skillmds 1.1.2 → 1.2.0

package/dist/mcp.js

@@ -0,0 +1,579 @@
+import {
+  AGENTS,
+  IntegrityError,
+  agentDir,
+  canonicalDir,
+  createClient,
+  detectAgents,
+  fetchBundle,
+  installSkill,
+  looksLikeProject,
+  resolvePackFiles,
+  safeText,
+  stripTerminalEscapes,
+  telemetryDisabled
+} from "./chunk-A7BKAUUO.js";
+
+// src/mcp/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { readFileSync } from "fs";
+
+// src/mcp/tools.ts
+import { lint as lint2, skillMdFor as skillMdFor2 } from "@skillmds/core";
+
+// src/mcp/schemas.ts
+var SKILL_ITEM = {
+  type: "object",
+  description: "A skill as listed in search and leaderboard results.",
+  properties: {
+    slug: { type: "string", description: "owner/name identifier, e.g. anthropic/pdf" },
+    title: { type: "string", description: "Human-readable skill title" },
+    description: { type: "string", description: "What the skill does and when an agent should use it" },
+    category: { type: ["string", "null"], description: "Category name" },
+    agents: { type: "array", items: { type: "string" }, description: "Agent ids the skill is published for" },
+    owner_handle: { type: "string", description: "Publisher handle" },
+    owner_name: { type: "string", description: "Publisher display name" },
+    license: { type: ["string", "null"], description: "SPDX license id when declared" },
+    repo_stars: { type: ["number", "null"], description: "GitHub stars of the source repository" },
+    ai_audit_verdict: {
+      type: ["string", "null"],
+      description: "Safety review verdict: pass, caution, warning, fail or inconclusive"
+    },
+    verdict: { type: ["string", "null"], description: "Safety verdict from the registry's audits" },
+    security_flags: {
+      type: "array",
+      items: { type: "string" },
+      description: "Capability flags: docs_only, network_calls, executes_scripts, reads_secrets, untrusted_install"
+    },
+    install_snippet: { type: "string", description: "One-line install command" },
+    install: { type: "object", additionalProperties: true, description: "Install snippets (cli, mcp)" }
+  },
+  // Only `slug` is guaranteed. Requiring title/description would make a client
+  // that validates structuredContent reject a sparse row the registry is
+  // entitled to return — and an agent can still act on a slug alone.
+  required: ["slug"],
+  additionalProperties: true
+};
+var ITEMS = {
+  type: "object",
+  properties: { items: { type: "array", items: SKILL_ITEM, description: "Matching skills, best first" } },
+  required: ["items"]
+};
+var LINT_RESULT = {
+  type: "object",
+  properties: {
+    ok: { type: "boolean", description: "True when there are no error-level diagnostics" },
+    score: { type: "integer", description: "Quality score 0-100" },
+    diagnostics: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "Rule id, e.g. SK011" },
+          severity: { type: "string", enum: ["error", "warn", "info"] },
+          message: { type: "string" },
+          line: { type: ["integer", "null"] }
+        },
+        required: ["id", "severity", "message"],
+        additionalProperties: true
+      }
+    },
+    security: { type: "object", additionalProperties: true, description: "Scanner findings and capability flags" }
+  },
+  required: ["ok", "score", "diagnostics"]
+};
+var INSTALL_RESULT = {
+  type: "object",
+  properties: {
+    installed: { type: "boolean", description: "Whether files were written" },
+    slug: { type: "string", description: "owner/name of the skill" },
+    scope: { type: "string", enum: ["project", "global"], description: "Which set of agent folders was written" },
+    canonical: { type: "string", description: "Absolute path of the canonical copy every target links to" },
+    targets: {
+      type: "array",
+      description: "Agent skill dirs the canonical copy was linked or copied into; empty when only the canonical copy was written",
+      items: {
+        type: "object",
+        properties: { agent: { type: "string" }, path: { type: "string" }, mode: { type: "string" } },
+        required: ["agent", "path", "mode"]
+      }
+    },
+    skipped: {
+      type: "array",
+      description: "Agents that were not written, with the reason",
+      items: {
+        type: "object",
