@pascalcouturier/skill-builder-mcp 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +19 -0
  2. package/LICENSE +21 -0
  3. package/README.md +387 -0
  4. package/SECURITY.md +107 -0
  5. package/dist/THIRD_PARTY_LICENSES.md +105 -0
  6. package/dist/cli.js +14661 -0
  7. package/package.json +47 -0
package/CHANGELOG.md ADDED
@@ -0,0 +1,19 @@
1
+ # Changelog
2
+
3
+ Every release of `@pascalcouturier/skill-builder-mcp`. Versions follow
4
+ [semantic versioning](https://semver.org); the major version matches the protocol Skill
5
+ Builder speaks, so any `1.x` connector works with the current site.
6
+
7
+ To update, change the version in your AI tool's settings and restart its MCP server (see
8
+ **Updating** in the [README](./README.md#updating)).
9
+
10
+ ## 1.0.0
11
+
12
+ First release.
13
+
14
+ - Connects GitHub Copilot (VS Code), Claude Code, OpenAI Codex, Cursor, Claude Desktop and
15
+ other MCP clients to Skill Builder open in the browser or the installed app.
16
+ - 57 tools: read, build and edit sessions, skills, agents, blocks and files; run the checks;
17
+ save, compare and restore versions; export; manage the library; undo AI changes.
18
+ - Pairing with a code only the AI tool shows, checked in both directions; signed, numbered
19
+ messages; origin and `Host` checks; listens on 127.0.0.1 only.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Pascal Couturier
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,387 @@
1
+ # @pascalcouturier/skill-builder-mcp
2
+
3
+ **The Connect AI connector for [Skill Builder](https://skill-builder.pascalcouturier.com).**
4
+ It lets AI tools on your computer (**GitHub Copilot** in VS Code, **Claude Code**, **OpenAI
5
+ Codex**, **Cursor**, **Claude Desktop** and other MCP clients) work in the Skill Builder you
6
+ have open in your browser, over the [Model Context Protocol](https://modelcontextprotocol.io).
7
+
8
+ Skill Builder is a web app for building AI agent skills (`SKILL.md` with reference files) and
9
+ agent definitions with drag and drop. With this connector you can build them from the chat
10
+ instead: _"Create a session called Backend with a skill for our API conventions, based on
11
+ #file:docs/api.md"_. The AI creates sessions, adds skills, agents and blocks, runs the
12
+ checks, fixes issues and saves versions, and you watch the changes appear in Skill Builder.
13
+
14
+ > **This package only works with Skill Builder.** It accepts connections only from
15
+ > `https://skill-builder.pascalcouturier.com` and speaks Skill Builder's own protocol. It is
16
+ > not a general-purpose MCP server and does nothing on its own.
17
+
18
+ - [How it works](#how-it-works)
19
+ - [What you need](#what-you-need)
20
+ - [Setup](#setup)
21
+ - [Pairing](#pairing)
22
+ - [What you can ask](#what-you-can-ask)
23
+ - [What the AI can do](#what-the-ai-can-do)
24
+ - [What you see in Skill Builder](#what-you-see-in-skill-builder)
25
+ - [Privacy](#privacy)
26
+ - [Security](#security)
27
+ - [Troubleshooting](#troubleshooting)
28
+ - [Updating](#updating)
29
+ - [Removing it](#removing-it)
30
+ - [Options](#options)
31
+ - [Limits](#limits)
32
+ - [Licence](#licence)
33
+
34
+ ## How it works
35
+
36
+ A website can not accept connections, so this small program sits in between. **Your AI tool
37
+ starts it for you**; you never run it by hand.
38
+
39
+ ```
40
+ VS Code / Claude Code / Codex / Cursor / Claude Desktop
41
+ │ MCP over stdio (the AI tool starts the connector with npx)
42
+ ▼
43
+ This connector (on your computer, 127.0.0.1 only)
44
+ ▲ WebSocket on 127.0.0.1:47320-47329, paired and signed
45
+ │
46
+ Skill Builder in your browser or the installed app
47
+ ```
48
+
49
+ - The connector only passes messages between the two. It has no access to your files and
50
+ does not know what the tools do.
51
+ - Skill Builder runs every tool call with the same code as its buttons, so its checks,
52
+ security scanner and auto-save work exactly as when you edit yourself.
