Skillsmith

Enterprise analytics dashboard: recommendation accuracy, skill usage trends, team-wide aggregation. Requires Enterprise tier (advanced_analytics feature).

Manage API keys for programmatic access. Keys are shown once on creation. Stored as SHA-256 hashes. Requires Enterprise tier (custom_integrations feature).

[Skillsmith — Maintain stage] Repair a corrupted or ambiguous ~/.skillsmith/manifest.json entry through a supported path — MUTATES the manifest (with a pre-mutation backup and a durable, revertible ledger entry). Use after skill_outdated reports 'identity-mismatch' or 'local-drift', or after skill_recover_source found low/no confidence. Actions: 'mark_local' (stop tracking this entry against the registry — writes source:'unknown' + provenance:'local'); 'relink' (assert an explicit, registry-validated id/source pair — requires BOTH; never infers an identity); 'drop_entry' (hard-remove an entry whose installPath no longer resolves); 'verify' (re-check on-disk content against the registry's current content hash for one entry or, by default, every entry — writes verifiedAt only on a match); 'revert' (durable, cross-session undo of a prior reconcile on ONE entry, by ledgerEntryId or by name — survives an unrelated skill install happening in between).

[Skillsmith — Maintain stage] Apply a rename suggestion from a prior local namespace-collision audit (`skill_inventory_audit`), or revert one already applied. MUTATES `~/.claude` (renames a skill/command/agent file) — but ONLY when `confirmed: true`. Without `confirmed`, returns a non-mutating preview ({ preview: true, before, after, applied: false, direction }) so the agent can show the change before committing. `action: 'apply'` uses the suggested name; `'custom'` uses `customName`; `'skip'` records a no-op; `'revert'` undoes a previously applied rename for the same auditId + collisionId — this is the durable, cross-session undo path (a fresh MCP server process, e.g. a new session, can still revert a rename applied by an earlier process, since the ledger persists to disk).

[Skillsmith — Maintain stage] Apply a recommended prose edit from a prior `skill_inventory_audit`. MUTATES `~/.claude` (rewrites a SKILL.md / CLAUDE.md snippet) — but ONLY when `confirmed: true`. Without `confirmed`, returns a non-mutating preview ({ preview: true, before, after, applied: false }). Gated on APPLY_TEMPLATE_REGISTRY: only registered when at least one apply-eligible template is enabled.

Export audit log events for a given time range. Requires Enterprise tier (audit_logging feature). Returns structured audit events in JSON format.

Query audit logs with filters (actor, resource, event type, result, date range). Requires Enterprise tier (audit_logging feature).

Generate compliance reports: SOC2 (markdown), CycloneDX (JSON SBOM), or raw JSON. Scoped to local skill inventory. Requires Team tier or higher (compliance_reports feature).

Configure SSO/SAML integration for your organization. Actions: set (store IdP config), test (connection test), remove (clear config), claim_domain (issue a DNS TXT verification token), verify_domain (check the TXT record). Requires Enterprise tier (sso_saml feature).

[Skillsmith — Evaluate stage] Fetch full details for a specific Skillsmith-registry skill by ID. Use when the user wants details/info/description of a known skill — e.g. 'what does microsoft/playwright-cli do?', 'show me details for getsentry/commit', 'describe the vercel-labs/vercel-react-best-practices skill'. Returns name, description, trust tier, quality score, dependencies, compatibility, repository URL, install count, and an `also_installed` array of co-installed skills. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

Index local skills from ~/.claude/skills/ directory. Returns count and details of indexed skills.

[Skillsmith — Install stage] Install an agent skill (SKILL.md format) from the Skillsmith registry or a GitHub repository to the local Claude Code skills directory (~/.claude/skills/) — or runtime-equivalent path when SKILLSMITH_CLIENT is set (cursor, copilot, windsurf). Use when the user asks to install/add/get a specific skill — e.g. 'install playwright-cli', 'add getsentry/commit', 'use Skillsmith to install the testing skill'. Performs Skillsmith security scan and content optimization (decomposition, subagent generation) before installation. Returns install path and Skillsmith optimization summary. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

[Skillsmith — Sync stage] Push this machine's installed-skill inventory to your Skillsmith account so it appears on the web dashboard. Read-only monitoring — no local skill files are modified. Requires `skillsmith login`; respects the local SKILLSMITH_INVENTORY_DISABLE flag and your account's server-side consent setting.