+        properties: { agent: { type: "string" }, reason: { type: "string" } },
+        required: ["agent", "reason"]
+      }
+    },
+    files_written: { type: "integer", description: "Number of files written" },
+    security_flags: { type: "array", items: { type: "string" }, description: "Capability flags reported for the skill" },
+    note: { type: "string", description: "Caveats, e.g. when only SKILL.md could be written" }
+  },
+  required: ["installed", "slug", "scope", "canonical", "targets", "files_written"]
+};
+var OMIT_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "verified",
+  "avg_rating",
+  "rating_count",
+  "install_count",
+  "save_count",
+  "owner_avatar",
+  "confident",
+  "category_slug"
+]);
+
+// src/mcp/install.ts
+import { resolve } from "path";
+import { lint, skillMdFor } from "@skillmds/core";
+
+// src/mcp/types.ts
+var notice = (msg) => ({ isError: true, content: [{ type: "text", text: msg }] });
+function parseSlug(slug) {
+  const m = String(slug ?? "").match(/^([a-z0-9][a-z0-9-]*)\/([a-z0-9][a-z0-9-]*)$/i);
+  return m ? [m[1], m[2]] : null;
+}
+
+// src/mcp/install.ts
+function agentForDest(dest, scopeOpts) {
+  const target = resolve(dest);
+  for (const global of [false, true]) {
+    if (resolve(canonicalDir({ ...scopeOpts, global })) === target) return { agent: null, global };
+    for (const a of AGENTS) {
+      if (global && a.global === null) continue;
+      if (resolve(agentDir(a.id, { ...scopeOpts, global })) === target) return { agent: a.id, global };
+    }
+  }
+  return null;
+}
+function skillMdOf(files) {
+  const f = files.find((x) => x.path === "SKILL.md");
+  if (!f) return null;
+  return typeof f.contents === "string" ? f.contents : f.contents.toString("utf8");
+}
+async function installFromRegistry(args, ctx, deps = {}) {
+  const getBundle = deps.fetchBundle ?? fetchBundle;
+  const getPackFiles = deps.resolvePackFiles ?? resolvePackFiles;
+  const parsed = parseSlug(args.slug);
+  if (!parsed) return notice(`Refused: invalid slug "${String(args.slug)}" \u2014 expected owner/name.`);
+  const [owner, name] = parsed;
+  const base = { cwd: ctx.cwd, home: ctx.home, env: ctx.env };
+  let agents = Array.isArray(args.agents) ? args.agents.map(String) : void 0;
+  const dest = typeof args.dest === "string" && args.dest ? args.dest : void 0;
+  if (dest && agents) return notice("Refused: pass either `dest` or `agents`, not both. `dest` names one directory; prefer scope + agents.");
+  let global;
+  let canonicalOnly = false;
+  if (dest) {
+    const hit = agentForDest(dest, base);
+    if (!hit) {
+      return notice(
+        `Refused: dest "${dest}" is not a known agent skills directory. Use scope ("project"|"global") and agents instead; known roots: ${[...new Set(AGENTS.map((a) => a.project.join("/")))].join(", ")}.`
+      );
+    }
+    global = hit.global;
+    if (hit.agent === null) canonicalOnly = true;
+    else agents = [hit.agent];
+  } else if (args.scope === "project" || args.scope === "global") {
+    global = args.scope === "global";
+  } else {
+    global = !looksLikeProject(resolve(ctx.cwd ?? process.cwd()));
+  }
+  const scope = { ...base, global };
+  const detected = detectAgents(scope);
+  const targets = canonicalOnly ? [] : agents?.length ? agents : detected.length ? detected : ["claude-code"];
+  for (const a of targets) {
+    if (!AGENTS.some((x) => x.id === a)) return notice(`Unknown agent "${a}". Known: ${AGENTS.map((x) => x.id).join(", ")}`);
+  }
+  const skill = await ctx.api(`/api/skills/${owner}/${name}`);
+  const flags = skill.security_flags ?? [];
+  const deny = Array.isArray(args.deny) ? args.deny.map(String) : [];
+  const denied = flags.filter((f) => deny.includes(f));
+  if (denied.length) return notice(`Refused: ${owner}/${name} carries denied security flags: ${denied.join(", ")}. Not installed.`);
+  const raw = skillMdFor(skill);
+  const refuseLint = (content) => {
+    const result = lint(content, { slug: name });
+    if (result.ok) return null;
+    const errors = result.diagnostics.filter((d) => d.severity === "error");
+    return notice(`Refused: ${owner}/${name} failed validation (${errors.map((d) => `${d.id}: ${d.message}`).join("; ")}). Not installed.`);
+  };
+  const bad = refuseLint(raw);
+  if (bad) return bad;
