@pascalcouturier/skill-builder-mcp 2.0.0 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +19 -2
- package/README.md +51 -32
- package/SECURITY.md +13 -6
- package/dist/cli.js +2 -2
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,8 +5,25 @@ Every release of `@pascalcouturier/skill-builder-mcp`. Versions follow
|
|
|
5
5
|
connector speaks. Skill Builder still speaks protocol 1, so `1.x` connectors keep working
|
|
6
6
|
(tools only); slash commands need `2.x`.
|
|
7
7
|
|
|
8
|
-
|
|
9
|
-
**Updating** in the
|
|
8
|
+
The install line names the major version (`@2`), so restarting your AI tool or its MCP server
|
|
9
|
+
fetches the newest release of that major (see **Updating** in the
|
|
10
|
+
[README](./README.md#updating)).
|
|
11
|
+
|
|
12
|
+
## 2.1.0
|
|
13
|
+
|
|
14
|
+
Easier updates.
|
|
15
|
+
|
|
16
|
+
- **The install line names the major version (`@2`) instead of an exact release**, in Skill
|
|
17
|
+
Builder's setup panel, the docs and `--help`. `npx` looks it up every time your AI tool
|
|
18
|
+
starts the connector, so a restart picks up new releases without editing any settings. A
|
|
19
|
+
release that changes the protocol needs a new major and never arrives on its own.
|
|
20
|
+
- **Skill Builder tells you when your connector is out of date**: a notice when the tool
|
|
21
|
+
connects, an amber dot and note on the **AI** menu, and a note in **Settings → Connect AI**.
|
|
22
|
+
It says to restart the tool (same major) or to replace an older install line (for example
|
|
23
|
+
`@1`). That check lives in the app; in the connector itself only the `--help` text changes.
|
|
24
|
+
- Still protocol 2, so 1.x and 2.0 connectors keep working with the current site.
|
|
25
|
+
- No new permissions: the connector still reads no files and no environment variables beyond
|
|
26
|
+
its allowlist, listens only on 127.0.0.1 and accepts only the live site.
|
|
10
27
|
|
|
11
28
|
## 2.0.0
|
|
12
29
|
|
package/README.md
CHANGED
|
@@ -69,12 +69,17 @@ Once per AI tool. Each tool keeps its own list of MCP servers, so if you use Cop
|
|
|
69
69
|
Code and Codex inside VS Code, add it to each. In Skill Builder, **Settings → Connect AI**
|
|
70
70
|
shows the same steps with copy buttons and one-click install links for VS Code and Cursor.
|
|
71
71
|
|
|
72
|
-
Every tool runs the same command,
|
|
72
|
+
Every tool runs the same command, which names the major version:
|
|
73
73
|
|
|
74
74
|
```bash
|
|
75
|
-
npx -y @pascalcouturier/skill-builder-mcp@2
|
|
75
|
+
npx -y @pascalcouturier/skill-builder-mcp@2
|
|
76
76
|
```
|
|
77
77
|
|
|
78
|
+
`@2` means "the newest 2.x release". `npx` looks it up each time your AI tool starts the
|
|
79
|
+
connector, so you get fixes and new features after a restart without editing anything. A
|
|
80
|
+
release that changes how the app and the connector talk to each other needs a new major
|
|
81
|
+
(`@3`) and never arrives on its own.
