@pascalcouturier/skill-builder-mcp 2.5.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +37 -3
- package/README.md +59 -83
- package/SECURITY.md +5 -5
- package/dist/cli.js +411 -409
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,13 +2,47 @@
|
|
|
2
2
|
|
|
3
3
|
Every release of `@pascalcouturier/skill-builder-mcp`. Versions follow
|
|
4
4
|
[semantic versioning](https://semver.org); the major version matches the newest protocol the
|
|
5
|
-
connector speaks. Skill Builder
|
|
6
|
-
|
|
5
|
+
connector speaks. Skill Builder speaks only protocol 3, so `1.x` and `2.x` connectors can no
|
|
6
|
+
longer connect: replace the install line with the `@3` one.
|
|
7
7
|
|
|
8
|
-
The install line names the major version (`@
|
|
8
|
+
The install line names the major version (`@3`), so restarting your AI tool or its MCP server
|
|
9
9
|
fetches the newest release of that major (see **Updating** in the
|
|
10
10
|
[README](./README.md#updating)).
|
|
11
11
|
|
|
12
|
+
## 3.0.0
|
|
13
|
+
|
|
14
|
+
Fewer, grouped tools, so AI tools read about a third less with every request and choose tools
|
|
15
|
+
more reliably. Every feature stays. **Replace your install line with the `@3` one** (Skill
|
|
16
|
+
Builder → Settings → Connect AI): `2.x` connectors can no longer connect, and Skill Builder
|
|
17
|
+
tells you when it finds one.
|
|
18
|
+
|
|
19
|
+
- **41 tools instead of 67.** Related actions share one tool, with an `action` (or `kind`):
|
|
20
|
+
- `block_action`: `move`, `duplicate`, `remove`, `convert`, `break_down`, `extract`
|
|
21
|
+
(was `move_block`, `duplicate_block`, `remove_block`, `convert_block`,
|
|
22
|
+
`break_down_block`, `extract_block_to_file`).
|
|
23
|
+
- `file_action`: `add`, `write`, `move`, `rename` (was `add_file`, `write_code_file`,
|
|
24
|
+
`move_file`, `rename_file`).
|
|
25
|
+
- `delete`: `session`, `document`, `file`, `block_type`, `library_item` (was
|
|
26
|
+
`delete_session`, `remove_document`, `remove_file`, `delete_block_type`,
|
|
27
|
+
`remove_library_item`). It still asks the person first.
|
|
28
|
+
- `duplicate`: `session`, `document` (was `duplicate_session`, `duplicate_document`).
|
|
29
|
+
- `link`: `connect`, `disconnect`.
|
|
30
|
+
- `versions`: `list`, `diff` (was `list_versions`, `diff_versions`).
|
|
31
|
+
- `library_item`: `add`, `update`, `restore_version`, `copy_builtin`, `set_hidden` (was
|
|
32
|
+
`add_library_item`, `update_library_item`, `restore_library_version`,
|
|
33
|
+
`copy_builtin_to_library`, `set_library_hidden`).
|
|
34
|
+
- `repository_import`: `start`, `add_files`, `finish` (was `start_repository_import`,
|
|
35
|
+
`add_repository_files`, `finish_repository_import`).
|
|
36
|
+
- `download`: `project` (the zip or the report), `backup` (was `download_export`,
|
|
37
|
+
`download_backup`).
|
|
38
|
+
- `get_session` with `canvas: true` replaces `get_canvas`; `get_document` with `fileId`
|
|
39
|
+
replaces `read_file`; `validate` with `files` replaces `check_files`; `add_document` with
|
|
40
|
+
`fromLibrary` replaces `add_from_library`.
|
|
41
|
+
- **Leaner definitions:** the input schemas AI tools read leave out length limits (Skill Builder
|
|
42
|
+
still enforces them), and shared notes are said once in the server instructions.
|
|
43
|
+
- **Compact results:** tool results are sent without indentation.
|
|
44
|
+
- **Protocol 3:** the tool list no longer repeats each title in its annotations.
|
|
45
|
+
|
|
12
46
|
## 2.5.0
|
|
13
47
|
|
|
14
48
|
Measure and improve a project, and a faster security scan.
