@codemcp/skills 1.7.1 → 1.8.0

package/dist/cli.mjs

@@ -549,13 +549,17 @@ async function parseSkillMd(skillMdPath, options) {
 		if (typeof data.name !== "string" || typeof data.description !== "string") return null;
 		if (data.metadata?.internal === true && !shouldInstallInternalSkills() && !options?.includeInternal) return null;
 		const rawMcpDeps = data["requires-mcp-servers"];
+		const rawAllowedTools = data["allowed-tools"];
+		let allowedTools;
+		if (typeof rawAllowedTools === "string") allowedTools = rawAllowedTools.split(/\s+/).filter(Boolean);
 		return {
 			name: data.name,
 			description: data.description,
 			path: dirname(skillMdPath),
 			rawContent: content,
 			metadata: data.metadata,
-			requiresMcpServers: Array.isArray(rawMcpDeps) ? rawMcpDeps : void 0
+			requiresMcpServers: Array.isArray(rawMcpDeps) ? rawMcpDeps : void 0,
+			allowedTools
 		};
 	} catch {
 		return null;
@@ -2352,7 +2356,7 @@ function createEmptyLocalLock() {
 		skills: {}
 	};
 }
-var version$1 = "1.7.1";
+var version$1 = "1.8.0";
 const isCancelled$1 = (value) => typeof value === "symbol";
 /**
 * Check if a source identifier (owner/repo format) represents a private GitHub repo.
@@ -4837,17 +4841,39 @@ async function generateSkillsMcpAgent(agentType, cwd, scope = "local", extraServ
 */
 /**
 * Load all installed skills for the given scope and return the unique set of
-* MCP server dependencies declared across them.
+* MCP server dependencies declared across them, along with per-server allowed
+* tool restrictions derived from skill `allowed-tools` frontmatter.
 */
 async function loadInstalledSkillMcpDeps(cwd, scope) {
 	const isGlobal = scope === "global";
 	const searchDirs = [getCanonicalSkillsDir(isGlobal, cwd), getMCPCanonicalSkillsDir(isGlobal, cwd)];
 	const seen = /* @__PURE__ */ new Map();
+	const serverToolSets = /* @__PURE__ */ new Map();
 	for (const dir of searchDirs) try {
 		const skills = await discoverSkills(dir, void 0, { fullDepth: true });
-		for (const skill of skills) for (const dep of skill.requiresMcpServers ?? []) if (!seen.has(dep.name)) seen.set(dep.name, dep);
+		for (const skill of skills) for (const dep of skill.requiresMcpServers ?? []) {
+			if (!seen.has(dep.name)) seen.set(dep.name, dep);
+			const skillAllowedTools = skill.allowedTools;
+			const serverName = dep.name;
+			if (!skillAllowedTools || skillAllowedTools.length === 0) serverToolSets.set(serverName, "wildcard");
+			else if (serverToolSets.get(serverName) !== "wildcard") {
+				const prefix = `@${serverName}/`;
+				const serverTools = skillAllowedTools.filter((t) => t.startsWith(prefix)).map((t) => t.slice(prefix.length));
+				if (serverTools.length === 0) serverToolSets.set(serverName, "wildcard");
+				else {
+					const existing = serverToolSets.get(serverName);
+					if (existing instanceof Set) for (const t of serverTools) existing.add(t);
+					else serverToolSets.set(serverName, new Set(serverTools));
+				}
+			}
+		}
 	} catch {}
-	return [...seen.values()];
+	const allowedToolsByServer = {};
+	for (const [serverName, toolsOrWildcard] of serverToolSets.entries()) if (toolsOrWildcard instanceof Set) allowedToolsByServer[serverName] = [...toolsOrWildcard];
+	return {
+		deps: [...seen.values()],
+		allowedToolsByServer
+	};
 }
 /** Replace `{{PARAM_NAME}}` placeholders with resolved values. */
 function substituteParam(value, params) {
@@ -4896,13 +4922,17 @@ async function resolveParameters(dep) {
 * In all cases the diff rule is: only check presence of the server key —
 * never modify an existing server's configuration.
 *
-* @param deps        MCP server dependencies collected from installed skills.
-* @param agentTypes  Agents that were just configured by `mcp setup`.
-* @param configCwd   Base directory for agent config files.
-* @param scope       'local' or 'global'.
-* @param configMode  Whether generator-backed agents use agent-config or mcp-json.
+* @param deps                 MCP server dependencies collected from installed skills.
+* @param agentTypes           Agents that were just configured by `mcp setup`.
+* @param configCwd            Base directory for agent config files.
+* @param scope                'local' or 'global'.
+* @param configMode           Whether generator-backed agents use agent-config or mcp-json.
+* @param allowedToolsByServer Per-server tool restrictions derived from skill allowedTools.