+  let files = [{ path: "SKILL.md", contents: raw }];
+  let note = "";
+  if (skill.type === "pack") {
+    try {
+      const bundle = await getBundle(ctx.base, `${owner}/${name}`, ctx.token);
+      if (bundle?.length) {
+        files = bundle.some((f) => f.path === "SKILL.md") ? bundle : [...bundle, { path: "SKILL.md", contents: raw }];
+      } else {
+        const pack = await getPackFiles(skill);
+        if (pack) {
+          files = pack.files;
+          if (pack.pinMiss) note = "pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead";
+        } else note = "pack assets could not be fetched \u2014 only SKILL.md was written";
+      }
+    } catch (e) {
+      if (e instanceof IntegrityError) return notice(`Refused: ${owner}/${name} failed integrity verification \u2014 ${e.message}. Not installed.`);
+      note = `pack assets could not be fetched (${e instanceof Error ? e.message : String(e)}) \u2014 only SKILL.md was written`;
+    }
+  }
+  const written = skillMdOf(files);
+  if (written === null) files = [...files, { path: "SKILL.md", contents: raw }];
+  else if (written !== raw) {
+    const badWritten = refuseLint(written);
+    if (badWritten) return badWritten;
+  }
+  let r;
+  try {
+    r = await installSkill({
+      name,
+      files,
+      source: `registry:${owner}/${name}`,
+      commit_sha: skill.commit_sha ?? void 0,
+      scope,
+      agents: targets,
+      explicitAgents: canonicalOnly || Boolean(agents?.length),
+      mode: args.mode === "copy" ? "copy" : "link",
+      force: Boolean(args.force)
+    });
+  } catch (e) {
+    return notice(`Refused: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (!telemetryDisabled(ctx.env ?? process.env)) {
+    ctx.api(`/api/skills/${owner}/${name}/install`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ via: "mcp" })
+    }).catch(() => {
+    });
+  }
+  const summary = {
+    installed: true,
+    slug: `${owner}/${name}`,
+    scope: global ? "global" : "project",
+    canonical: r.canonical,
+    targets: r.targets,
+    skipped: r.skipped,
+    // installSkill writes the whole tree or throws, so every file in `files`
+    // reached disk — the count is the list's length, not a running tally.
+    files_written: files.length,
+    security_flags: flags,
+    ...note ? { note } : {}
+  };
+  const where = r.targets.length ? r.targets.map((t) => `${t.agent} \u2192 ${t.path} (${t.mode})`).join("; ") : `${r.canonical} (canonical only)`;
+  return {
+    content: [
+      {
+        type: "text",
+        text: `Installed ${owner}/${name} [${summary.scope}]: ${where}. ${files.length} file(s); security: ${flags.join(", ") || "unscanned"}.${note ? ` NOTE: ${note}` : ""}`
+      }
+    ],
+    structuredContent: summary
+  };
+}
+
+// src/mcp/tools.ts
+var TOOLS = [
+  {
+    name: "skillmd_search",
+    title: "Search skills",
+    description: "Search the SkillMD registry of Agent Skills (SKILL.md files) by task, name or keywords. Returns matching skills with their owner/name slug, description, category, safety verdict and install snippet, best match first.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Natural-language query or keywords describing the task or skill" },
+        category: { type: "string", description: "Restrict to one category slug, e.g. coding, devops, data, security" },
+        verified_only: { type: "boolean", description: "Return only skills from verified publishers (default false)" },
+        type: { type: "string", enum: ["single", "pack"], description: "Restrict to single-file skills or multi-file packs" },
+        min_rating: { type: "number", minimum: 0, maximum: 5, description: "Minimum average rating, 0 to 5" },
+        limit: { type: "integer", minimum: 1, maximum: 100, description: "Maximum number of results (default 20)" }
+      },
+      required: ["query"],
+      additionalProperties: false
+    },
+    outputSchema: ITEMS,
+    annotations: { title: "Search skills", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  {
+    name: "skillmd_get",
+    title: "Get skill details",
+    description: "Fetch one skill by owner/name slug, including its SKILL.md body, provenance (source repo and pinned commit), license, safety verdict and capability flags.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        slug: { type: "string", pattern: "^[^/]+/[^/]+$", description: "Skill identifier as owner/name, e.g. anthropic/pdf" }
