Skillsmith Documentation

Agent builders need the same vetted skills, not one-off files nobody's reviewed. Skillsmith shares them across your team, scans them for risk before they ship, and shows you which ones are actually being used.

What is Skillsmith?

Skillsmith provides a comprehensive toolset for managing agent skills. Whether you're looking for testing utilities, git workflow helpers, or specialized development tools, Skillsmith makes it easy to discover and install the skills you need.

Key Features

Skill Discovery - Search and browse thousands of community skills
Smart Recommendations - Get personalized skill suggestions based on your project
Trust Verification - Know which skills are official, verified, curated, community, or unverified
Easy Installation - Install skills with a single command
Skill Comparison - Compare similar skills side-by-side

Quick Start

Get started with Skillsmith in minutes:

1. Configure the MCP Server

Pick the snippet for your MCP client and add it to the matching config file. Every snippet uses the same shape; only the config-file path (and, for Codex/Hermes, the format) differs.

Claude Code — ~/.claude/settings.json

{
  "mcpServers": {
    "@skillsmith/mcp-server": {
      "command": "npx",
      "args": ["-y", "@skillsmith/mcp-server"]
    }
  }
}

Cursor — ~/.cursor/mcp.json

{
  "mcpServers": {
    "@skillsmith/mcp-server": {
      "command": "<paste output of: which skillsmith-mcp (macOS/Linux) or where skillsmith-mcp (Windows)>",
      "env": {
        "SKILLSMITH_CLIENT": "cursor"
      }
    }
  }
}

Cursor 2.4+ required, Node >=22.22 (Cursor's own bundled Node meets this). Setup: run npm install -g @skillsmith/mcp-server, then run which skillsmith-mcp (macOS/Linux) or where skillsmith-mcp (Windows) and paste that path into command above — Cursor's bundled Node cannot resolve packages via npx (a real ENOENT on a missing Resources/app/resources/lib directory), so pointing directly at the installed binary is the only form confirmed to work inside Cursor. SKILLSMITH_CLIENT routes installs to ~/.cursor/skills instead of the default ~/.claude/skills. Prefer to try npx first anyway? Replace command with "npx" and add "args": ["-y", "@skillsmith/mcp-server"] — simpler, but may hit the same ENOENT, plus EBADENGINE or ENOTEMPTY on repeated installs. After saving: enable the server in Cursor's Settings → MCP panel and start a new chat — a correctly-configured entry still shows disconnected until toggled on there — then reload the window.

GitHub Copilot (VS Code) — .vscode/mcp.json (workspace)

{
  "mcpServers": {
    "@skillsmith/mcp-server": {
      "command": "npx",
      "args": ["-y", "@skillsmith/mcp-server"]
    }
  }
}

VS Code 1.108+ required. Workspace-scoped (commit to repo if team-shared, or use user settings.json instead).

Windsurf — ~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "@skillsmith/mcp-server": {
      "command": "npx",
      "args": ["-y", "@skillsmith/mcp-server"]
    }
  }
}

Supports ${env:VAR} interpolation for secrets in this config.

Codex CLI — ~/.codex/config.toml (TOML)

[mcp_servers.@skillsmith/mcp-server]
command = "npx"
args = ["-y", "@skillsmith/mcp-server"]

Codex reads ~/.agents/skills. When installing via Skillsmith CLI, pass --client agents.

Cross-agent (open standard) — ~/.agents/mcp.json

{
  "mcpServers": {
    "@skillsmith/mcp-server": {
      "command": "npx",
      "args": ["-y", "@skillsmith/mcp-server"]
    }
  }
}

OpenCode — ~/.config/opencode/opencode.json

{
  "mcp": {
    "@skillsmith/mcp-server": {
      "type": "local",
      "command": ["npx", "-y", "@skillsmith/mcp-server"],
      "enabled": true
    }
  }
}

OpenCode also reads .claude/skills and .agents/skills for skill discovery. Note the OpenCode-specific entry shape: command is an array and the env-var field is named environment, not env.

