@rhize/skill-forge 0.5.0 → 0.6.0

package/dist/cli.js

@@ -6,7 +6,7 @@ import { createRequire } from "module";
 
 // src/commands/add.ts
 import { createInterface as createInterface2 } from "readline/promises";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -406,24 +406,204 @@ function appendProvenance(entry, skillsRoot) {
 }
 
 // src/commands/gatePipeline.ts
-import { readdirSync as readdirSync6 } from "fs";
-import { join as join10 } from "path";
+import { readdirSync as readdirSync7 } from "fs";
+import { join as join11 } from "path";
 
 // src/gate/profile.ts
 import { execFileSync } from "child_process";
 import {
   closeSync,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync4,
-  readdirSync as readdirSync2,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync3,
   readSync,
   rmSync as rmSync2,
-  statSync as statSync3
+  statSync as statSync4
 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename3, dirname as dirname2, extname, join as join6, resolve as resolve2 } from "path";
+import { basename as basename3, dirname as dirname2, extname as extname2, join as join7, resolve as resolve2 } from "path";
+
+// src/gate/mcpCapabilities.ts
+import { existsSync as existsSync7, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { extname, join as join6 } from "path";
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
+var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_ITEMS_PER_CATEGORY = 200;
+function* walkSourceFiles(dir) {
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = join6(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS2.has(entry.name)) continue;
+      yield* walkSourceFiles(full);
+    } else if (entry.isFile() && SOURCE_EXT.has(extname(entry.name))) {
+      yield full;
+    }
+  }
+}
+function readTextFileSafe(file) {
+  try {
+    if (statSync3(file).size > MAX_FILE_BYTES) return void 0;
+    return readFileSync4(file, "utf-8");
+  } catch {
+    return void 0;
+  }
+}
+function readJsonSafe(file) {
+  try {
+    return JSON.parse(readFileSync4(file, "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+var MCP_SDK_DEP = "@modelcontextprotocol/sdk";
+var MCP_KEYWORD = "mcp-server";
+var MCP_BIN_PREFIX = /^mcp-/i;
+function hasPackageJsonMcpMarkers(pkg2) {
+  for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+    const deps = pkg2[section];
+    if (deps && typeof deps === "object" && MCP_SDK_DEP in deps) return true;
+  }
+  const keywords = pkg2.keywords;
+  if (Array.isArray(keywords) && keywords.some((k) => k === MCP_KEYWORD)) return true;
+  const bin = pkg2.bin;
+  if (typeof bin === "string") {
+    if (MCP_BIN_PREFIX.test(bin.split("/").pop() ?? bin)) return true;
+  } else if (bin && typeof bin === "object") {
+    if (Object.keys(bin).some((k) => MCP_BIN_PREFIX.test(k))) return true;
+  }
+  if (pkg2.mcp && typeof pkg2.mcp === "object") return true;
+  return false;
+}
+function collectDeclaredFromManifest(node, buckets) {
+  if (Array.isArray(node)) {
+    for (const item of node) collectDeclaredFromManifest(item, buckets);
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+  const obj = node;
+  for (const [key, value] of Object.entries(obj)) {
+    if ((key === "tools" || key === "resources" || key === "prompts") && Array.isArray(value)) {
+      const target = buckets[key];
+      for (const item of value) {
+        if (typeof item === "string") {
+          target.add(item);
+        } else if (item && typeof item === "object") {
+          const name = item.name ?? item.uri;
+          if (typeof name === "string") target.add(name);
+        }
+      }
+    } else {
+      collectDeclaredFromManifest(value, buckets);
+    }
+  }
+}
+var REGISTRATION_CALL_RE = /\bserver\.(tool|registerTool|resource|prompt)\(\s*['"]([^'"]+)['"]/g;
+var REGISTRATION_METHOD_CATEGORY = {
+  tool: "tools",
+  registerTool: "tools",
+  resource: "resources",
+  prompt: "prompts"
+};
+function captureRegistrations(text, buckets) {
+  REGISTRATION_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = REGISTRATION_CALL_RE.exec(text)) !== null) {
+    buckets[REGISTRATION_METHOD_CATEGORY[m[1]]].add(m[2]);
+  }
+}
+var LIST_HANDLER_SCHEMAS = {