+*                             When provided and a server has an entry, only those specific
+*                             tools are whitelisted in the generated agent config instead of
+*                             the default wildcard.
 */
-async function configureSkillMcpDepsForAgents(deps, agentTypes, configCwd, scope, configMode = "agent-config") {
+async function configureSkillMcpDepsForAgents(deps, agentTypes, configCwd, scope, configMode = "agent-config", allowedToolsByServer = {}) {
 	if (deps.length === 0 || agentTypes.length === 0) return;
 	const resolvedConfigs = /* @__PURE__ */ new Map();
 	for (const dep of deps) {
@@ -4915,11 +4945,13 @@ async function configureSkillMcpDepsForAgents(deps, agentTypes, configCwd, scope
 		const missingServers = {};
 		for (const dep of deps) {
 			const resolved = resolvedConfigs.get(dep.name);
+			const restrictedTools = allowedToolsByServer[dep.name];
 			missingServers[dep.name] = {
 				command: resolved.command,
 				args: resolved.args,
 				env: resolved.env,
-				...resolved.cwd ? { cwd: resolved.cwd } : {}
+				...resolved.cwd ? { cwd: resolved.cwd } : {},
+				...restrictedTools ? { tools: restrictedTools } : {}
 			};
 		}
 		try {
@@ -5106,7 +5138,10 @@ async function setupTuiMode(cwd, scope = "local", forcedConfigMode) {
 	console.log("");
 	const configuredAgents = [];
 	for (const agentType of selectedAgents) if (await configureOneAgent(agentType, configCwd, scope, configMode) !== null) configuredAgents.push(agentType);
-	if (configuredAgents.length > 0) await configureSkillMcpDepsForAgents(await loadInstalledSkillMcpDeps(cwd, scope), configuredAgents, configCwd, scope, configMode);
+	if (configuredAgents.length > 0) {
+		const { deps: skillDeps, allowedToolsByServer } = await loadInstalledSkillMcpDeps(cwd, scope);
+		await configureSkillMcpDepsForAgents(skillDeps, configuredAgents, configCwd, scope, configMode, allowedToolsByServer);
+	}
 	const scopeLabel = scope === "global" ? "global (home directory)" : "local (project directory)";
 	const failCount = selectedAgents.length - configuredAgents.length;
 	console.log("");
@@ -5124,17 +5159,17 @@ async function setupCliMode(agentTypes, cwd, scope = "local", forcedConfigMode)
 	const configuredAgents = [];
 	for (const agentType of agentTypes) if (await configureOneAgent(agentType, cwd, scope, forcedConfigMode ?? (isGeneratorBacked(agentType) ? "agent-config" : "mcp-json")) !== null) configuredAgents.push(agentType);
 	if (configuredAgents.length > 0) {
-		const skillDeps = await loadInstalledSkillMcpDeps(cwd, scope);
+		const { deps: skillDeps, allowedToolsByServer } = await loadInstalledSkillMcpDeps(cwd, scope);
 		if (forcedConfigMode) {
 			const generatorBacked = configuredAgents.filter((a) => isGeneratorBacked(a));
 			const rawMcp = configuredAgents.filter((a) => !isGeneratorBacked(a));
-			if (generatorBacked.length > 0) await configureSkillMcpDepsForAgents(skillDeps, generatorBacked, cwd, scope, forcedConfigMode);
-			if (rawMcp.length > 0) await configureSkillMcpDepsForAgents(skillDeps, rawMcp, cwd, scope, "mcp-json");
+			if (generatorBacked.length > 0) await configureSkillMcpDepsForAgents(skillDeps, generatorBacked, cwd, scope, forcedConfigMode, allowedToolsByServer);
+			if (rawMcp.length > 0) await configureSkillMcpDepsForAgents(skillDeps, rawMcp, cwd, scope, "mcp-json", allowedToolsByServer);
 		} else {
 			const generatorBacked = configuredAgents.filter((a) => isGeneratorBacked(a));
 			const rawMcp = configuredAgents.filter((a) => !isGeneratorBacked(a));
-			if (generatorBacked.length > 0) await configureSkillMcpDepsForAgents(skillDeps, generatorBacked, cwd, scope, "agent-config");
-			if (rawMcp.length > 0) await configureSkillMcpDepsForAgents(skillDeps, rawMcp, cwd, scope, "mcp-json");
+			if (generatorBacked.length > 0) await configureSkillMcpDepsForAgents(skillDeps, generatorBacked, cwd, scope, "agent-config", allowedToolsByServer);
+			if (rawMcp.length > 0) await configureSkillMcpDepsForAgents(skillDeps, rawMcp, cwd, scope, "mcp-json", allowedToolsByServer);
 		}
 	}
 	const failCount = agentTypes.length - configuredAgents.length;