53
+ - Your work stays in your browser (IndexedDB). There is no account, no server and no cloud.
54
+
55
+ ## What you need
56
+
57
+ - **A computer** (Mac, Windows or Linux). Connect AI is not available on phones or tablets.
58
+ - **Skill Builder** open at <https://skill-builder.pascalcouturier.com>, or installed as an
59
+ app, in **Chrome, Edge, Firefox** or another Chromium browser. Safari is not supported.
60
+ - **Node.js 20 or later** on the same computer. Check with `node --version`; install the LTS
61
+ version from <https://nodejs.org> if needed.
62
+ - An AI tool that supports MCP servers.
63
+
64
+ ## Setup
65
+
66
+ ### 1. Add the connector to your AI tool
67
+
68
+ Once per AI tool. Each tool keeps its own list of MCP servers, so if you use Copilot, Claude
69
+ Code and Codex inside VS Code, add it to each. In Skill Builder, **Settings → Connect AI**
70
+ shows the same steps with copy buttons and one-click install links for VS Code and Cursor.
71
+
72
+ Every tool runs the same command, with an exact version:
73
+
74
+ ```bash
75
+ npx -y @pascalcouturier/skill-builder-mcp@1.0.0
76
+ ```
77
+
78
+ **VS Code (GitHub Copilot).** Command Palette → **MCP: Add Server…** → **Command (stdio)** →
79
+ enter the command above, name it `skill-builder` and choose **Global**. Or run **MCP: Open
80
+ User Configuration** and add:
81
+
82
+ ```json
83
+ {
84
+ "servers": {
85
+ "skill-builder": {
86
+ "type": "stdio",
87
+ "command": "npx",
88
+ "args": ["-y", "@pascalcouturier/skill-builder-mcp@1.0.0"]
89
+ }
90
+ }
91
+ }
92
+ ```
93
+
94
+ Then switch Copilot Chat to **Agent** mode and tick the **skill-builder** tools under
95
+ **Configure Tools**.
96
+
97
+ **Claude Code** (CLI and the VS Code extension), once in a terminal:
98
+
99
+ ```bash
100
+ claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-builder-mcp@1.0.0
101
+ ```
102
+
103
+ **OpenAI Codex** (CLI and the VS Code extension), in `~/.codex/config.toml`
104
+ (`%USERPROFILE%\.codex\config.toml` on Windows), then restart Codex:
105
+
106
+ ```toml
107
+ [mcp_servers.skill-builder]
108
+ command = "npx"
109
+ args = ["-y", "@pascalcouturier/skill-builder-mcp@1.0.0"]
110
+ ```
111
+
112
+ **Cursor** (`~/.cursor/mcp.json`), **Claude Desktop** (**Settings → Developer → Edit
113
+ Config**, then restart it) and most other clients (Windsurf, Cline, Zed…):
114
+
115
+ ```json
116
+ {
117
+ "mcpServers": {
118
+ "skill-builder": {
119
+ "command": "npx",
120
+ "args": ["-y", "@pascalcouturier/skill-builder-mcp@1.0.0"]
121
+ }
122
+ }
123
+ }
124
+ ```
125
+
126
+ On **Windows**, if the tool can not start `npx`, use `"command": "cmd"` and
127
+ `"args": ["/c", "npx", "-y", "@pascalcouturier/skill-builder-mcp@1.0.0"]`.
128
+
129
+ ### 2. Turn on Connect AI in Skill Builder
130
+
131
+ Open Skill Builder, go to **Settings → Connect AI** and switch on **Connect AI tools**. It is off
132
+ by default. If the browser asks to let the site access apps and services on this device
133
+ (local network access), click **Allow**.
134
+
135
+ ### 3. Pair
136
+
137
+ See [Pairing](#pairing) below. Then chat.
138
+
139
+ ## Pairing
140
+
141
+ Each time the connector starts, you approve it once:
142
+
143
+ 1. In your AI tool's chat, ask _"What is open in Skill Builder?"_.
144
+ 2. The AI tool replies with a pairing code like `K7Q2-M9XD-4RTA` (it is also in the tool's
145
+ MCP log). If it does not, ask _"What is the Skill Builder pairing code?"_.
146
+ 3. Skill Builder shows **Connect _your tool_?**. Type the code and click **Connect**. Case,
147
+ spaces and dashes do not matter. If you did not start this, click **Deny**.