|
package/README.md
CHANGED
|
@@ -72,10 +72,10 @@ shows the same steps with copy buttons and one-click install links for VS Code a
|
|
|
72
72
|
Every tool runs the same command, which names the major version:
|
|
73
73
|
|
|
74
74
|
```bash
|
|
75
|
-
npx -y @pascalcouturier/skill-builder-mcp@
|
|
75
|
+
npx -y @pascalcouturier/skill-builder-mcp@3
|
|
76
76
|
```
|
|
77
77
|
|
|
78
|
-
`@
|
|
78
|
+
`@3` means "the newest 3.x release". `npx` looks it up each time your AI tool starts the
|
|
79
79
|
connector, so you get fixes and new features after a restart without editing anything. A
|
|
80
80
|
release that changes how the app and the connector talk to each other needs a new major
|
|
81
81
|
(`@3`) and never arrives on its own.
|
|
@@ -90,7 +90,7 @@ User Configuration** and add:
|
|
|
90
90
|
"skill-builder": {
|
|
91
91
|
"type": "stdio",
|
|
92
92
|
"command": "npx",
|
|
93
|
-
"args": ["-y", "@pascalcouturier/skill-builder-mcp@
|
|
93
|
+
"args": ["-y", "@pascalcouturier/skill-builder-mcp@3"]
|
|
94
94
|
}
|
|
95
95
|
}
|
|
96
96
|
}
|
|
@@ -102,7 +102,7 @@ Then switch Copilot Chat to **Agent** mode and tick the **skill-builder** tools
|
|
|
102
102
|
**Claude Code** (CLI and the VS Code extension), once in a terminal:
|
|
103
103
|
|
|
104
104
|
```bash
|
|
105
|
-
claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-builder-mcp@
|
|
105
|
+
claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-builder-mcp@3
|
|
106
106
|
```
|
|
107
107
|
|
|
108
108
|
**OpenAI Codex** (CLI and the VS Code extension), in `~/.codex/config.toml`
|
|
@@ -111,7 +111,7 @@ claude mcp add --scope user skill-builder -- npx -y @pascalcouturier/skill-build
|
|
|
111
111
|
```toml
|
|
112
112
|
[mcp_servers.skill-builder]
|
|
113
113
|
command = "npx"
|
|
114
|
-
args = ["-y", "@pascalcouturier/skill-builder-mcp@
|
|
114
|
+
args = ["-y", "@pascalcouturier/skill-builder-mcp@3"]
|
|
115
115
|
```
|
|
116
116
|
|
|
117
117
|
**Cursor** (`~/.cursor/mcp.json`), **Claude Desktop** (**Settings → Developer → Edit
|
|
@@ -122,14 +122,14 @@ Config**, then restart it) and most other clients (Windsurf, Cline, Zed…):
|
|
|
122
122
|
"mcpServers": {
|
|
123
123
|
"skill-builder": {
|
|
124
124
|
"command": "npx",
|
|
125
|
-
"args": ["-y", "@pascalcouturier/skill-builder-mcp@
|
|
125
|
+
"args": ["-y", "@pascalcouturier/skill-builder-mcp@3"]
|
|
126
126
|
}
|
|
127
127
|
}
|
|
128
128
|
}
|
|
129
129
|
```
|
|
130
130
|
|
|
131
131
|
On **Windows**, if the tool can not start `npx`, use `"command": "cmd"` and
|
|
132
|
-
`"args": ["/c", "npx", "-y", "@pascalcouturier/skill-builder-mcp@
|
|
132
|
+
`"args": ["/c", "npx", "-y", "@pascalcouturier/skill-builder-mcp@3"]`.
|
|
133
133
|
|
|
134
134
|
### 2. Turn on Connect AI in Skill Builder
|
|
135
135
|
|
|
@@ -177,7 +177,7 @@ or reloading Skill Builder; the code is new every time and you never need to kee
|
|
|
177
177
|
The connector offers MCP prompts, which AI tools show as slash commands:
|
|
178
178
|
|
|
179
179
|
- **`review-skill`** (always): the AI checks a skill or agent with Skill Builder's rules
|
|
180
|
-
(`
|
|
180
|
+
(`validate` with `files` for files in your repository, `validate` alone in Skill Builder), fixes the
|
|
181
181
|
problems, improves it following best practice and summarises what it changed.