+  ListToolsRequestSchema: "tools",
+  ListResourcesRequestSchema: "resources",
+  ListPromptsRequestSchema: "prompts"
+};
+var SET_REQUEST_HANDLER_RE = /setRequestHandler\(\s*(ListToolsRequestSchema|ListResourcesRequestSchema|ListPromptsRequestSchema)\s*,/g;
+var NAME_OR_URI_FIELD_RE = /\b(?:name|uri)\s*:\s*['"]([^'"]+)['"]/g;
+function extractBalancedCall(text, openParenIndex) {
+  let depth = 0;
+  for (let i = openParenIndex; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "(") depth++;
+    else if (ch === ")") {
+      depth--;
+      if (depth === 0) return text.slice(openParenIndex, i + 1);
+    }
+  }
+  return text.slice(openParenIndex, Math.min(text.length, openParenIndex + 2e4));
+}
+function extractFromListHandlers(text, buckets) {
+  SET_REQUEST_HANDLER_RE.lastIndex = 0;
+  let m;
+  while ((m = SET_REQUEST_HANDLER_RE.exec(text)) !== null) {
+    const openParenIdx = text.indexOf("(", m.index);
+    if (openParenIdx === -1) continue;
+    const body = extractBalancedCall(text, openParenIdx);
+    const target = buckets[LIST_HANDLER_SCHEMAS[m[1]]];
+    NAME_OR_URI_FIELD_RE.lastIndex = 0;
+    let fieldMatch;
+    while ((fieldMatch = NAME_OR_URI_FIELD_RE.exec(body)) !== null) {
+      target.add(fieldMatch[1]);
+    }
+  }
+}
+var STDIO_TRANSPORT_RE = /StdioServerTransport/;
+var HTTP_TRANSPORT_RE = /StreamableHTTPServerTransport|SSEServerTransport|WebSocketServerTransport/;
+var MCP_SDK_IMPORT_RE = /@modelcontextprotocol\/sdk/;
+function extractMcpCapabilities(packageDir) {
+  const buckets = { tools: /* @__PURE__ */ new Set(), resources: /* @__PURE__ */ new Set(), prompts: /* @__PURE__ */ new Set() };
+  let hasPackageJsonMarker = false;
+  const pkgPath = join6(packageDir, "package.json");
+  if (existsSync7(pkgPath)) {
+    const pkg2 = readJsonSafe(pkgPath);
+    if (pkg2 && typeof pkg2 === "object" && !Array.isArray(pkg2)) {
+      hasPackageJsonMarker = hasPackageJsonMcpMarkers(pkg2);
+    }
+  }
+  for (const manifestName of [".mcp.json", "mcp.json"]) {
+    const manifestPath = join6(packageDir, manifestName);
+    if (!existsSync7(manifestPath)) continue;
+    const parsed = readJsonSafe(manifestPath);
+    if (parsed !== void 0) {
+      collectDeclaredFromManifest(parsed, buckets);
+    }
+  }
+  let sawStdioTransport = false;
+  let sawHttpTransport = false;
+  let sawMcpSdkImport = false;
+  for (const file of walkSourceFiles(packageDir)) {
+    const text = readTextFileSafe(file);
+    if (text === void 0) continue;
+    captureRegistrations(text, buckets);
+    extractFromListHandlers(text, buckets);
+    if (STDIO_TRANSPORT_RE.test(text)) sawStdioTransport = true;
+    if (HTTP_TRANSPORT_RE.test(text)) sawHttpTransport = true;
+    if (MCP_SDK_IMPORT_RE.test(text)) sawMcpSdkImport = true;
+  }
+  const transport = sawStdioTransport ? "stdio" : sawHttpTransport ? "http" : sawMcpSdkImport ? "unknown" : void 0;
+  const sortCap = (set) => Array.from(set).sort().slice(0, MAX_ITEMS_PER_CATEGORY);
+  const tools = sortCap(buckets.tools);
+  const resources = sortCap(buckets.resources);
+  const prompts = sortCap(buckets.prompts);
+  const hasExplicitSignal = tools.length > 0 || resources.length > 0 || prompts.length > 0;
+  const declaredConfidence = hasExplicitSignal ? "high" : hasPackageJsonMarker ? "partial" : "none";
+  return {
+    tools,
+    resources,
+    prompts,
+    transport,
+    declaredConfidence
+  };
+}
+
+// src/gate/profile.ts
 var SPDX_HINTS = {
   mit: "MIT (permissive)",
   apache: "Apache-2.0 (permissive)",
@@ -465,10 +645,10 @@ var PYTHON_STDLIB = /* @__PURE__ */ new Set([
 ]);
 function profileSkill(inputPath) {
   const p = resolve2(expandHome(inputPath));
-  if (!existsSync7(p)) {
+  if (!existsSync8(p)) {
     throw new Error(`path does not exist: ${p}`);
   }
-  const stat = statSync3(p);
+  const stat = statSync4(p);
   const kind = stat.isDirectory() ? classifyInput(p) : "skill";
   if (kind === "plugin") {
     return profilePlugin(p);
@@ -479,18 +659,18 @@ function profileSkill(inputPath) {
   return profileSkillDir(p);
 }
 function classifyInput(p) {
-  if (existsSync7(join6(p, ".claude-plugin", "plugin.json"))) return "plugin";