148
+
149
+ The code is made by the connector and shown only in your AI tool; it never travels over the
150
+ connection. Both sides prove they know it, so no other program on your computer can pose as
151
+ Skill Builder or as the connector. Three wrong codes close the connection; ten in one run
152
+ turn pairing off until you restart the AI tool. You pair again after restarting the AI tool
153
+ or reloading Skill Builder; the code is new every time and you never need to keep it.
154
+
155
+ ## What you can ask
156
+
157
+ - _"List my sessions."_
158
+ - _"Create a session called Frontend with a skill for our component conventions. Use
159
+ #file:src/components/Button.vue and #file:docs/styleguide.md as the source."_
160
+ - _"Add an agent called code-reviewer that uses the frontend-conventions skill."_
161
+ - _"Turn the error handling in #file:src/api/client.ts into a Rules block in the api-design
162
+ skill."_
163
+ - _"Run the checks and fix what you can."_
164
+ - _"Save a version with the message 'First draft'."_
165
+ - _"Import the skills from https://github.com/anthropics/skills/tree/main/skills/pdf into my
166
+ library."_
167
+ - _"Undo your last changes."_
168
+
169
+ ## What the AI can do
170
+
171
+ The AI can do what you can do in the app, except anything to do with the cloud (sign-in,
172
+ sync, the AI check, the community library). Tools marked **asks** wait for your confirmation
173
+ in Skill Builder.
174
+
175
+ | Tool | What it does | Asks |
176
+ | ------------------------- | ----------------------------------------------------------------------- | ------------- |
177
+ | `get_status` | What is open: session, skill or agent, file, unsaved changes | |
178
+ | `list_sessions` | Search, filter, sort and page sessions | |
179
+ | `get_session` | A session's skills and agents, files and links | |
180
+ | `get_document` | A skill or agent with every block (uids, types, values) | |
181
+ | `read_file` | The markdown a file produces, or a script's text | |
182
+ | `list_block_types` | Block types and their fields | |
183
+ | `list_templates` | Templates for new skills and agents | |
184
+ | `list_library` | Built-in skills and your library items | |
185
+ | `get_library_item` | One library item with its files, scan result and versions | |
186
+ | `validate` | The checks (errors, warnings, info), with one-click fixes | |
187
+ | `preview_export` | The files the zip would contain (ready for a project, or plain folders) | |
188
+ | `list_versions` | Saved versions | |
189
+ | `diff_versions` | Line changes between versions or against the working copy | |
190
+ | `get_canvas` | The canvas graph | |
191
+ | `create_session` | New session | |
192
+ | `open_session` | Show a session, skill or agent, or file in the app | |
193
+ | `update_session` | Rename, change author or description | |
194
+ | `duplicate_session` | Copy a session | |
195
+ | `set_favourite` | Star or unstar | |
196
+ | `delete_session` | Delete a session and its versions | asks |
197
+ | `add_document` | Add a skill or agent, optionally from a template | |
198
+ | `update_document` | Set name, description, licence, allowed tools, model… | |
199
+ | `duplicate_document` | Copy a skill or agent | |
200
+ | `remove_document` | Delete a skill or agent | asks |
201
+ | `add_block` | Add a block with values at a position | |
202
+ | `update_block` | Change block values, collapse or expand | |
203
+ | `move_block` | Up, down, or to another file | |
204
+ | `duplicate_block` | Copy a block | |
205
+ | `remove_block` | Remove a block | |
206
+ | `convert_block` | Turn a block into Custom markdown | |
207
+ | `break_down_block` | Split Custom markdown into built-in blocks | |
208
+ | `extract_block_to_file` | Move a long block into a new reference file | |
209
+ | `add_file` | Add a reference, script or asset | |
210
+ | `write_code_file` | Write a script or data file (scanned, never run) | |
211
+ | `add_files` | Add several supporting files by path (scanned like uploads) | |
212
+ | `rename_file` | Rename a reference | |
213
+ | `remove_file` | Delete a file | asks |
214
+ | `connect` | Link an agent to a skill, or point a reference or Resource link block | |
215
+ | `disconnect` | Remove such a link | |
216
+ | `add_from_library` | Add a library skill or agent to the session | |
217
+ | `apply_fix` | Apply a fix from `validate` | |
218