|
|
182
182
|
- **`init-agents-md`** (when Skill Builder is connected): like `/init`, the AI reads your
|
|
183
183
|
repository (commands, structure, conventions, installed skills and agents) and creates or
|
|
@@ -210,75 +210,49 @@ The AI can do what you can do in the app, except anything to do with the cloud (
|
|
|
210
210
|
sync, the AI check, the community library). Tools marked **asks** wait for your confirmation
|
|
211
211
|
in Skill Builder.
|
|
212
212
|
|
|
213
|
-
| Tool | What it does
|
|
214
|
-
| ---------------------------- |
|
|
215
|
-
| `get_status` | What is open: project, skill or agent, file, unsaved changes
|
|
216
|
-
| `list_sessions` | Search, filter, sort and page projects
|
|
217
|
-
| `get_session` | A project's skills and agents, files and links
|
|
218
|
-
| `get_document` | A skill or agent with every block (uids, types, values)
|
|
219
|
-
| `
|
|
220
|
-
| `
|
|
221
|
-
| `
|
|
222
|
-
| `
|
|
223
|
-
| `
|
|
224
|
-
| `
|
|
225
|
-
| `
|
|
226
|
-
| `
|
|
227
|
-
| `
|
|
228
|
-
| `
|
|
229
|
-
| `
|
|
230
|
-
| `
|
|
231
|
-
| `
|
|
232
|
-
| `
|
|
233
|
-
| `
|
|
234
|
-
| `
|
|
235
|
-
| `
|
|
236
|
-
| `
|
|
237
|
-
| `
|
|
238
|
-
| `
|
|
239
|
-
| `
|
|
240
|
-
| `
|
|
241
|
-
| `
|
|
242
|
-
| `
|
|
243
|
-
| `
|
|
244
|
-
| `
|
|
245
|
-
| `
|
|
246
|
-
| `
|
|
247
|
-
| `
|
|
248
|
-
| `
|
|
249
|
-
| `
|
|
250
|
-
| `
|
|
251
|
-
| `
|
|
252
|
-
| `
|
|
253
|
-
| `
|
|
254
|
-
| `
|
|
255
|
-
| `
|
|
256
|
-
| `write_code_file` | Write a script or data file (scanned, never run) | |
|
|
257
|
-
| `add_files` | Add several supporting files by path (scanned like uploads) | |
|
|
258
|
-
| `move_file` | Move a file to another folder of its skill (`scripts/test`) | |
|
|
259
|
-
| `rename_file` | Rename a reference | |
|
|
260
|
-
| `remove_file` | Delete a file | asks |
|
|
261
|
-
| `connect` | Link an agent to a skill, or point a reference or Resource link block | |
|
|
262
|
-
| `disconnect` | Remove such a link | |
|
|
263
|
-
| `add_from_library` | Add a library skill or agent to the project | |
|
|
264
|
-
| `update_evaluation` | Save tests for a skill or agent, or the results of running them (`/evaluate-skill`) | |
|
|
265
|
-
| `apply_fix` | Apply a fix from `validate` | |
|
|
266
|
-
| `save_version` | Save a version (bump suggested from the changes) | |
|
|
267
|
-
| `restore_version` | Replace the working copy with a version | asks |
|
|
268
|
-
| `download_export` | Download the zip in the browser, for the AI tools you choose, or the project report | |
|
|
269
|
-
| `download_backup` | Download a backup in the browser | |
|
|
270
|
-
| `tidy_canvas` | Tidy the canvas layout | |
|
|
271
|
-
| `undo_ai_changes` | Same as **Undo AI changes** | if you edited |
|
|
272
|
-
| `save_block_type` | Create or edit a custom block type | |
|
|
273
|
-
| `delete_block_type` | Delete a custom block type | asks |
|
|
274
|
-
| `add_library_item` | Add your own skill or agent to the library from markdown | if warnings |
|
|
275
|
-
| `update_library_item` | Edit a library item (saved as a new version) | |
|
|
276
|
-
| `restore_library_version` | Bring back an older version of a library item | |
|
|
277
|
-
| `copy_builtin_to_library` | Make an editable copy of a built-in skill | |
|
|
278
|
-
| `set_library_hidden` | Hide or show a built-in skill | |
|
|
279
|
-
| `remove_library_item` | Delete a library item | asks |
|
|
280
|
-
| `import_from_github` | List and import skills and agents from a public GitHub repo | if warnings |
|
|
281
|
-
| `set_preferences` | Default author, Blocks or Canvas view, block matching on import | |
|
|
213
|
+
| Tool | What it does | Asks |
|
|
214
|
+
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