+  if (existsSync8(join7(p, ".claude-plugin", "plugin.json"))) return "plugin";
   if (detectArtifactType(p) === "mcp") return "mcp";
   return "skill";
 }
-var MCP_SDK_DEP = "@modelcontextprotocol/sdk";
-var MCP_KEYWORD = "mcp-server";
-var MCP_BIN_PREFIX = /^mcp-/i;
+var MCP_SDK_DEP2 = "@modelcontextprotocol/sdk";
+var MCP_KEYWORD2 = "mcp-server";
+var MCP_BIN_PREFIX2 = /^mcp-/i;
 function readPackageJsonSafe(root) {
-  const pkgPath = join6(root, "package.json");
-  if (!existsSync7(pkgPath)) return void 0;
+  const pkgPath = join7(root, "package.json");
+  if (!existsSync8(pkgPath)) return void 0;
   try {
-    return JSON.parse(readFileSync4(pkgPath, "utf-8"));
+    return JSON.parse(readFileSync5(pkgPath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -498,20 +678,20 @@ function readPackageJsonSafe(root) {
 function hasMcpPackageMarkers(pkg2) {
   for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
     const deps = pkg2[section];
-    if (deps && typeof deps === "object" && MCP_SDK_DEP in deps) return true;
+    if (deps && typeof deps === "object" && MCP_SDK_DEP2 in deps) return true;
   }
   const keywords = pkg2.keywords;
-  if (Array.isArray(keywords) && keywords.some((k) => k === MCP_KEYWORD)) return true;
+  if (Array.isArray(keywords) && keywords.some((k) => k === MCP_KEYWORD2)) return true;
   const bin = pkg2.bin;
   if (typeof bin === "string") {
-    if (MCP_BIN_PREFIX.test(basename3(bin))) return true;
+    if (MCP_BIN_PREFIX2.test(basename3(bin))) return true;
   } else if (bin && typeof bin === "object") {
-    if (Object.keys(bin).some((k) => MCP_BIN_PREFIX.test(k))) return true;
+    if (Object.keys(bin).some((k) => MCP_BIN_PREFIX2.test(k))) return true;
   }
   return false;
 }
 function detectArtifactType(root) {
-  if (existsSync7(join6(root, ".mcp.json")) || existsSync7(join6(root, "mcp.json"))) return "mcp";
+  if (existsSync8(join7(root, ".mcp.json")) || existsSync8(join7(root, "mcp.json"))) return "mcp";
   const pkg2 = readPackageJsonSafe(root);
   if (pkg2 && hasMcpPackageMarkers(pkg2)) return "mcp";
   return "skill";
@@ -519,19 +699,19 @@ function detectArtifactType(root) {
 function resolveSkillMd(inputPath) {
   let currentPath = inputPath;
   let tmpDir;
-  const initialStat = statSync3(currentPath);
-  if (extname(currentPath) === ".skill" || initialStat.isFile() && isZipFile(currentPath)) {
-    tmpDir = mkdtempSync(join6(tmpdir(), "forge_"));
+  const initialStat = statSync4(currentPath);
+  if (extname2(currentPath) === ".skill" || initialStat.isFile() && isZipFile(currentPath)) {
+    tmpDir = mkdtempSync(join7(tmpdir(), "forge_"));
     extractZip(currentPath, tmpDir);
     currentPath = tmpDir;
   }
-  const stat = statSync3(currentPath);
+  const stat = statSync4(currentPath);
   if (stat.isFile() && basename3(currentPath) === "SKILL.md") {
     return { skillMd: currentPath, root: dirname2(currentPath), tmpDir };
   }
   if (stat.isDirectory()) {
-    const direct = join6(currentPath, "SKILL.md");
-    if (existsSync7(direct)) {
+    const direct = join7(currentPath, "SKILL.md");
+    if (existsSync8(direct)) {
       return { skillMd: direct, root: currentPath, tmpDir };
     }
     const matches = findSkillMdOneLevelDown(currentPath);
@@ -554,18 +734,18 @@ function cleanupTmp(tmpDir) {
 }
 function findSkillMdOneLevelDown(dir) {
   const matches = /* @__PURE__ */ new Set();
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      const candidate = join6(dir, entry.name, "SKILL.md");
-      if (existsSync7(candidate)) matches.add(candidate);
+      const candidate = join7(dir, entry.name, "SKILL.md");
+      if (existsSync8(candidate)) matches.add(candidate);
     }
   }
-  const skillsDir = join6(dir, "skills");
+  const skillsDir = join7(dir, "skills");
   if (isDir(skillsDir)) {
-    for (const entry of readdirSync2(skillsDir, { withFileTypes: true })) {
+    for (const entry of readdirSync3(skillsDir, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        const candidate = join6(skillsDir, entry.name, "SKILL.md");
-        if (existsSync7(candidate)) matches.add(candidate);
+        const candidate = join7(skillsDir, entry.name, "SKILL.md");