+ | `save_version` | Save a version (bump suggested from the changes) | |
219
+ | `restore_version` | Replace the working copy with a version | asks |
220
+ | `download_export` | Download the zip in the browser, for the AI tools you choose | |
221
+ | `download_backup` | Download a backup in the browser | |
222
+ | `tidy_canvas` | Tidy the canvas layout | |
223
+ | `undo_ai_changes` | Same as **Undo AI changes** | if you edited |
224
+ | `save_block_type` | Create or edit a custom block type | |
225
+ | `delete_block_type` | Delete a custom block type | asks |
226
+ | `add_library_item` | Add your own skill or agent to the library from markdown | if warnings |
227
+ | `update_library_item` | Edit a library item (saved as a new version) | |
228
+ | `restore_library_version` | Bring back an older version of a library item | |
229
+ | `copy_builtin_to_library` | Make an editable copy of a built-in skill | |
230
+ | `set_library_hidden` | Hide or show a built-in skill | |
231
+ | `remove_library_item` | Delete a library item | asks |
232
+ | `import_from_github` | List and import skills and agents from a public GitHub repo | if warnings |
233
+ | `set_preferences` | Default author, Blocks or Canvas view, block matching on import | |
234
+
235
+ Edits carry the session's revision. If you changed the session since the AI last read it,
236
+ the edit is refused and the AI reads it again, so it never overwrites your work by accident.
237
+
238
+ ### How the AI knows what to change
239
+
240
+ - **Skill Builder or your project?** Every Skill Builder tool says "In Skill Builder" in its
241
+ description, and the connector tells the AI to use them only when you mean Skill Builder.
242
+ Saying "Skill Builder", "session", "skill" or "agent" in your request is usually enough. In
243
+ VS Code you can also type `#` and pick a Skill Builder tool, or untick the tools in the tools
244
+ picker while you work only on your project.
245
+ - **Which session, skill or agent?** Everything has a unique id. The AI finds the one you
246
+ named, then works with its id. If you do not name one, it uses what is open in Skill
247
+ Builder, so _"add a rule to this skill"_ works.
248
+ - **When it is unclear,** for example two sessions called "Backend" or a search that matches
249
+ several, the result tells the AI to ask you which one before changing anything.
250
+ - **It tells you where it worked.** Before its first change the AI says what it is about to
251
+ change, and every change reports the session and skill or agent it landed in
252
+ (`changedIn`), so it can tell you exactly what it did. The app also jumps to it and
253
+ highlights it, and **Undo AI changes** puts it back.
254
+
255
+ ## What you see in Skill Builder
256
+
257
+ - **Changes appear at once**, and the app opens what is being changed.
258
+ - **Highlights:** changed blocks show **Changed by AI**; changed files and canvas cards get
259
+ an accent outline, until you undo or keep the changes.
260
+ - **Undo AI changes**, in the AI menu in the header, puts the session back to how it was
261
+ before the latest batch of AI changes. Undo again to go further back (up to 10 steps per
262
+ session).
263
+ - **Confirmations:** deleting a session, skill, agent, file, custom block or library item,
264
+ and restoring a version, always ask you in the app first.
265
+ - **Saving:** AI changes are saved in the browser straight away, like your own edits. They
266
+ are not a version until you (or the AI) save one. Saved versions can never be changed, so
267
+ **save a version before a big AI session**: you can always go back to it from **History**.
268
+
269
+ ## Privacy
270
+
271
+ - **Your work stays in your browser.** The connector holds content only in memory, while
272
+ passing a result to your AI tool. No telemetry, no analytics, no account, no cloud.
273
+ - **What your AI provider sees:** anything the AI reads through these tools becomes part of
274
+ your chat, so it is sent to your AI tool's model provider (for example GitHub, Anthropic
275
+ or OpenAI), the same as text you paste into the chat. The pairing code is shown there too;
276
+ it works once, for one connection.
277
+ - **Imported skills are instructions.** A skill or agent from someone else tells an AI what
278
+ to do. Read it before you use it: Skill Builder's security scanner catches common attacks,
279
+ not all of them.