|
|
215
|
+
| `get_status` | What is open: project, skill or agent, file, unsaved changes | |
|
|
216
|
+
| `list_sessions` | Search, filter, sort and page projects | |
|
|
217
|
+
| `get_session` | A project's skills and agents, files and links; with `canvas`, the canvas graph | |
|
|
218
|
+
| `get_document` | A skill or agent with every block (uids, types, values); with `fileId`, the markdown a file produces or a script's text | |
|
|
219
|
+
| `list_block_types` | Block types and their fields | |
|
|
220
|
+
| `list_templates` | Templates for new skills, agents and rules, with best practice for writing them | |
|
|
221
|
+
| `list_library` | Built-in skills and your library items | |
|
|
222
|
+
| `get_library_item` | One library item with its files, scan result and versions | |
|
|
223
|
+
| `validate` | The checks, with one-click fixes, each with why it matters and its source; with `files`, checks skill or agent files from your repository (nothing is stored) | |
|
|
224
|
+
| `analyze_project` | The project report's analysis: scorecard, findings with evidence, context cost per AI tool, competition, portability, tests; returns a baseline id | |
|
|
225
|
+
| `compare_analysis` | Before and after a baseline, computed by Skill Builder (characters, findings, tests) | |
|
|
226
|
+
| `get_standards` | Best practice per topic and per AI tool, with sources and the date each was checked | |
|
|
227
|
+
| `use_skill` | Use a skill, agent, rule or instructions you shared: main file, then files on demand | first use |
|
|
228
|
+
| `preview_export` | The files the zip would contain (ready for a project, or plain folders) | |
|
|
229
|
+
| `versions` | Saved versions (`list`), or line changes between versions or against the working copy (`diff`) | |
|
|
230
|
+
| `create_session` | New project | |
|
|
231
|
+
| `open_session` | Show a project, skill or agent, or file in the app | |
|
|
232
|
+
| `update_session` | Rename, change author or description, star | |
|
|
233
|
+
| `duplicate` | Copy a project (`session`) or a skill or agent (`document`) | |
|
|
234
|
+
| `delete` | Delete a project and its versions, a skill or agent, a file, a custom block type or a library item | asks |
|
|
235
|
+
| `add_document` | Add a skill, agent or tool file, optionally from a template, or a copy of a library item (`fromLibrary`) | |
|
|
236
|
+
| `update_document` | Set name, description, licence, allowed tools, model… | |
|
|
237
|
+
| `write_project_instructions` | Create or update AGENTS.md and CLAUDE.md from your repository (`/init-agents-md`) | |
|
|
238
|
+
| `repository_import` | Import your repository's AI files into a new project: `start`, `add_files` (up to 50 per call), `finish` (`/import-project`) | |
|
|
239
|
+
| `add_block` | Add a block with values at a position | |
|
|
240
|
+
| `update_block` | Change block values, collapse or expand | |
|
|
241
|
+
| `block_action` | `move` (up, down or to another file), `duplicate`, `remove`, `convert` to Custom markdown, `break_down` into built-in blocks, `extract` to a new reference file | |
|
|
242
|
+
| `add_files` | Add several supporting files by path (scanned like uploads) | |
|
|
243
|
+
| `file_action` | `add` a reference, script or asset, `write` a script or data file (scanned, never run), `move` it to another folder (`scripts/test`), `rename` a reference | |
|
|
244
|
+
| `link` | `connect` an agent to a skill, or point a reference or Resource link block; `disconnect` removes the link | |
|
|
245
|
+
| `update_evaluation` | Save tests for a skill or agent, or the results of running them (`/evaluate-skill`) | |
|
|
246
|
+
| `apply_fix` | Apply a fix from `validate` | |
|
|
247
|
+