+        if (existsSync8(candidate)) matches.add(candidate);
       }
     }
   }
@@ -648,9 +828,9 @@ function detectLicense(root, fm) {
   if (fm.license) return fm.license;
   const names = ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "license"];
   for (const name of names) {
-    const p = join6(root, name);
-    if (existsSync7(p) && statSync3(p).isFile()) {
-      const head = readFileSync4(p, "utf-8").slice(0, 2e3).toLowerCase();
+    const p = join7(root, name);
+    if (existsSync8(p) && statSync4(p).isFile()) {
+      const head = readFileSync5(p, "utf-8").slice(0, 2e3).toLowerCase();
       for (const [hint, label] of Object.entries(SPDX_HINTS)) {
         if (head.includes(hint)) return label;
       }
@@ -661,8 +841,8 @@ function detectLicense(root, fm) {
 }
 function walkFiles(dir) {
   const out = [];
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-    const full = join6(dir, entry.name);
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    const full = join7(dir, entry.name);
     if (entry.isDirectory()) {
       out.push(...walkFiles(full));
     } else if (entry.isFile()) {
@@ -674,7 +854,7 @@ function walkFiles(dir) {
 function countResources(root) {
   const resources = {};
   for (const d of RESOURCE_DIRS) {
-    const dp = join6(root, d);
+    const dp = join7(root, d);
     if (isDir(dp)) {
       resources[d] = walkFiles(dp).length;
     }
@@ -685,11 +865,11 @@ function scanMcpAndImports(text, root) {
   const mcpRefRe = /mcp__[a-zA-Z0-9_]+/g;
   const mcpRefs = new Set(text.match(mcpRefRe) ?? []);
   const imports = /* @__PURE__ */ new Set();
-  const scriptsDir = join6(root, "scripts");
+  const scriptsDir = join7(root, "scripts");
   if (isDir(scriptsDir)) {
     for (const f of walkFiles(scriptsDir)) {
       if (!f.endsWith(".py")) continue;
-      const ft = readFileSync4(f, "utf-8");
+      const ft = readFileSync5(f, "utf-8");
       for (const m2 of ft.match(mcpRefRe) ?? []) mcpRefs.add(m2);
       const importRe = /^\s*(?:import|from)\s+([a-zA-Z0-9_]+)/gm;
       let m;
@@ -706,7 +886,7 @@ function scanMcpAndImports(text, root) {
 function profileSkillDir(inputPath) {
   const { skillMd, root, tmpDir } = resolveSkillMd(inputPath);
   try {
-    const text = readFileSync4(skillMd, "utf-8");
+    const text = readFileSync5(skillMd, "utf-8");
     const fm = parseFrontmatter(text);
     const bodyLines = (text.match(/\n/g)?.length ?? 0) + 1;
     const headers = Array.from(text.matchAll(/^#{1,3}\s+(.+)$/gm)).map((m) => m[1]);
@@ -734,20 +914,20 @@ function profileSkillDir(inputPath) {
   }
 }
 function profilePlugin(p) {
-  const manifestPath = join6(p, ".claude-plugin", "plugin.json");
+  const manifestPath = join7(p, ".claude-plugin", "plugin.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync4(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse plugin.json under ${p}: ${err.message}`);
   }
-  const skillsDir = join6(p, "skills");
+  const skillsDir = join7(p, "skills");
   let skills = [];
   if (isDir(skillsDir)) {
-    skills = readdirSync2(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync7(join6(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
+    skills = readdirSync3(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync8(join7(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
   }
-  const commandsDir = join6(p, "commands");
-  const commands = isDir(commandsDir) ? readdirSync2(commandsDir).filter((f) => f.endsWith(".md")).length : 0;
+  const commandsDir = join7(p, "commands");
+  const commands = isDir(commandsDir) ? readdirSync3(commandsDir).filter((f) => f.endsWith(".md")).length : 0;
   const mc = manifest.mcpServers ?? manifest.mcp_servers ?? {};
   const mcpServers = typeof mc === "object" && mc !== null ? Object.keys(mc).sort() : [];
   return {
@@ -764,11 +944,11 @@ function profilePlugin(p) {
   };
 }
 function profileMcp(p) {
-  const explicitConfig = existsSync7(join6(p, ".mcp.json")) ? join6(p, ".mcp.json") : existsSync7(join6(p, "mcp.json")) ? join6(p, "mcp.json") : void 0;
+  const explicitConfig = existsSync8(join7(p, ".mcp.json")) ? join7(p, ".mcp.json") : existsSync8(join7(p, "mcp.json")) ? join7(p, "mcp.json") : void 0;