280
+
281
+ ## Security
282
+
283
+ The connector is the only part that runs on your computer outside the browser, and it is
284
+ built to do as little as possible:
285
+
286
+ | The connector… | |
287
+ | --------------------------------------------------- | -------------------------------------------------------------- |
288
+ | connects to the internet or other servers | **Never.** It only accepts one connection, on 127.0.0.1. |
289
+ | can be reached from other devices on your network | **No.** It listens on 127.0.0.1 only. |
290
+ | reads or writes your files | **No.** It reads only its own code. |
291
+ | starts programs or shells | **Never.** |
292
+ | runs code it receives, or generates code at runtime | **Never** (`eval` and `new Function` are not used). |
293
+ | keeps running after the AI tool closes | **No.** It exits when the AI tool closes it or quits. |
294
+ | installs other packages | **No.** One bundled file, no dependencies, no install scripts. |
295
+ | sends telemetry | **No.** |
296
+
297
+ An automated test runs the exact published file inside Node's permission model with a
298
+ guard that fails on any network connection, host name lookup, program start, file write or
299
+ runtime code generation.
300
+
301
+ - **Only Skill Builder can connect from a browser:** the WebSocket `Origin` must be exactly
302
+ `https://skill-builder.pascalcouturier.com`, and the `Host` header must be `127.0.0.1` or
303
+ `localhost` (DNS-rebinding protection).
304
+ - **Pairing with a code only you see,** proven in both directions (ECDH P-256 and
305
+ HMAC-SHA256); the code itself is never sent.
306
+ - **Every message is signed and numbered** (HMAC-SHA256), so it can not be forged, replayed
307
+ or reordered, and limited to 1 MB. At most 120 calls a minute per AI tool.
308
+ - **Inputs are checked** against schemas, and text the AI writes goes through Skill
309
+ Builder's security scanner (prompt-injection phrases, hidden characters, secrets,
310
+ download-and-run commands). Scripts are stored as text and never run.
311
+ - **Exact versions:** install `@1.0.0`, not `@latest`. Published npm versions can never be
312
+ changed, so you run exactly the release you chose.
313
+
314
+ **Keep your AI tool's confirmations on.** The bigger risk with any MCP server is what an AI
315
+ does with text it reads: the AI in VS Code, Claude Code or Codex may be allowed to run
316
+ commands or edit files. Do not turn on auto-approve for terminal commands, and only approve
317
+ pairing requests you started yourself.
318
+
319
+ Details, the threat model, how to check a release yourself and how to report a problem
320
+ (privately, to [security@giondesign.com](mailto:security@giondesign.com)): [SECURITY.md](./SECURITY.md).
321
+
322
+ ## Troubleshooting
323
+
324
+ | Problem | What to do |
325
+ | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
326
+ | The AI says _"Skill Builder is not connected"_ | Open Skill Builder, go to **Settings → Connect AI** and switch on **Connect AI tools**. Wait a few seconds and ask again. |
327
+ | Nothing appears to approve in Skill Builder | Check the AI tool started the server (VS Code: **MCP: List Servers**; Claude Code: `/mcp`). Allow local network access: in Chrome or Edge, click the icon left of the address bar → **Site settings**. |
328
+ | _"Skill Builder is waiting for approval"_ | Type the code the AI shows into Skill Builder (the dialog, or **Settings → Connect AI → Enter code**). |
329
+ | _"That code is not right"_ | Use the code from this AI tool's latest message; each connection gets a new one. |
330
+ | _"Pairing is blocked after too many wrong codes"_ | Restart the AI tool or its MCP server (VS Code: **MCP: List Servers → skill-builder → Restart**). |
331
+ | _"…could not prove it belongs to your AI tool"_ | Skill Builder refused a connection that did not know your code. Something else on this computer may be imitating the connector: check what is running, then restart your AI tool. |
332
+ | `spawn npx ENOENT` or _"command not found"_ | Node.js is missing or not on the AI tool's PATH. Install Node.js 20+, or use the full path from `which npx` (macOS, Linux) or `where npx` (Windows). On Windows, try the `cmd /c` configuration. |
333
+ | _"Ports 47320-47329 are all in use"_ | Ten connectors are already running. Close unused AI tool windows or chats, or restart the AI tool. |
334
+ | _"AI tools are connected in another tab"_ | Click **Use this tab** in Skill Builder, or close the other tab or window. |
335
+ | _"Connector x.y.z; the current one is …"_ in the app | See [Updating](#updating). |
336
+ | _"Not saved: the security check refused it"_ | The text contains something the scanner does not allow (for example an API key or a `curl … \| sh` command). Remove it and try again. |
337
+ | Company network blocks `npx` | Ask for `registry.npmjs.org` to be allowed, or install once with `npm install -g @pascalcouturier/skill-builder-mcp@1.0.0` and use `skill-builder-mcp` as the command. |
338
+ | Safari | Not supported: Safari blocks websites from connecting to programs on your computer. Use Chrome, Edge or Firefox. |
339
+
340
+ The connector logs connection events (never your content) to your AI tool's MCP log (VS
341
+ Code: **MCP: List Servers → skill-builder → Show Output**).