| `save_version` | Save a version, only when you ask (bump suggested from the changes) | asks |
|
|
248
|
+
| `restore_version` | Replace the working copy with a version | asks |
|
|
249
|
+
| `download` | Download the zip (refused if the scan finds a secret) or the project report as HTML or Markdown (`project`), or a backup (`backup`) | asks |
|
|
250
|
+
| `tidy_canvas` | Tidy the canvas layout | |
|
|
251
|
+
| `undo_ai_changes` | Same as **Undo AI changes** | if you edited |
|
|
252
|
+
| `save_block_type` | Create or edit a custom block type | |
|
|
253
|
+
| `library_item` | Your library: `add` a skill, agent or rule from markdown, `update` it (a new version), `restore_version`, `copy_builtin` (an editable copy of a built-in skill), `set_hidden` | if warnings |
|
|
254
|
+
| `import_from_github` | List and import skills and agents from a public GitHub repo | if warnings |
|
|
255
|
+
| `set_preferences` | Default author, Blocks or Canvas view, block matching on import | |
|
|
282
256
|
|
|
283
257
|
Edits carry the project's revision. If you changed the project since the AI last read it,
|
|
284
258
|
the edit is refused and the AI reads it again, so it never overwrites your work by accident.
|
|
@@ -375,7 +349,7 @@ runtime code generation.
|
|
|
375
349
|
- **Inputs are checked** against schemas, and text the AI writes goes through Skill
|
|
376
350
|
Builder's security scanner (prompt-injection phrases, hidden characters, secrets,
|
|
377
351
|
download-and-run commands). Scripts are stored as text and never run.
|
|
378
|
-
- **Major version, not `latest`:** the install line is `@
|
|
352
|
+
- **Major version, not `latest`:** the install line is `@3`, so you get new 3.x releases but
|
|
379
353
|
never a breaking major unasked. Published npm versions can never be changed or replaced, and
|
|
380
354
|
only the approved GitHub Actions workflow can publish. To review every release first, put
|
|
381
355
|
an exact version after the `@` instead; Skill Builder still tells you when it is out of
|
|
@@ -404,7 +378,7 @@ Details, the threat model, how to check a release yourself and how to report a p
|
|
|
404
378
|
| _"AI tools are connected in another tab"_ | Click **Use this tab** in Skill Builder, or close the other tab or window. |
|
|
405
379
|
| _"…connector x.y.z is out of date…"_ in the app | See [Updating](#updating). |
|
|
406
380
|
| _"Not saved: the security check refused it"_ | The text contains something the scanner does not allow (for example an API key or a `curl … \| sh` command). Remove it and try again. |
|
|
407
|
-
| Company network blocks `npx` | Ask for `registry.npmjs.org` to be allowed, or install once with `npm install -g @pascalcouturier/skill-builder-mcp@
|
|
381
|
+
| Company network blocks `npx` | Ask for `registry.npmjs.org` to be allowed, or install once with `npm install -g @pascalcouturier/skill-builder-mcp@3` and use `skill-builder-mcp` as the command (run it again to update; a global install does not update itself). |
|
|
408
382
|
| Safari | Not supported: Safari blocks websites from connecting to programs on your computer. Use Chrome, Edge or Firefox. |
|
|
409
383
|
|
|
410
384
|
The connector logs connection events (never your content) to your AI tool's MCP log (VS
|
|
@@ -412,8 +386,8 @@ Code: **MCP: List Servers → skill-builder → Show Output**).
|
|
|
412
386
|
|
|
413
387
|
## Updating
|
|
414
388
|
|
|
415
|
-
The install line names the major version (`@
|
|
416
|
-
your AI tool starts it, `npx` fetches the newest
|
|
389
|
+
The install line names the major version (`@3`), so the connector updates itself: each time
|
|
390
|
+
your AI tool starts it, `npx` fetches the newest 3.x release. You only have to restart.