Hermes (Nous Research) — ~/.hermes/config.yaml (YAML)

mcp_servers:
  @skillsmith/mcp-server:
    command: "npx"
    args: ["-y", "@skillsmith/mcp-server"]

Hermes config is YAML. Hermes has no SessionStart hook equivalent — nudge/attribution is unsupported on this harness.

Grok Build (xAI) — ~/.grok/config.toml (TOML)

[mcp_servers.@skillsmith/mcp-server]
command = "npx"
args = ["-y", "@skillsmith/mcp-server"]

Grok Build uses TOML under a [mcp_servers.NAME] table, the same convention as Codex CLI above.

Google Antigravity — ~/.gemini/config/mcp_config.json

{
  "mcpServers": {
    "@skillsmith/mcp-server": {
      "command": "npx",
      "args": ["-y", "@skillsmith/mcp-server"],
      "env": {
        "SKILLSMITH_CLIENT": "antigravity"
      }
    }
  }
}

One config file is shared across the Antigravity CLI, IDE, and 2.0. A workspace-scoped alternative also exists at .agents/mcp_config.json (project root) if you prefer not to register the server globally. SKILLSMITH_CLIENT routes installs to ~/.gemini/config/skills instead of the default ~/.claude/skills.

2. Configure Your API Key (Optional)

For usage tracking and higher rate limits, add your API key. Create ~/.skillsmith/config.json:

mkdir -p ~/.skillsmith && cat > ~/.skillsmith/config.json << 'EOF'
{
  "apiKey": "sk_live_your_key_here"
}
EOF

Get your API key from your Account Dashboard after signing up.

3. Start Using Skillsmith

Once configured, ask your assistant to find and install skills:

"Search for testing skills"
"Find verified skills for git workflows"
"Install the commit skill"
"Recommend skills for my React project"

Documentation Sections

Getting Started

Step-by-step guide to set up Skillsmith in your environment.

CLI Reference

Complete command reference for the Skillsmith CLI.

MCP Server

Learn how to configure and use the MCP server.

API Reference

Detailed API documentation for developers and integrators.

Security

Learn how Skillsmith protects your development environment.

Trust Tiers

Understand the four-tier trust system for evaluating skills.

Quarantine

What happens when skills are flagged for security issues.

Dependencies

Three-signal dependency intelligence: declared, inferred, and advisory.

Cross-machine skill inventory

See which agent skills are installed across your machines and harnesses — opt-in, read-only.

Private Registry

A real, hosted, team-shared skill registry — versioned and access-controlled.

Private Skills

Keep a skill out of public search on your own machine.

Governance, End to End

Deprecation, audit trails, compliance reporting, and automatic quarantine.

Roles, Permissions & SSO

Owner/Admin/Member roles, per-permission overrides, and self-service SSO setup.

CLI or MCP?

Skillsmith offers two interfaces: a CLI for shell workflows, CI/CD pipelines, and skill authoring, and an MCP server for interactive use inside Claude Code with richer context and recommendations. Use whichever fits your workflow — they share the same registry and installed skills.

Task	CLI	MCP
Search for skills	`skillsmith search "testing"`	`search` tool
Install a skill	`skillsmith install author/name`	`install_skill` tool
Remove a skill	`skillsmith remove name`	`uninstall_skill` tool
Get skill details	`skillsmith info author/name`	`get_skill` tool
Compare skills	—	`skill_compare` tool
Audit a skill (security advisories)	`skillsmith audit advisories name`	`skill_audit` tool
Audit skill inventory for local namespace collisions	`skillsmith audit collisions`	`skill_inventory_audit` tool
Create a skill	`skillsmith create name`	—
Validate a skill	`skillsmith author validate .`	`skill_validate` tool

Trust Tiers

Skillsmith categorizes skills by trust level to help you make informed decisions:

Tier	Description
`official`	Official or partner skills with full security review
`verified`	Publisher verified, quality checked
`curated`	GitHub-verified vendor org or manually curated
`community`	Basic scan passed, metadata present
`unverified`	No verification performed, review before installing

Need Help?

If you run into issues or have questions, check out our GitHub Issues or join the community discussion.