342
+
343
+ ## Updating
344
+
345
+ Your AI tool runs exactly the version in its settings; nothing updates on its own. When
346
+ Skill Builder's **Settings → Connect AI** says a newer connector is available:
347
+
348
+ 1. Read what changed in [CHANGELOG.md](./CHANGELOG.md).
349
+ 2. In your AI tool's settings, change `@pascalcouturier/skill-builder-mcp@1.0.0` to the new
350
+ version. The snippets in **Settings → Connect AI** always show the current one.
351
+ 3. Restart the MCP server (VS Code: **MCP: List Servers → skill-builder → Restart**; Claude
352
+ Code: `claude mcp remove skill-builder`, then the new `claude mcp add` line).
353
+
354
+ ## Removing it
355
+
356
+ - Remove the `skill-builder` entry from your AI tool's MCP settings (Claude Code:
357
+ `claude mcp remove skill-builder`).
358
+ - Switch off **Connect AI tools** in Skill Builder.
359
+ - Optional: delete the `_npx` folder inside your npm cache folder (`npm config get cache`
360
+ prints where it is) to remove the copy `npx` downloaded.
361
+
362
+ Nothing else is installed, and the connector leaves no files behind.
363
+
364
+ ## Options
365
+
366
+ | Option | Meaning |
367
+ | ------------ | ------------------------------------------------------------------------------ |
368
+ | `--dev` | Also accept a local Skill Builder dev server (`http://localhost:5173`, `4173`) |
369
+ | `--port <n>` | Use only this port (47320-47329) |
370
+ | `--help` | Show help |
371
+ | `--version` | Show the version |
372
+
373
+ ## Limits
374
+
375
+ - The AI tool and the browser must be on the **same computer**; phones and tablets are not
376
+ supported.
377
+ - **ChatGPT** (web and desktop) only supports remote MCP servers, so it can not use this
378
+ connector.
379
+ - **Safari** is not supported.
380
+ - **Pair on each start:** pairing is not remembered between restarts or reloads.
381
+ - **Cloud features** (sign-in, sync, the AI check, the community library) are not available
382
+ to AI tools.
383
+
384
+ ## Licence
385
+
386
+ [MIT](./LICENSE) © 2026 Pascal Couturier. Bundled third-party packages keep their own
387
+ licences, listed in `dist/THIRD_PARTY_LICENSES.md`.
package/SECURITY.md ADDED
@@ -0,0 +1,107 @@
1
+ # Security and privacy
2
+
3
+ This connector runs on your computer, started by your AI tool. This page says exactly what
4
+ it does and does not do, how that is enforced, and how to check it yourself.
5
+
6
+ ## What it does
7
+
8
+ - Talks MCP with the AI tool that started it, over that process's stdin and stdout.
9
+ - Listens for **one** Skill Builder tab on `127.0.0.1`, on the first free port from 47320 to
10
+ 47329, and passes tool calls and results between the two.
11
+ - Writes short status lines (never your content) to stderr, which your AI tool shows in its
12
+ MCP log.
13
+
14
+ ## What it never does
15
+
16
+ - **No outbound connections.** It does not contact any server, not npm, not GitHub, not
17
+ Skill Builder's website. It only accepts a connection on 127.0.0.1.
18
+ - **Not reachable from your network.** It binds to 127.0.0.1 only.
19
+ - **No files.** It does not read your files (other than its own code) or write any.
20
+ - **No programs.** It does not start other programs or shells.
21
+ - **No code from outside.** It never evaluates code it receives, and it does not generate
22
+ code at runtime (`eval` and `new Function` are never called).
23
+ - **No telemetry, no analytics, no accounts, no cloud.**
24
+ - **No secrets stored.** Keys are made fresh for each connection and kept in memory only.