+      },
+      required: ["slug"],
+      additionalProperties: false
+    },
+    outputSchema: {
+      type: "object",
+      description: "Full skill record.",
+      properties: {
+        slug: { type: "string", description: "owner/name identifier, e.g. anthropic/pdf" },
+        title: { type: "string", description: "Human-readable skill title" },
+        description: { type: "string", description: "What the skill does and when an agent should use it" },
+        category: { type: "string", description: "Category name" },
+        category_slug: { type: "string", description: "Category slug, as used by search and trending filters" },
+        owner_handle: { type: "string", description: "Publisher handle" },
+        owner_name: { type: "string", description: "Publisher display name" },
+        license: { type: ["string", "null"], description: "SPDX license id when declared" },
+        security_flags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Capability flags: docs_only, network_calls, executes_scripts, reads_secrets, untrusted_install"
+        },
+        ai_audit_verdict: { type: ["string", "null"], description: "Safety review verdict: pass, caution, warning, fail or inconclusive" },
+        repo_stars: { type: ["number", "null"], description: "GitHub stars of the source repository" },
+        install_snippet: { type: "string", description: "One-line install command" },
+        type: { type: "string", enum: ["single", "pack"], description: "single SKILL.md or a multi-file pack" },
+        body_md: { type: "string", description: "Markdown body of SKILL.md" },
+        raw_md: { type: ["string", "null"], description: "Verbatim SKILL.md including frontmatter when stored" },
+        verified: { type: "boolean", description: "Published by a verified publisher" },
+        source_repo: { type: ["string", "null"], description: "Upstream repository" },
+        commit_sha: { type: ["string", "null"], description: "Pinned upstream commit" },
+        files: { type: "array", description: "Companion files for packs", items: { type: "object", additionalProperties: true } },
+        tags: { type: "array", items: { type: "object", additionalProperties: true }, description: "Registry tags" },
+        categories: { type: "array", items: { type: "object", additionalProperties: true }, description: "Every category the skill belongs to" }
+      },
+      required: ["slug", "title", "description"],
+      additionalProperties: true
+    },
+    annotations: { title: "Get skill details", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  {
+    name: "skillmd_install",
+    title: "Install skill",
+    description: "Install a skill by owner/name slug: validates it, then writes one canonical copy (.agents/skills/<name>) and links it into the chosen agents' skill directories. Never executes scripts. The response reports the skill's capability flags (docs_only, network_calls, executes_scripts, reads_secrets) as information.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        slug: { type: "string", pattern: "^[^/]+/[^/]+$", description: "Skill identifier as owner/name, e.g. anthropic/pdf" },
+        scope: {
+          type: "string",
+          enum: ["project", "global"],
+          description: "project = the current directory's agent folders (default when the cwd looks like a project); global = the user's home-level agent folders"
+        },
+        agents: {
+          type: "array",
+          items: { type: "string" },
+          description: "Agent ids to link the skill into (default: every agent detected on this machine)"
+        },
+        mode: { type: "string", enum: ["link", "copy"], description: "link (junction/symlink to the canonical copy, default) or copy" },
+        force: { type: "boolean", description: "Replace a skill installed from a different source or an untracked directory" },
+        deny: { type: "array", items: { type: "string" }, description: "Refuse the skill if it carries any of these security flags" },
+        dest: {
+          type: "string",
+          description: "Deprecated: an explicit agent skills directory. Must be a known agent skills dir; prefer scope + agents."