Manage skills in your private registry (list, get, install, deprecate, undeprecate, namespace, submissions, approve, reject). Requires Enterprise tier (private_registry feature). Published versions require a team admin to approve them via "approve" before other members can install them (see "submissions" to check status).

Publish a skill to your organization's private registry. Requires Enterprise tier (private_registry feature). Skills are scoped to your team's registry namespace and published versions are immutable. A published version is not installable by teammates until a team admin approves it — see private_registry_manage action "submissions" to check its status.

Mark a skill as private on this machine: hides it from local community-search results. This is a local-only setting today -- it does not sync or share the skill with your teammates. For a real shared team registry, see the Enterprise-tier private_registry_publish tool. Requires Team tier license.

Assign or revoke a team member's role, or list current members and their roles. Roles are fixed: admin or member (owner is managed separately and can never be changed here). Requires the team:manage_rbac permission and Enterprise tier (rbac feature).

Bulk-write or clear permission overrides: create expands resources x actions into "resource:action" permission grants for one role, delete clears them, list shows the overrides currently set. Valid expansions: registry:approve, registry:deprecate, team:manage_rbac, team:manage_sso. Requires the team:manage_rbac permission and Enterprise tier (rbac feature).

Inspect and configure team role permissions: list_roles, get_role, set_role_permission, reset_role_permission. Roles are fixed (owner, admin, member) — owners always hold every permission and cannot be narrowed. Configurable permissions: registry:approve, registry:deprecate, team:manage_rbac, team:manage_sso. Requires the team:manage_rbac permission and Enterprise tier (rbac feature).

[Skillsmith — Discover stage] Search the Skillsmith registry of agent skills (SKILL.md format) — curated, security-scanned, trust-scored skills indexed daily from GitHub. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime. Use this tool for ANY user request to find/search/discover/list skills — e.g. 'search for testing skills', 'find git workflow skills', 'show me devops skills with quality above 80'. Returns ranked installable skills with trust badges, NOT general programming guidance. Results are installable-only by default (pass installable_only:false to also include discovery-only entries that cannot be installed). Filters: query (required), category, trust_tier (verified/curated/community/experimental), min_score, max_risk, safe_only, installable_only, limit, compatibility (IDE/LLM). Matching is keyword-based, not semantic — use a short single-topic query; on empty results, check the response suggestion field for what to try next.

Add, remove, or list skills in a team workspace. Requires Team tier license.

Export audit events for SIEM ingestion (CloudWatch, Splunk, Datadog). Requires Enterprise tier (siem_export feature). SIEM destination is configured via environment variables, not tool arguments.

Check installed skills for known security advisories. Requires Team tier or higher (skill_security_audit feature). The advisory system is in early access — the Skillsmith team publishes advisories as security issues are identified. Run `skillsmith sync` to fetch the latest advisories.

[Skillsmith — Evaluate stage] Compare two Skillsmith-registry skills side-by-side. Use when the user wants to compare/contrast/decide-between two specific skills — e.g. 'compare getsentry/commit and microsoft/playwright-cli', 'which is better, X or Y', 'what's the difference between these two skills'. Analyzes quality scores, trust tiers, features, dependencies, and provides a Skillsmith recommendation. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

Show a section-level diff between two versions of an installed skill. Returns added, removed, and modified headings along with a change type (major/minor/patch) and update recommendation. Requires Individual tier or higher (version_tracking feature).

[Skillsmith — Maintain stage] Audit your installed AI coding clients' skill inventories (Claude Code, Cursor, Copilot, and every other Skillsmith-supported client) — plus Claude Code's own commands, agents, and CLAUDE.md trigger rules — for local namespace collisions. Returns rename + prose-edit suggestions keyed by a fresh `auditId`. Never modifies your skills, commands, agents, or CLAUDE.md — it only writes its own audit artifacts under `~/.skillsmith/audits/<auditId>/`. Feed the returned suggestions into `apply_namespace_rename` / `apply_recommended_edit`.

Check installed skills for available updates and dependency satisfaction status. Reads the local manifest, hashes each installed SKILL.md, and compares against the latest registry state. Community tier — no license required.