25
+
26
+ These are checked by an automated test (`src/sandbox.test.ts`) that runs the exact file
27
+ published to npm under Node's permission model (`--permission`, with read access to the
28
+ package only) and a guard that fails the test on any network connection, DNS lookup of a host
29
+ name, program start, file write or runtime code generation.
30
+
31
+ ## Who can talk to it
32
+
33
+ | Who | What happens |
34
+ | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
35
+ | Another website in your browser | Refused: only `https://skill-builder.pascalcouturier.com` is accepted (exact match; `--dev` adds `http://localhost:5173` and `:4173`), and the `Host` header must be `127.0.0.1:<port>` or `localhost:<port>`, which stops DNS-rebinding attacks. |
36
+ | Other devices on your network | Can not connect: it only listens on 127.0.0.1. |
37
+ | A program on your computer pretending to be Skill Builder | Can connect (programs can fake the `Origin` header), but can not pair: the connector makes a random 60-bit pairing code and shows it only to you, through your AI tool and its log. The tab must prove it knows the code (HMAC bound to this connection's ECDH key). Three wrong codes close the connection; ten in one run turn pairing off until the AI tool restarts. Until paired, it receives nothing and can send nothing to your AI tool. |
38
+ | A program pretending to be this connector | Can not pair with Skill Builder: after you type the code, Skill Builder also asks the connector to prove it knows it. Only the connector that showed the code in your AI tool can, so an imitation is refused and the user is told. The code itself never crosses the connection. |
39
+ | Your approved Skill Builder tab | Can answer the tool calls your AI tool makes. Every message is signed (HMAC-SHA256) and numbered, so it can not be forged, replayed or reordered. Messages are limited to 1 MB. |
40
+
41
+ ## Data and privacy
42
+
43
+ - Your skills, agents and sessions stay in your browser (IndexedDB). The connector holds them
44
+ only in memory, while passing a result to your AI tool.
45
+ - What the AI tool reads through the tools becomes part of your chat, so it is sent to your
46
+ AI tool's model provider (for example GitHub, Anthropic or OpenAI), as if you had pasted it.
47
+ The pairing code is also shown there; it is single-use and useless without access to your
48
+ computer.
49
+ - Skill Builder tells the AI that stored text is content, not instructions, and scans what
50
+ the AI writes with its security scanner.
51
+
52
+ ## Keeping your AI tool safe
53
+
54
+ An MCP server's results are read by an AI that may be able to act on your computer (run
55
+ commands, edit files). Treat any tool's output as untrusted, including this one's:
56
+
57
+ - Keep your AI tool's confirmations on for terminal commands and file edits (in VS Code, do
58
+ not turn on auto-approve for terminal tools). Skill Builder's own tools are marked
59
+ read-only or destructive so your AI tool can ask before running them.
60
+ - Only approve a pairing request you started yourself.
61
+ - Turn **Connect AI** off in Skill Builder when you are not using it.
62
+
63
+ ## What is in the package
64
+
65
+ - `dist/cli.js`: one file, built by GitHub Actions. It bundles the MCP TypeScript SDK, `ws`
66
+ and `zod` at locked versions. It is **not minified**, so you can read exactly what runs:
67
+ on npmjs.com open the package's **Code** tab, or look in your npm cache after the first
68
+ run.
69
+ - `dist/THIRD_PARTY_LICENSES.md`: every bundled package, its version and licence.
70
+ - The package has **no dependencies to install** and **no install scripts**.
71
+ - Releases are published only by a GitHub Actions workflow with npm trusted publishing: no
72
+ npm token exists that could leak, and publishing with a token is turned off for this
73
+ package. Every release waits for the maintainer's approval. (Skill Builder's source
74
+ repository is private, and npm adds provenance attestations only for public repositories,
75
+ so releases do not carry one.)
76
+
77
+ ## Check it yourself
78
+
79
+ ```bash
80
+ # What it contains, and its checksum
81
+ npm pack @pascalcouturier/skill-builder-mcp@1.0.0
82
+ tar -tzf pascalcouturier-skill-builder-mcp-1.0.0.tgz
83
+ npm view @pascalcouturier/skill-builder-mcp@1.0.0 dist.integrity
84
+
85
+ # That the registry signed it (in a project that installs it)
86
+ npm audit signatures
87
+
88
+ # Run it with Node's permission model (no file writes, no programs).