+        }
+      },
+      required: ["slug"],
+      additionalProperties: false
+    },
+    outputSchema: INSTALL_RESULT,
+    annotations: { title: "Install skill", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  {
+    name: "skillmd_trending",
+    title: "Trending skills",
+    description: "Top skills on the SkillMD leaderboard, ranked by installs, saves and ratings, optionally within one category and time window.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        range: { type: "string", enum: ["30d", "all"], description: "Ranking window: last 30 days or all time (default all)" },
+        category: { type: "string", description: "Restrict to one category slug, e.g. coding, devops, data, security" },
+        limit: { type: "integer", minimum: 1, maximum: 100, description: "Maximum number of results (default 20)" }
+      },
+      additionalProperties: false
+    },
+    outputSchema: ITEMS,
+    annotations: { title: "Trending skills", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  {
+    name: "skillmd_recommend",
+    title: "Recommend skills",
+    description: "Recommend skills. With based_on set to a skill's owner/name slug, returns the top skills in that skill's category (excluding itself); without it, returns what is trending over the last 30 days.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        based_on: { type: "string", pattern: "^[^/]+/[^/]+$", description: "Skill slug (owner/name) to base recommendations on" },
+        limit: { type: "integer", minimum: 1, maximum: 100, description: "Maximum number of results (default 10)" }
+      },
+      additionalProperties: false
+    },
+    outputSchema: ITEMS,
+    annotations: { title: "Recommend skills", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  {
+    name: "skillmd_list_saved",
+    title: "List saved skills",
+    description: "List the signed-in user's saved skills. Requires the SKILLMD_TOKEN environment variable (a SkillMD personal access token).",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    outputSchema: ITEMS,
+    annotations: { title: "List saved skills", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  },
+  {
+    name: "skillmd_lint",
+    title: "Lint a SKILL.md",
+    description: "Validate a SKILL.md against the SkillMD format and return diagnostics, capability flags and a 0-100 quality score. Pass raw SKILL.md content, or a registry slug (owner/name) to fetch and lint that skill.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        content: { type: "string", description: "Raw SKILL.md text to validate (frontmatter plus body)" },
+        slug: {
+          type: "string",
+          pattern: "^[^/]+/[^/]+$",
+          description: "Registry skill (owner/name) to fetch and validate instead of content"
+        }
+      },
+      additionalProperties: false
+    },
+    outputSchema: LINT_RESULT,
+    annotations: { title: "Lint a SKILL.md", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  }
+];
+var text = (obj) => {
+  if (typeof obj === "string") return { content: [{ type: "text", text: obj }] };
+  const structured = Array.isArray(obj) ? { items: obj } : obj;
+  return { content: [{ type: "text", text: JSON.stringify(structured, null, 2) }], structuredContent: structured };
+};
+var clean = (items) => (items ?? []).map(
+  (s) => Object.fromEntries(
+    Object.entries(s).filter(([k]) => !OMIT_FIELDS.has(k)).map(([k, v]) => [k, typeof v === "string" ? safeText(v, 2e3) : v])
+  )
+);
+var VERBATIM_FIELDS = /* @__PURE__ */ new Set(["body_md", "raw_md"]);
+var sanitizeRecord = (skill) => Object.fromEntries(
+  Object.entries(skill).map(([k, v]) => {
+    if (typeof v !== "string") return [k, v];
+    return [k, VERBATIM_FIELDS.has(k) ? stripTerminalEscapes(v) : safeText(v, 2e3)];
+  })
+);
+async function handleCall(name, args, ctx) {
+  try {
+    switch (name) {
+      case "skillmd_search": {
+        const p = new URLSearchParams({ q: String(args.query ?? ""), limit: String(args.limit ?? 20) });
+        if (args.category) p.set("category", String(args.category));
+        if (args.verified_only) p.set("verified", "true");
+        if (args.type) p.set("type", String(args.type));
+        if (args.min_rating != null) p.set("min_rating", String(args.min_rating));
+        const r = await ctx.api(`/api/search?${p}`);
+        return text(clean(r.items));
+      }
+      case "skillmd_get": {
+        const s = parseSlug(args.slug);
+        if (!s) return notice("Provide `slug` as owner/name.");
+        const skill = await ctx.api(`/api/skills/${s[0]}/${s[1]}`);
+        return text(sanitizeRecord(skill));
+      }
+      case "skillmd_trending": {
+        const p = new URLSearchParams({ range: String(args.range ?? "all"), limit: String(args.limit ?? 20) });
