@rhize/skill-forge 0.5.0 → 0.6.0

package/README.md

@@ -172,6 +172,21 @@ launch commands, `--dangerously-*`/`--no-sandbox` flags, and filesystem-root lau
 during the 0.x beta) ranks the candidate against the server entries already present in your
 configured `mcpTargets` files, instead of against a skills root.
 
+**Capability profile (v0.6).** The report also includes a **static** capability summary — tool,
+resource, and prompt counts, plus a `declaredConfidence` (`high`/`partial`/`none`) — parsed from
+the candidate's `package.json`, any shipped `.mcp.json`/manifest, and MCP SDK source-text patterns
+(`server.tool(...)`, `setRequestHandler(ListToolsRequestSchema, ...)`, etc.):
+
+```
+Artifact type       : mcp
+Capabilities        : 2 tools, 1 resource, 0 prompts (declaredConfidence: high)
+```
+
+This is free (it's profiling, not a Pro feature) and **never derived by running the candidate
+server** — anything that can't be determined from source text is reported as undetermined rather
+than discovered by executing it. `--json` includes the full `tools`/`resources`/`prompts` name
+lists under `profile.capabilities`.
+
 **Promote semantics**
 
 Promoting an MCP candidate writes ONE server entry into a target MCP config file's `mcpServers`
@@ -192,7 +207,13 @@ map — it never touches a skills root:
 
 There's no MCP equivalent of the skill provenance ledger (`SOURCES.md`) — the pending-ingestion
 queue (Pro) and `--ingest` handoff both apply the same way, keyed on the written config file path
-instead of an installed skill directory.
+instead of an installed skill directory. The queued entry carries the candidate's static capability
+profile (`capabilities`, v0.6, above), so a `--ingest` handoff run on an MCP promote has real
+material to work with: `assets/ingest-prompt.md` branches on `artifactType: "mcp"` and walks the
+same five-verb decide (DEFER/ABSORB/FORK/REJECT/WATCH) applied to a server instead of a skill —
+compare declared capabilities against what's already configured, then keep/tighten/remove the
+promoted config entry accordingly. Same static-only rule as the CLI's own profiling: the deep pass
+never runs or installs the candidate server to inspect it.
 
 **TOML-format agents: detect-only.** `skill-forge init` detects MCP config files for every known
 agent, including TOML-format ones (Codex CLI's `config.toml`) — they show up in `init`'s MCP-target
@@ -262,7 +283,10 @@ that deeper judgment (which patterns to keep, whether to absorb into an existing
 new one, verifying the result beats baseline) is a job for a coding agent, not the gate. `--ingest`
 hands a promoted skill off to one, running the bundled, agent-neutral prompt at
 `assets/ingest-prompt.md` (Claude Code users get a deeper experience via the companion
-`rhize-skill-forge` plugin skill, but the bundled prompt works with any agent).
+`rhize-skill-forge` plugin skill, but the bundled prompt works with any agent). The same flag works
+on an MCP server promote (`--artifact mcp --ingest`, v0.6): the bundled prompt branches on the
+queue entry's `artifactType` and runs the matching decide pass — see
+[MCP gating](#mcp-gating-v05) above.
 
 ```bash
 skill-forge add owner/name --yes --ingest