89
+ # Unpack the tarball first (tar -xzf …), then:
90
+ node --permission --allow-fs-read="$PWD/package" package/dist/cli.js --help
91
+ ```
92
+
93
+ On Node.js 25 and later the permission model also covers the network. `--help` needs none,
94
+ but to run the connector itself this way add `--allow-net`: it only listens on 127.0.0.1,
95
+ and the sandbox test still checks that it never connects anywhere.
96
+
97
+ Install instructions pin an exact version (`@1.0.0`, not `@1` or `@latest`). Published npm
98
+ versions can never be changed, so your computer runs exactly the release you chose, and an
99
+ update happens only when you change the version yourself.
100
+
101
+ ## Reporting a problem
102
+
103
+ Please report security issues privately by email to
104
+ [security@giondesign.com](mailto:security@giondesign.com), with the connector version, your
105
+ AI tool and browser, and the steps to reproduce. Please do not post them publicly before
106
+ they are fixed. Fixes are released as a new patch version and listed in
107
+ [CHANGELOG.md](./CHANGELOG.md).
package/dist/THIRD_PARTY_LICENSES.md ADDED
@@ -0,0 +1,105 @@
1
+ # Third-party software in this package
2
+
3
+ dist/cli.js bundles the following packages. Their licences follow.
4
+
5
+ - @modelcontextprotocol/sdk@1.31.0 (MIT)
6
+ - ws@8.22.0 (MIT)
7
+ - zod@4.6.5 (MIT)
8
+ - zod-to-json-schema@3.25.2 (ISC)
9
+
10
+ ## @modelcontextprotocol/sdk@1.31.0
11
+
12
+ ```
13
+ MIT License
14
+
15
+ Copyright (c) 2024 Anthropic, PBC
16
+
17
+ Permission is hereby granted, free of charge, to any person obtaining a copy
18
+ of this software and associated documentation files (the "Software"), to deal
19
+ in the Software without restriction, including without limitation the rights
20
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
21
+ copies of the Software, and to permit persons to whom the Software is
22
+ furnished to do so, subject to the following conditions:
23
+
24
+ The above copyright notice and this permission notice shall be included in all
25
+ copies or substantial portions of the Software.
26
+
27
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
28
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
29
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
30
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
31
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
32
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33
+ SOFTWARE.
34
+ ```
35
+
36
+ ## ws@8.22.0
37
+
38
+ ```
39
+ Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
40
+ Copyright (c) 2013 Arnout Kazemier and contributors
41
+ Copyright (c) 2016 Luigi Pinca and contributors
42
+
43
+ Permission is hereby granted, free of charge, to any person obtaining a copy of
44
+ this software and associated documentation files (the "Software"), to deal in
45
+ the Software without restriction, including without limitation the rights to
46
+ use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
47
+ the Software, and to permit persons to whom the Software is furnished to do so,
48
+ subject to the following conditions:
49
+
50
+ The above copyright notice and this permission notice shall be included in all
51
+ copies or substantial portions of the Software.
52
+
53
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
54
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
55
+ FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
56
+ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
57
+ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
58
+ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
59
+ ```
60
+
61
+ ## zod@4.6.5
62
+
63
+ ```
64
+ MIT License
65
+
66
+ Copyright (c) 2025 Colin McDonnell
67
+
68
+ Permission is hereby granted, free of charge, to any person obtaining a copy
69
+ of this software and associated documentation files (the "Software"), to deal
70
+ in the Software without restriction, including without limitation the rights
71
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
72
+ copies of the Software, and to permit persons to whom the Software is
73
+ furnished to do so, subject to the following conditions:
74
+
75
+ The above copyright notice and this permission notice shall be included in all
76
+ copies or substantial portions of the Software.
77
+
78
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
79
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
80
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
81
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
82
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
83
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
84
+ SOFTWARE.
85
+ ```
86
+
87
+ ## zod-to-json-schema@3.25.2
88
+
89
+ ```
90
+ ISC License
91
+
92
+ Copyright (c) 2020, Stefan Terdell
93
+
94
+ Permission to use, copy, modify, and/or distribute this software for any
95
+ purpose with or without fee is hereby granted, provided that the above
96
+ copyright notice and this permission notice appear in all copies.
97
+
98
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
99
+ WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
100
+ MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
101
+ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
102
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
103
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
104
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
105
+ ```