+        if (args.category) p.set("category", String(args.category));
+        const r = await ctx.api(`/api/leaderboard?${p}`);
+        return text(clean(r.items));
+      }
+      case "skillmd_recommend": {
+        const limit = Number(args.limit ?? 10);
+        const s = parseSlug(args.based_on);
+        if (s) {
+          const base = await ctx.api(`/api/skills/${s[0]}/${s[1]}`).catch(() => null);
+          if (base?.category_slug) {
+            const r2 = await ctx.api(
+              `/api/leaderboard?range=all&limit=${limit}&category=${encodeURIComponent(base.category_slug)}`
+            );
+            return text(clean(r2.items).filter((x) => x.slug !== args.based_on));
+          }
+        }
+        const r = await ctx.api(`/api/leaderboard?range=30d&limit=${limit}`);
+        return text(clean(r.items));
+      }
+      case "skillmd_list_saved": {
+        if (!ctx.hasToken) return notice("Set SKILLMD_TOKEN (a SkillMD personal access token) to list your saved skills.");
+        const r = await ctx.api(`/api/favorites`);
+        return text(clean(r.items));
+      }
+      case "skillmd_lint": {
+        let raw = typeof args.content === "string" ? args.content : void 0;
+        let slug;
+        let verified = false;
+        if (!raw && args.slug) {
+          const s = parseSlug(args.slug);
+          if (!s) return notice("Provide `slug` as owner/name.");
+          const skill = await ctx.api(`/api/skills/${s[0]}/${s[1]}`);
+          raw = skillMdFor2(skill);
+          slug = s[1];
+          verified = Boolean(skill.verified);
+        }
+        if (!raw) return notice("Provide `content` (raw SKILL.md) or `slug` (owner/name).");
+        const result = lint2(raw, { ...slug ? { slug } : {}, verified });
+        return text({ ok: result.ok, score: result.score, diagnostics: result.diagnostics, security: result.security });
+      }
+      case "skillmd_install":
+        return await installFromRegistry(args, ctx);
+      default:
+        return notice(`Unknown tool: ${name}`);
+    }
+  } catch (e) {
+    return notice(e instanceof Error ? e.message : String(e));
+  }
+}
+
+// src/mcp/server.ts
+var VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return "0.0.0";
+  }
+})();
+function buildContext() {
+  try {
+    const c = createClient({});
+    return { api: c.api, hasToken: c.hasToken, base: c.base, token: c.token, cwd: process.cwd(), home: void 0, env: process.env };
+  } catch (e) {
+    const why = e instanceof Error ? e.message : String(e);
+    const unavailable = async () => {
+      throw new Error(`SkillMD client unavailable: ${why}`);
+    };
+    return { api: unavailable, hasToken: false, base: "", cwd: process.cwd(), home: void 0, env: process.env };
+  }
+}
+async function startMcpServer() {
+  const server = new Server(
+    {
+      name: "skillmd",
+      version: VERSION,
+      title: "SkillMD",
+      description: "The open registry of Agent Skills: search, inspect, lint and install 25,000+ linted, security-reviewed SKILL.md files for Claude Code, Cursor, Codex and 60+ other agents.",
+      websiteUrl: "https://skillmd.com",
+      icons: [
+        { src: "https://skillmd.com/favicon.png", mimeType: "image/png", sizes: ["512x512"] },
+        { src: "https://skillmd.com/favicon.svg", mimeType: "image/svg+xml", sizes: ["any"] }
+      ]
+    },
+    {
+      capabilities: { tools: {} },
+      instructions: "SkillMD is a registry of Agent Skills (SKILL.md files). Use skillmd_search to find skills for a task, skillmd_get to inspect one (safety verdict, capability flags, provenance), skillmd_install to write it into the agent's skills directory, and skillmd_lint to validate your own SKILL.md. skillmd_trending and skillmd_recommend surface popular and related skills. Only skillmd_install writes files; it never executes scripts. skillmd_install writes one canonical copy (.agents/skills/<name>) and links it into the chosen agents' skill dirs; pass scope (project|global) and agents to choose where."
+    }
+  );
+  const ctx = buildContext();
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+  server.setRequestHandler(
+    CallToolRequestSchema,
+    async (req) => await handleCall(req.params.name, req.params.arguments ?? {}, ctx)
+  );
+  await server.connect(new StdioServerTransport());
+  console.error("skillmd MCP server running (stdio)");
+}
+
+// src/mcp/index.ts
+if (process.argv.length > 2 || process.stdin.isTTY) {
+  await import("./cli.js");
+} else {
+  await startMcpServer();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",
@@ -60,8 +60,7 @@
     "@skillmds/core": "^1.0.0",
     "commander": "^12.1.0",
     "giget": "^3.3.0",
-    "picocolors": "^1.1.0",
-    "yaml": "^2.6.1"
+    "picocolors": "^1.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",