Audit a skill pack directory for (a) version drift — bundled SKILL.md versions vs. the Skillsmith registry cache — and (b) trigger-quality issues — generic trigger words in skill names/descriptions and generic pack namespaces that misfire Claude's skill-trigger heuristic (SMI-4124). Response is additive: new triggerQuality and namespaceQuality fields appear when check_trigger_quality is true (default); existing fields (skills, driftCount, etc.) are unchanged. Requires Individual tier or higher.

Prepare a skill for publishing. Validates the skill, generates a checksum, creates a publish manifest, and optionally checks for project-specific references. Can also create a GitHub repository for registry discovery.

[Skillsmith — Discover stage] Recommend skills from the Skillsmith registry based on the user's project context and currently installed skills, using semantic similarity. Use when the user asks for recommendations or 'what skills should I use' — e.g. 'recommend skills for my React project'. Auto-detects installed skills from ~/.claude/skills/ when not provided. Optional role-based filtering. Returns ranked Skillsmith candidates with description + security, NOT general programming advice. Narrate security per item: absent = never scanned (say so, imply neither safe nor unsafe); passed:null = scanned, no verdict yet; passed:true/false = real verdict — state it, and flag false or high riskScore explicitly rather than recommending install uncritically. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime. candidates_considered:0 does NOT mean a backend problem — check the response's suggestion field for next steps.

[Skillsmith — Maintain stage] Recover the canonical GitHub source of locally-installed skills (SMI-5407). Read-only — never mutates ~/.skillsmith/manifest.json. Returns { skills, summary } where each skill entry reports confidence (exact/high/medium/low), method, and the recovered source URL. Feed exact/high results into `sklx audit sources --apply` to backfill the manifest.

Re-scan installed skills with the latest security patterns. Detects issues like SSRF instructions, prompt injection, data exfiltration, and other threats that may not have been caught when the skill was originally installed. Run without arguments to scan all installed skills, or specify a skill name to scan one.

Proactively suggest relevant skills based on current context (files, commands, errors, project structure). Counts against your monthly API quota (Community: 100/mo — see www.skillsmith.app/pricing).

Check installed skills for available updates by comparing locally-recorded content hashes against the current registry state. Requires Individual tier or higher. Returns a list of skills with their installed vs. latest hash and whether an update is available.

[Skillsmith — Install stage] Validate a SKILL.md file or skill directory against the Skillsmith specification before installing or publishing. Use when the user wants to check/validate a skill's structure — e.g. 'validate my skill at ./my-skill', 'check if this skill is valid', 'use Skillsmith to validate this SKILL.md'. Checks YAML frontmatter, required fields, file structure, and security-pattern signatures. For end-to-end skill authoring including scaffolding/publishing, use the CLI `skillsmith author` commands. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

View current SSO/SAML configuration for your organization. Requires Enterprise tier (sso_saml feature).

View team usage analytics: per-user tool usage counts, top tools, and daily trend. Requires Team tier (usage_analytics feature).

Generate a weekly/monthly usage summary with period-over-period comparison. Requires Team tier (usage_analytics feature).

Manage team workspaces (create, list, get, delete). Requires Team tier license.

[Skillsmith — Maintain stage] Undo the most recent apply_namespace_rename / apply_recommended_edit changeset(s) made in THIS server session. Session-scoped: restarting the MCP server clears the undo history — for a namespace rename applied in a PRIOR session, use the durable, cross-session revert instead: apply_namespace_rename({ auditId, collisionId, action: 'revert' }) (SMI-5671). Restores from the apply tool's own pre-mutation backup and refuses (never throws) if the target was modified since the apply, the backup is missing, or the restore target falls outside the confined skill roots. Pass `count` to undo the N most-recent changesets (default 1), or `suggestion_id` to undo one specific changeset — mutually exclusive.

[Skillsmith — Retire stage] Uninstall an agent skill from the local Claude Code skills directory (~/.claude/skills/) or runtime-equivalent path. Use when the user asks to uninstall/remove/delete a specific skill — e.g. 'uninstall playwright-cli', 'remove getsentry/commit', 'use Skillsmith to delete the testing skill'. Optional `force` flag overrides protection on locally-modified skills. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

Comprehensive enterprise usage report with all metrics. Requires Enterprise tier (advanced_analytics feature).

Configure webhooks for skill lifecycle events (skill.install, skill.publish, etc.). Webhooks are signed with HMAC-SHA256. Requires Enterprise tier (custom_integrations feature).