|
|
82
|
+
|
|
78
83
|
**VS Code (GitHub Copilot).** Command Palette → **MCP: Add Server…** → **Command (stdio)** →
|
|
79
84
|
enter the command above, name it `skill-builder` and choose **Global**. Or run **MCP: Open
|
|
80
85
|
User Configuration** and add:
|
|
@@ -85,7 +90,7 @@ User Configuration** and add:
|
|
|
85
90
|
"skill-builder": {
|
|
86
91
|
"type": "stdio",
|
|
87
92
|
"command": "npx",
|
|
88
|
-
"args": ["-y", "@pascalcouturier/skill-builder-mcp@2
|
|
93
|
+
"args": ["-y", "@pascalcouturier/skill-builder-mcp@2"]
|
|
89
94
|
}
|
|
90
95
|
}
|
|
91
96
|
}
|
|
@@ -97,7 +102,7 @@ Then switch Copilot Chat to **Agent** mode and tick the **skill-builder** tools
|
|
|
97
102
|
**Claude Code** (CLI and the VS Code extension), once in a terminal:
|
|
98
103
|
|
|
99
104
|
```bash
|
|
100
|
-
claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-builder-mcp@2
|
|
105
|
+
claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-builder-mcp@2
|
|
101
106
|
```
|
|
102
107
|
|
|
103
108
|
**OpenAI Codex** (CLI and the VS Code extension), in `~/.codex/config.toml`
|
|
@@ -106,7 +111,7 @@ claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-build
|
|
|
106
111
|
```toml
|
|
107
112
|
[mcp_servers.skill-builder]
|
|
108
113
|
command = "npx"
|
|
109
|
-
args = ["-y", "@pascalcouturier/skill-builder-mcp@2
|
|
114
|
+
args = ["-y", "@pascalcouturier/skill-builder-mcp@2"]
|
|
110
115
|
```
|
|
111
116
|
|
|
112
117
|
**Cursor** (`~/.cursor/mcp.json`), **Claude Desktop** (**Settings → Developer → Edit
|
|
@@ -117,14 +122,14 @@ Config**, then restart it) and most other clients (Windsurf, Cline, Zed…):
|
|
|
117
122
|
"mcpServers": {
|
|
118
123
|
"skill-builder": {
|
|
119
124
|
"command": "npx",
|
|
120
|
-
"args": ["-y", "@pascalcouturier/skill-builder-mcp@2
|
|
125
|
+
"args": ["-y", "@pascalcouturier/skill-builder-mcp@2"]
|
|
121
126
|
}
|
|
122
127
|
}
|
|
123
128
|
}
|
|
124
129
|
```
|
|
125
130
|
|
|
126
131
|
On **Windows**, if the tool can not start `npx`, use `"command": "cmd"` and
|
|
127
|
-
`"args": ["/c", "npx", "-y", "@pascalcouturier/skill-builder-mcp@2
|
|
132
|
+
`"args": ["/c", "npx", "-y", "@pascalcouturier/skill-builder-mcp@2"]`.
|
|
128
133
|
|
|
129
134
|
### 2. Turn on Connect AI in Skill Builder
|
|
130
135
|
|
|
@@ -348,8 +353,11 @@ runtime code generation.
|
|
|
348
353
|
- **Inputs are checked** against schemas, and text the AI writes goes through Skill
|
|
349
354
|
Builder's security scanner (prompt-injection phrases, hidden characters, secrets,
|
|
350
355
|
download-and-run commands). Scripts are stored as text and never run.
|
|
351
|
-
- **
|
|
352
|
-
|
|
356
|
+
- **Major version, not `latest`:** the install line is `@2`, so you get new 2.x releases but
|
|
357
|
+
never a breaking major unasked. Published npm versions can never be changed or replaced, and
|
|
358
|
+
only the approved GitHub Actions workflow can publish. To review every release first, put
|
|
359
|
+
an exact version after the `@` instead; Skill Builder still tells you when it is out of
|
|
360
|
+
date.
|
|
353
361
|
|
|
354
362
|
**Keep your AI tool's confirmations on.** The bigger risk with any MCP server is what an AI
|
|
355
363
|
does with text it reads: the AI in VS Code, Claude Code or Codex may be allowed to run
|
|
@@ -361,35 +369,46 @@ Details, the threat model, how to check a release yourself and how to report a p
|
|
|
361
369
|
|
|
362
370
|
## Troubleshooting
|
|
363
371
|
|
|
364
|
-
| Problem
|
|
365
|
-
|
|
|
366
|
-
| The AI says _"Skill Builder is not connected"_
|
|
367
|
-
| Nothing appears to approve in Skill Builder
|
|
368
|
-
| _"Skill Builder is waiting for approval"_
|
|
369
|
-
| _"That code is not right"_
|
|
370
|
-
| _"Pairing is blocked after too many wrong codes"_
|
|
371
|
-
| _"…could not prove it belongs to your AI tool"_
|
|
372
|
-
| `spawn npx ENOENT` or _"command not found"_
|
|
373
|
-
| _"Ports 47320-47329 are all in use"_
|
|
374
|
-
| _"AI tools are connected in another tab"_
|
|
375
|
-
| _"
|
|
376
|
-
| _"Not saved: the security check refused it"_
|
|
377
|
-
| Company network blocks `npx`
|
|
378
|
-
| Safari
|
|
372
|
+