   if (explicitConfig) {
     let cfg;
     try {
-      cfg = JSON.parse(readFileSync4(explicitConfig, "utf-8"));
+      cfg = JSON.parse(readFileSync5(explicitConfig, "utf-8"));
     } catch (err) {
       throw new Error(`could not parse MCP config ${explicitConfig}: ${err.message}`);
     }
@@ -780,13 +960,14 @@ function profileMcp(p) {
       config: explicitConfig,
       servers: names,
       serverCount: names.length,
-      artifactType: "mcp"
+      artifactType: "mcp",
+      capabilities: extractMcpCapabilities(p)
     };
   }
-  const pkgPath = join6(p, "package.json");
+  const pkgPath = join7(p, "package.json");
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync4(pkgPath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync5(pkgPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse package.json ${pkgPath}: ${err.message}`);
   }
@@ -797,14 +978,15 @@ function profileMcp(p) {
     config: pkgPath,
     servers: [name],
     serverCount: 1,
-    artifactType: "mcp"
+    artifactType: "mcp",
+    capabilities: extractMcpCapabilities(p)
   };
 }
 
 // src/gate/safety.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync3, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { execFile } from "child_process";
-import { delimiter, extname as extname2, join as join7 } from "path";
+import { delimiter, extname as extname3, join as join8 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var BLOCK_SEVERITIES_BY_STRICTNESS = {
@@ -874,7 +1056,7 @@ var DENY_RULES = [
     message: "invokes sudo \u2014 review for unnecessary privilege escalation"
   }
 ];
-var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
+var SKIP_DIRS3 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
 var BINARY_EXT = /* @__PURE__ */ new Set([
   ".png",
   ".jpg",
@@ -896,18 +1078,18 @@ var BINARY_EXT = /* @__PURE__ */ new Set([
   ".bin",
   ".exe"
 ]);
-var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_FILE_BYTES2 = 2 * 1024 * 1024;
 function* walk(dir) {
   let entries;
   try {
-    entries = readdirSync3(dir, { withFileTypes: true });
+    entries = readdirSync4(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const full = join7(dir, entry.name);
+    const full = join8(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_DIRS2.has(entry.name)) continue;
+      if (SKIP_DIRS3.has(entry.name)) continue;
       yield* walk(full);
     } else if (entry.isFile()) {
       yield full;
@@ -915,10 +1097,10 @@ function* walk(dir) {
   }
 }
 function readTextFile(file) {
-  if (BINARY_EXT.has(extname2(file).toLowerCase())) return void 0;
+  if (BINARY_EXT.has(extname3(file).toLowerCase())) return void 0;
   try {
-    if (statSync4(file).size > MAX_FILE_BYTES) return void 0;
-    const content = readFileSync5(file, "utf-8");
+    if (statSync5(file).size > MAX_FILE_BYTES2) return void 0;
+    const content = readFileSync6(file, "utf-8");
     if (content.slice(0, 512).includes("\0")) return void 0;
     return content;
   } catch {
@@ -929,7 +1111,7 @@ function scanStaticRules(targetPath) {
   const findings = [];
   let root;
   try {
-    root = statSync4(targetPath);
+    root = statSync5(targetPath);
   } catch {
     return findings;
   }
@@ -959,9 +1141,9 @@ function which(cmd) {
   const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
   for (const dir of dirs) {
     for (const ext of exts) {
-      const candidate = join7(dir, cmd + ext);
+      const candidate = join8(dir, cmd + ext);
       try {
-        if (statSync4(candidate).isFile()) return candidate;
+        if (statSync5(candidate).isFile()) return candidate;
       } catch {
       }
     }
@@ -1005,8 +1187,8 @@ async function scanSafety(targetPath, strictness = DEFAULT_STRICTNESS) {
 }
 
 // src/gate/overlap.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "fs";
-import { basename as basename4, dirname as dirname3, join as join8, resolve as resolve3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync5 } from "fs";
+import { basename as basename4, dirname as dirname3, join as join9, resolve as resolve3 } from "path";
 var STOPWORDS = new Set(
   `
