cursor/skills`, and Codex uses `~/.agents/skills`.
How do I get an API key?
Run `npm install -g @skillsmith/cli` and then `skillsmith login`: the skillsmith.app page opens where a key is created. It is stored in the OS keyring.
How does a registry differ from a skill list?
Skills are published to a team-scoped registry, versioned immutably and security-scanned, so drift between installs is visible.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server that opens SKILL.md skills to clients without native support, such as Codex, Copilot and Cursor
A CLI and MCP server for Agent Skills: spec validation, installs from GitHub and on-demand loading of the right skill
Claude Skills MCP: semantic search for skills
Claude Skills MCP
An MCP server with vector search: the agent describes a task and gets matching skills from the Anthropic and K-Dense collections
Skill search from inside the conversation: the agent finds a SKILL.md, reads it and applies it with no prior install
The skillx CLI searches a skills catalog, vets skills before install, pins versions in a lock file and serves an MCP installer.
Meta Skill (ms)
Meta Skill
Meta Skill (ms) keeps skills locally in SQLite and Git, searches them with a hybrid index and serves agents over MCP
README in short
The README explains why teams need a skill registry and gives ready connection snippets for different clients. Then come API key setup, a tier table and the server tool list.