| Problem | What to do |
|
|
373
|
+
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
374
|
+
| The AI says _"Skill Builder is not connected"_ | Open Skill Builder, go to **Settings → Connect AI** and switch on **Connect AI tools**. Wait a few seconds and ask again. |
|
|
375
|
+
| Nothing appears to approve in Skill Builder | Check the AI tool started the server (VS Code: **MCP: List Servers**; Claude Code: `/mcp`). Allow local network access: in Chrome or Edge, click the icon left of the address bar → **Site settings**. |
|
|
376
|
+
| _"Skill Builder is waiting for approval"_ | Type the code the AI shows into Skill Builder (the dialog, or **Settings → Connect AI → Enter code**). |
|
|
377
|
+
| _"That code is not right"_ | Use the code from this AI tool's latest message; each connection gets a new one. |
|
|
378
|
+
| _"Pairing is blocked after too many wrong codes"_ | Restart the AI tool or its MCP server (VS Code: **MCP: List Servers → skill-builder → Restart**). |
|
|
379
|
+
| _"…could not prove it belongs to your AI tool"_ | Skill Builder refused a connection that did not know your code. Something else on this computer may be imitating the connector: check what is running, then restart your AI tool. |
|
|
380
|
+
| `spawn npx ENOENT` or _"command not found"_ | Node.js is missing or not on the AI tool's PATH. Install Node.js 20+, or use the full path from `which npx` (macOS, Linux) or `where npx` (Windows). On Windows, try the `cmd /c` configuration. |
|
|
381
|
+
| _"Ports 47320-47329 are all in use"_ | Ten connectors are already running. Close unused AI tool windows or chats, or restart the AI tool. |
|
|
382
|
+
| _"AI tools are connected in another tab"_ | Click **Use this tab** in Skill Builder, or close the other tab or window. |
|
|
383
|
+
| _"…connector x.y.z is out of date…"_ in the app | See [Updating](#updating). |
|
|
384
|
+
| _"Not saved: the security check refused it"_ | The text contains something the scanner does not allow (for example an API key or a `curl … \| sh` command). Remove it and try again. |
|
|
385
|
+
| Company network blocks `npx` | Ask for `registry.npmjs.org` to be allowed, or install once with `npm install -g @pascalcouturier/skill-builder-mcp@2` and use `skill-builder-mcp` as the command (run it again to update; a global install does not update itself). |
|
|
386
|
+
| Safari | Not supported: Safari blocks websites from connecting to programs on your computer. Use Chrome, Edge or Firefox. |
|
|
379
387
|
|
|
380
388
|
The connector logs connection events (never your content) to your AI tool's MCP log (VS
|
|
381
389
|
Code: **MCP: List Servers → skill-builder → Show Output**).
|
|
382
390
|
|
|
383
391
|
## Updating
|
|
384
392
|
|
|
385
|
-
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
|
|
389
|
-
|
|
390
|
-
|
|
391
|
-
|
|
392
|
-
|
|
393
|
+
The install line names the major version (`@2`), so the connector updates itself: each time
|
|
394
|
+
your AI tool starts it, `npx` fetches the newest 2.x release. You only have to restart.
|
|
395
|
+
|
|
396
|
+
Skill Builder tells you when a connected tool's connector is older than the one it was built
|
|
397
|
+
for: a notice when the tool connects, an amber dot on the **AI** menu in the header, and a
|
|
398
|
+
note under the tool in **Settings → Connect AI**. What to do:
|
|
399
|
+
|
|
400
|
+
- **"Restart …"**: restart your AI tool, or its MCP server (VS Code: **MCP: List Servers →
|
|
401
|
+
skill-builder → Restart**; Claude Code: `/mcp`, or quit and start it again), then approve
|
|
402
|
+
the new connection. If it still says out of date, the old process is still running (reload
|
|
403
|
+
the window or quit the tool) or `npx` served a cached copy: delete the `_npx` folder inside
|
|
404
|
+
your npm cache (`npm config get cache` prints where it is).
|
|
405
|
+
- **"Replace its install line…"**: the tool has a line from an earlier major (for example
|
|
406
|
+
`@1`), which a restart keeps running. Copy the current line from **Settings → Connect AI →
|
|
407
|
+
Set up an AI tool** (Claude Code: `claude mcp remove skill-builder`, then the new
|
|
408
|
+
`claude mcp add` line).