|
|
417
391
|
|
|
418
392
|
Skill Builder tells you when a connected tool's connector is older than the one it was built
|
|
419
393
|
for: a notice when the tool connects, an amber dot on the **AI** menu in the header, and a
|
|
@@ -425,12 +399,14 @@ note under the tool in **Settings → Connect AI**. What to do:
|
|
|
425
399
|
the window or quit the tool) or `npx` served a cached copy: delete the `_npx` folder inside
|
|
426
400
|
your npm cache (`npm config get cache` prints where it is).
|
|
427
401
|
- **"Replace its install line…"**: the tool has a line from an earlier major (for example
|
|
428
|
-
`@
|
|
402
|
+
`@2`), which a restart keeps running. Copy the current line from **Settings → Connect AI →
|
|
429
403
|
Set up an AI tool** (Claude Code: `claude mcp remove skill-builder`, then the new
|
|
430
404
|
`claude mcp add` line).
|
|
431
405
|
|
|
432
406
|
Read what changed in [CHANGELOG.md](./CHANGELOG.md). An older connector that still speaks a
|
|
433
|
-
protocol the app supports keeps working; it only misses what is new.
|
|
407
|
+
protocol the app supports keeps working; it only misses what is new. A `2.x` connector can not
|
|
408
|
+
connect to the current Skill Builder (3.0 grouped the tools): Skill Builder says so, and the
|
|
409
|
+
fix is to replace the install line with the `@3` one.
|
|
434
410
|
|
|
435
411
|
## Removing it
|
|
436
412
|
|
package/SECURITY.md
CHANGED
|
@@ -122,9 +122,9 @@ commands, edit files). Treat any tool's output as untrusted, including this one'
|
|
|
122
122
|
|
|
123
123
|
```bash
|
|
124
124
|
# What it contains, and its checksum
|
|
125
|
-
npm pack @pascalcouturier/skill-builder-mcp@
|
|
125
|
+
npm pack @pascalcouturier/skill-builder-mcp@3.0.0
|
|
126
126
|
tar -tzf pascalcouturier-skill-builder-mcp-2.5.0.tgz
|
|
127
|
-
npm view @pascalcouturier/skill-builder-mcp@
|
|
127
|
+
npm view @pascalcouturier/skill-builder-mcp@3.0.0 dist.integrity
|
|
128
128
|
|
|
129
129
|
# That the registry signed it (in a project that installs it)
|
|
130
130
|
npm audit signatures
|
|
@@ -138,15 +138,15 @@ On Node.js 25 and later the permission model also covers the network. `--help` n
|
|
|
138
138
|
but to run the connector itself this way add `--allow-net`: it only listens on 127.0.0.1,
|
|
139
139
|
and the sandbox test still checks that it never connects anywhere.
|
|
140
140
|
|
|
141
|
-
Install instructions name the major version (`@
|
|
142
|
-
`npx` resolves it each time your AI tool starts the connector, so you get new
|
|
141
|
+
Install instructions name the major version (`@3`), not `@latest` and not an exact release.
|
|
142
|
+
`npx` resolves it each time your AI tool starts the connector, so you get new 3.x releases after
|
|
143
143
|
a restart, while a release that breaks the protocol needs a new major and never arrives on its
|
|
144
144
|
own. Published npm versions can never be changed or replaced, and releases are published only by
|
|
145
145
|
the approved GitHub Actions workflow (no npm token exists).
|
|
146
146
|
|
|
147
147
|
This means a release reaches you without you reviewing it first. If you want to review each one
|
|
148
148
|
(for example in a company), put an exact version after the `@` in your AI tool's settings, such as
|
|
149
|
-
`@
|
|
149
|
+
`@3.0.0`, and update it yourself; Skill Builder still shows when your connector is out of date.
|
|
150
150
|
Use the commands above to look at any release before you run it.
|
|
151
151
|
|
|
152
152
|
## Reporting a problem
|