 a an the and or of to for in on with use used using when whether this that these those is are be
@@ -1027,7 +1209,7 @@ function splitLimited(text, sep, maxSplit) {
   return parts;
 }
 function readFrontmatter(skillMdPath) {
-  const text = readFileSync6(skillMdPath, "utf-8");
+  const text = readFileSync7(skillMdPath, "utf-8");
   const meta = { name: basename4(dirname3(skillMdPath)), description: "" };
   if (text.startsWith("---\n")) {
     const block = splitLimited(text, "---", 2)[1] ?? "";
@@ -1122,29 +1304,29 @@ function suggestVerbCode(topScore) {
   return verbTier(topScore).verb;
 }
 function listSubdirs(dir) {
-  if (!existsSync8(dir)) return [];
+  if (!existsSync9(dir)) return [];
   let entries;
   try {
-    entries = readdirSync4(dir, { withFileTypes: true });
+    entries = readdirSync5(dir, { withFileTypes: true });
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory()).map((e) => join8(dir, e.name));
+  return entries.filter((e) => e.isDirectory()).map((e) => join9(dir, e.name));
 }
 function findSkillMdFiles(root) {
   const found = /* @__PURE__ */ new Set();
   for (const dir of listSubdirs(root)) {
-    const candidate = join8(dir, "SKILL.md");
-    if (existsSync8(candidate)) found.add(resolve3(candidate));
+    const candidate = join9(dir, "SKILL.md");
+    if (existsSync9(candidate)) found.add(resolve3(candidate));
   }
-  for (const dir of listSubdirs(join8(root, "skills"))) {
-    const candidate = join8(dir, "SKILL.md");
-    if (existsSync8(candidate)) found.add(resolve3(candidate));
+  for (const dir of listSubdirs(join9(root, "skills"))) {
+    const candidate = join9(dir, "SKILL.md");
+    if (existsSync9(candidate)) found.add(resolve3(candidate));
   }
   for (const topDir of listSubdirs(root)) {
-    for (const dir of listSubdirs(join8(topDir, "skills"))) {
-      const candidate = join8(dir, "SKILL.md");
-      if (existsSync8(candidate)) found.add(resolve3(candidate));
+    for (const dir of listSubdirs(join9(topDir, "skills"))) {
+      const candidate = join9(dir, "SKILL.md");
+      if (existsSync9(candidate)) found.add(resolve3(candidate));
     }
   }
   return Array.from(found).filter((p) => !p.includes("/.git/")).sort();
@@ -1156,9 +1338,9 @@ function scanOverlap(candidatePath, skillsRoot) {
   }
   let cpath = resolve3(expandHome(candidatePath));
   if (isDir(cpath)) {
-    cpath = join8(cpath, "SKILL.md");
+    cpath = join9(cpath, "SKILL.md");
   }
-  if (!existsSync8(cpath)) {
+  if (!existsSync9(cpath)) {
     throw new Error(`candidate SKILL.md not found: ${cpath}`);
   }
   const cand = readFrontmatter(cpath);
@@ -1182,9 +1364,9 @@ function scanOverlap(candidatePath, skillsRoot) {
 }
 
 // src/gate/mcpSafety.ts
-import { readFileSync as readFileSync7, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
-import { basename as basename5, extname as extname3, join as join9 } from "path";
-var SKIP_DIRS3 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
+import { readFileSync as readFileSync8, readdirSync as readdirSync6, statSync as statSync6 } from "fs";
+import { basename as basename5, extname as extname4, join as join10 } from "path";
+var SKIP_DIRS4 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
 var BINARY_EXT2 = /* @__PURE__ */ new Set([
   ".png",
   ".jpg",
@@ -1206,18 +1388,18 @@ var BINARY_EXT2 = /* @__PURE__ */ new Set([
   ".bin",
   ".exe"
 ]);
-var MAX_FILE_BYTES2 = 2 * 1024 * 1024;
+var MAX_FILE_BYTES3 = 2 * 1024 * 1024;
 function* walk2(dir) {
   let entries;
   try {
-    entries = readdirSync5(dir, { withFileTypes: true });
+    entries = readdirSync6(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const full = join9(dir, entry.name);
+    const full = join10(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_DIRS3.has(entry.name)) continue;
+      if (SKIP_DIRS4.has(entry.name)) continue;
       yield* walk2(full);
     } else if (entry.isFile()) {
       yield full;
@@ -1225,10 +1407,10 @@ function* walk2(dir) {
   }
 }
 function readTextFile2(file) {
-  if (BINARY_EXT2.has(extname3(file).toLowerCase())) return void 0;
+  if (BINARY_EXT2.has(extname4(file).toLowerCase())) return void 0;
   try {