|
|
409
|
+
|
|
410
|
+
Read what changed in [CHANGELOG.md](./CHANGELOG.md). An older connector that still speaks a
|
|
411
|
+
protocol the app supports keeps working; it only misses what is new.
|
|
393
412
|
|
|
394
413
|
## Removing it
|
|
395
414
|
|
package/SECURITY.md
CHANGED
|
@@ -122,9 +122,9 @@ commands, edit files). Treat any tool's output as untrusted, including this one'
|
|
|
122
122
|
|
|
123
123
|
```bash
|
|
124
124
|
# What it contains, and its checksum
|
|
125
|
-
npm pack @pascalcouturier/skill-builder-mcp@2.
|
|
126
|
-
tar -tzf pascalcouturier-skill-builder-mcp-2.
|
|
127
|
-
npm view @pascalcouturier/skill-builder-mcp@2.
|
|
125
|
+
npm pack @pascalcouturier/skill-builder-mcp@2.1.0
|
|
126
|
+
tar -tzf pascalcouturier-skill-builder-mcp-2.1.0.tgz
|
|
127
|
+
npm view @pascalcouturier/skill-builder-mcp@2.1.0 dist.integrity
|
|
128
128
|
|
|
129
129
|
# That the registry signed it (in a project that installs it)
|
|
130
130
|
npm audit signatures
|
|
@@ -138,9 +138,16 @@ On Node.js 25 and later the permission model also covers the network. `--help` n
|
|
|
138
138
|
but to run the connector itself this way add `--allow-net`: it only listens on 127.0.0.1,
|
|
139
139
|
and the sandbox test still checks that it never connects anywhere.
|
|
140
140
|
|
|
141
|
-
Install instructions
|
|
142
|
-
|
|
143
|
-
|
|
141
|
+
Install instructions name the major version (`@2`), not `@latest` and not an exact release.
|
|
142
|
+
`npx` resolves it each time your AI tool starts the connector, so you get new 2.x releases after
|
|
143
|
+
a restart, while a release that breaks the protocol needs a new major and never arrives on its
|
|
144
|
+
own. Published npm versions can never be changed or replaced, and releases are published only by
|
|
145
|
+
the approved GitHub Actions workflow (no npm token exists).
|
|
146
|
+
|
|
147
|
+
This means a release reaches you without you reviewing it first. If you want to review each one
|
|
148
|
+
(for example in a company), put an exact version after the `@` in your AI tool's settings, such as
|
|
149
|
+
`@2.1.0`, and update it yourself; Skill Builder still shows when your connector is out of date.
|
|
150
|
+
Use the commands above to look at any release before you run it.
|
|
144
151
|
|
|
145
152
|
## Reporting a problem
|
|
146
153
|
|
package/dist/cli.js
CHANGED
|
@@ -7845,7 +7845,7 @@ var StdioServerTransport = class {
|
|
|
7845
7845
|
};
|
|
7846
7846
|
var package_default = {
|
|
7847
7847
|
name: "@pascalcouturier/skill-builder-mcp",
|
|
7848
|
-
version: "2.
|
|
7848
|
+
version: "2.1.0",
|
|
7849
7849
|
description: "Connect AI tools (GitHub Copilot, Claude Code, Codex, Cursor, Claude Desktop) to Skill Builder open in your browser, over MCP.",
|
|
7850
7850
|
license: "MIT",
|
|
7851
7851
|
author: "Pascal Couturier (https://pascalcouturier.com)",
|
|
@@ -13203,7 +13203,7 @@ function printable(value) {
|
|
|
13203
13203
|
//#region src/args.ts
|
|
13204
13204
|
var USAGE = `skill-builder-mcp: connect AI tools to Skill Builder in your browser.
|
|
13205
13205
|
|
|
13206
|
-
Usage: npx -y @pascalcouturier/skill-builder-mcp@2
|
|
13206
|
+
Usage: npx -y @pascalcouturier/skill-builder-mcp@2 [options]
|
|
13207
13207
|
|
|
13208
13208
|
Your AI tool starts this for you; you do not run it by hand. Then open
|
|
13209
13209
|
https://skill-builder.pascalcouturier.com, go to Settings → Connect AI,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pascalcouturier/skill-builder-mcp",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.1.0",
|
|
4
4
|
"description": "Connect AI tools (GitHub Copilot, Claude Code, Codex, Cursor, Claude Desktop) to Skill Builder open in your browser, over MCP.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "Pascal Couturier (https://pascalcouturier.com)",
|