-    if (statSync5(file).size > MAX_FILE_BYTES2) return void 0;
-    const content = readFileSync7(file, "utf-8");
+    if (statSync6(file).size > MAX_FILE_BYTES3) return void 0;
+    const content = readFileSync8(file, "utf-8");
     if (content.slice(0, 512).includes("\0")) return void 0;
     return content;
   } catch {
@@ -1395,7 +1577,7 @@ function scanTextFile(file, content, allowCredentialCheck) {
 function scanFileForMcpFindings(file) {
   const content = readTextFile2(file);
   if (content === void 0) return [];
-  if (extname3(file).toLowerCase() === ".json") {
+  if (extname4(file).toLowerCase() === ".json") {
     const parsed = tryParseJson(content);
     if (parsed !== void 0) return scanJsonConfig(file, parsed);
   }
@@ -1404,7 +1586,7 @@ function scanFileForMcpFindings(file) {
 function scanMcpFindings(targetPath) {
   let root;
   try {
-    root = statSync5(targetPath);
+    root = statSync6(targetPath);
   } catch {
     return [];
   }
@@ -1434,14 +1616,14 @@ async function mcpScan(targetPath, strictness = DEFAULT_STRICTNESS) {
 }
 
 // src/gate/mcpOverlap.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve4 } from "path";
 function readTargetServers(targetPath) {
   const path = resolve4(expandHome(targetPath));
-  if (!existsSync9(path)) return [];
+  if (!existsSync10(path)) return [];
   let cfg;
   try {
-    cfg = JSON.parse(readFileSync8(path, "utf-8"));
+    cfg = JSON.parse(readFileSync9(path, "utf-8"));
   } catch {
     return [];
   }
@@ -1639,6 +1821,16 @@ function profileHeaderFields(profile) {
     license: profile.kind === "skill" ? profile.license : "UNKNOWN"
   };
 }
+function pluralize(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function renderCapabilitiesLine(profile) {
+  const { tools, resources, prompts, declaredConfidence } = profile.capabilities;
+  const counts = [pluralize(tools.length, "tool"), pluralize(resources.length, "resource"), pluralize(prompts.length, "prompt")].join(
+    ", "
+  );
+  return `${padLabel("Capabilities")}: ${counts} (declaredConfidence: ${declaredConfidence})`;
+}
 function renderReport(result) {
   const { profile, overlap, overlapLocked, safety, worthTaking, leaveBehind } = result;
   const { name, version, license } = profileHeaderFields(profile);
@@ -1651,6 +1843,7 @@ function renderReport(result) {
     `\u{1F528} Forge: ${name}  (v${version}, ${license})`,
     BORDER,
     `${padLabel("Artifact type")}: ${profile.artifactType}`,
+    ...profile.kind === "mcp" ? [renderCapabilitiesLine(profile)] : [],
     ...overlapLines,
     renderListField("What's worth taking", worthTaking, "(pending \u2014 not yet determined)"),
     renderListField("What to leave behind", leaveBehind, "(pending \u2014 not yet determined)"),
@@ -1715,10 +1908,10 @@ function resolveMcpCandidatePath(entry) {
   if (entry.packageDir) return entry.packageDir;
   let children = [];
   try {
-    children = readdirSync6(entry.quarantinePath, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    children = readdirSync7(entry.quarantinePath, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
   }
-  return children.length === 1 ? join10(entry.quarantinePath, children[0]) : entry.quarantinePath;
+  return children.length === 1 ? join11(entry.quarantinePath, children[0]) : entry.quarantinePath;
 }
 async function runGate(candidatePath, skillsRoot, {
   proFeatureLabel = "overlap analysis",
@@ -1749,17 +1942,17 @@ async function runGate(candidatePath, skillsRoot, {
 
 // src/queue.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
+import { join as join12 } from "path";
 function getQueuePath() {
-  return join11(getHomeDir(), "queue.json");
+  return join12(getHomeDir(), "queue.json");
 }
 function readQueue() {
   const path = getQueuePath();
-  if (!existsSync10(path)) {
+  if (!existsSync11(path)) {
     return { version: 1, entries: [] };
   }
-  const raw = readFileSync9(path, "utf-8");
+  const raw = readFileSync10(path, "utf-8");
   const parsed = JSON.parse(raw);
   return { version: 1, entries: parsed.entries ?? [] };
 }
@@ -1789,16 +1982,16 @@ function generateId(existingIds) {
 
 // src/handoff.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync11 } from "fs";
-import { dirname as dirname4, join as join12 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { dirname as dirname4, join as join13 } from "path";
 import { fileURLToPath } from "url";
 var KNOWN_AGENT_BINARIES = ["claude", "codex", "cursor-agent", "windsurf", "opencode", "gemini"];
 var HANDOFF_INSTRUCTION = "Read {prompt} and follow its instructions for the skill installed at {path}";
 function resolvePromptPath() {
   const here = dirname4(fileURLToPath(import.meta.url));
-  const builtCandidate = join12(here, "ingest-prompt.md");
-  if (existsSync11(builtCandidate)) return builtCandidate;
-  return join12(here, "..", "assets", "ingest-prompt.md");
+  const builtCandidate = join13(here, "ingest-prompt.md");
+  if (existsSync12(builtCandidate)) return builtCandidate;
+  return join13(here, "..", "assets", "ingest-prompt.md");
 }
 function defaultIsOnPath(bin) {
   const finder = process.platform === "win32" ? "where" : "which";
@@ -1853,17 +2046,17 @@ function runHandoff(config, installedPath, options = {}) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import { homedir as homedir4 } from "os";
 import { createInterface } from "readline/promises";
 
 // src/agents.ts
-import { statSync as statSync6 } from "fs";
+import { statSync as statSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join13, resolve as resolve5 } from "path";
+import { join as join14, resolve as resolve5 } from "path";
 function isFile(p) {
   try {
-    return statSync6(p).isFile();
+    return statSync7(p).isFile();
   } catch {
     return false;
   }
@@ -1874,7 +2067,7 @@ function projectPath(root, cwd) {
 function globalPath(root, home) {
   if (!root) return void 0;
   if (root === "~") return home;
-  if (root.startsWith("~/")) return join13(home, root.slice(2));
+  if (root.startsWith("~/")) return join14(home, root.slice(2));
   return root;
 }
 function makeAgent(spec) {
@@ -2261,7 +2454,7 @@ async function init(options = {}) {
 }
 async function maybeOfferInit(options = {}) {
   if (options.json || options.yes || !process.stdin.isTTY) return;
-  if (existsSync12(getConfigPath())) return;
+  if (existsSync13(getConfigPath())) return;
   console.log("[skill-forge] No config found \u2014 run `skill-forge init` to detect your agents and set gate targets.");
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   let answer = "";
@@ -2400,7 +2593,7 @@ async function addMcp(source, config, options) {
       envVars: detail.env ? Object.keys(detail.env) : void 0,
       candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
     };
-    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join14(process.cwd(), ".mcp.json");
+    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join15(process.cwd(), ".mcp.json");
     const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
     reject(entry);
     logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -2434,7 +2627,8 @@ async function addMcp(source, config, options) {
         suggestedVerb: overlap ? suggestVerbCode(overlap.nearestScore) : null
       },
       status: "pending",
-      artifactType: "mcp"
+      artifactType: "mcp",
+      capabilities: profile.capabilities
     });
     if (options.ingest && installedPath) {
       runHandoff(config, installedPath);
@@ -2513,7 +2707,7 @@ async function scan(source, options = {}) {
 }
 
 // src/commands/list.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function list() {
   await maybeOfferInit();
   const config = loadConfig();
@@ -2526,14 +2720,14 @@ async function list() {
   }
   console.log(`[skill-forge] ${ids.length} held in quarantine (${quarantineDir}):`);
   for (const id of ids) {
-    const skillDirs = findSkillDirs(join15(quarantineDir, id));
+    const skillDirs = findSkillDirs(join16(quarantineDir, id));
     if (skillDirs.length === 0) {
       console.log(`  ${id}  (no SKILL.md found)`);
       continue;
     }
     const names = skillDirs.map((dir) => {
       try {
-        return readFrontmatter(join15(dir, "SKILL.md")).name;
+        return readFrontmatter(join16(dir, "SKILL.md")).name;
       } catch {
         return dir;
       }