c1fa4f315e* docs: add skills-extension-candidates tracker Scaffold a candidates list for MCP servers, dev tools, SDKs, and skills repositories that could adopt SEP-2640. Initial entries: FastMCP 3.0 Skills, chrome-devtools-mcp, hf-mcp-server, Hugging Face skills library, github-mcp-server (PR #2428 demo), Azure Skills Plugin. Cross-link from related-work.md and add a row to the README docs table. * docs: add Issue/PR tracker column to candidates table * docs: add client-mcp-support survey alongside candidates tracker * docs: link Azure MCP Server source in candidates table * docs: remove gemini-cli from client MCP support survey * docs: verify hermes-agent, switch source refs to main-branch links, refresh takeaways - Promote hermes-agent from first-pass to verified; note its per-server tool pattern (`mcp_{server}_read_resource` + `mcp_{server}_list_resources`) and confirm end-user docs exist - Drop stale line numbers throughout; convert path refs to GitHub source-file links on `main` (commit-pinned URLs decayed once files moved) - Goose: PR #8989 has landed, so describe current `(extension_name, uri)` required signature and drop the now-closed issue/PR tracking - Takeaways: collapse to three implementation patterns (Goose now fits the `(server, uri)` bucket), fix open-source count to fourteen, drop the smolagents name-drop (not in survey), add strands-agents alongside mastra for the internal-SDK-only pattern, and reframe the signature recommendation around server-resolution reliability rather than URI portability * docs: verify remaining first-pass clients, flip cline/Roo-Code to Yes Verified adk-python, agent-framework, crewAI, mastra, cline, Roo-Code against local source clones. Two corrections to prior state: - cline and Roo-Code both expose access_mcp_resource(server, uri) as a model-facing tool via McpHub.readResource. Flipped from No to Yes. - adk-python's load_mcp_resource takes resource_names: array[string] in a single call (not two-shot); opt-in via use_mcp_resources flag. Headline count updated from six to eight of fourteen open-source clients satisfying #2527. Cross-cutting observations and takeaways adjusted for the new (server, uri) family members and the four-pattern signature breakdown. Trust-model list extended. * docs: add Figma and Adobe MCP as SEP-2640 testing candidates * docs: update FastMCP 3.0 Skills entry with detailed notes on SEP-2640 compliance * docs: drop unconfirmed Cursor SEP-2640 entry, track latest SEP-2640 wire-contract PRs Remove the Cursor row + deep dive (reported WIP never confirmed). Add the in-flight PRs realigning to the 2026-06-05/06-09 SEP-2640 schema (frontmatter + archives[] index, resources/directory/read): hf-mcp-server#174, fast-agent#825, huggingface/skills#172. * docs: add Slack (interested) and Bloomberg (internal use) as SEP-2640 candidates * docs: remove archived Roo-Code from client survey, update strands repo to harness-sdk * docs: re-verify SEP-2640 implementations against current upstream main Both reference implementations have migrated to the July 2026 v1 shape, verified against fresh clones rather than the prior June commit pins: - hf-mcp-server (d794b10, v0.4.6): skills/list + skills/get, per-file {uri,digest} resources manifest, directoryRead:true, no index.json or archives. Migrated in #219 (merged 2026-08-03). Also records the snapshot/TTL model and HTTP-transport-only constraint. - fast-agent (79b903c, 0.10.1): pins SEP-2640 revision d7490ec, treats legacy index.json skill-md/archive entries as unsupported. Requires --prerelease=allow (pins fastmcp-slim 4.0.0b1), per @evalstate. Corrects the earlier note claiming implementations lagged the SEP: the #174/#825/#172 round merged 2026-06-19 and was never in flight, and a second realignment followed the v1 rework. Also fixes drift found while re-checking fast-agent's resource tool: smart_agent.py is gone (now core/harness_tools.py), get_resource is opt-in via harness_tools (default False, was unconditional), and server_name is now optional - the one surveyed client where the model may omit server identity. Runtime skill loading is still unshipped; #816 remains open. 🦉 Generated with [Claude Code](https://claude.com/claude-code) * docs: track SEP revision 0eb05fe and add mcpkit to the candidates tracker The SEP moved from d7490ec to 0eb05fe (2026-08-05). The delta is editorial for the wire contract -- skills/list, skills/get, and the per-file resources manifest are unchanged -- so d7490ec-pinned implementations stay compatible. Records what it does change: a soft reg-name constraint on the first skill-path segment, the skill root URI fixed as skill://<skill-path> with no trailing slash, whether skills/get carries ttlMs/cacheScope reopened, and normative host obligations in the security section. Adds mcpkit (panyam/mcpkit, Go, v0.3.0) from #118 as a candidate. It implements the pre-v1 index.json catalog shape with per-file digests, so the ecosystem is now split across draft revisions rather than uniformly caught up. 🦉 Generated with [Claude Code](https://claude.com/claude-code) * docs: refine mcpkit entry — deliberate tracking, partial v1 migration Checked mcpkit's issues and PRs rather than inferring alignment from code shape. Its lag is a tracked decision, not drift: - #1185 (merged 2026-08-04) implements origin-tagging and per-origin resolve citing SEP L179/L183/L185 -- the host obligations 0eb05fe made normative -- so it is already on v1 for the security section. #1187 adds a SEP-2640 security/conformance harness as a WG demo. - #780 is an explicit index-schema tracking issue that has absorbed the archives removal and the resources:[{uri,digest}] direction but waits on WG confirmation; its conformance fork pins provenance at 556154c. - The carrier change is still unbooked: nothing references skills/list or skills/get. - Archives are kept as a non-spec extended surface rather than deleted, unlike fast-agent -- a counter-case for whether deferring a feature removes it from the ecosystem. Sharpens the callout accordingly: the draft split runs within an implementation, not only between them, so "which draft does X implement" often has no single answer. 🦉 Generated with [Claude Code](https://claude.com/claude-code)
24 lines
8.8 KiB
Markdown
24 lines
8.8 KiB
Markdown
# Skills Extension Candidates
|
||
|
||
A tracker of MCP servers, dev tools, SDKs, and skills repositories that are candidates for adopting the skills extension proposed in [SEP-2640](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640).
|
||
|
||
**Inclusion criterion.** An entry belongs here if it already ships skills in some non-MCP form (separate install path, plugin marketplace, framework-native provider), pairs an MCP server with a separate skills repo, or has an in-flight SEP-2640 implementation.
|
||
|
||
> ℹ️ **Implementations track the SEP by draft revision, and have realigned twice.** SEP-2640 was reworked into a v1 scope between July 8–15, 2026 (see the [2026-07-16 decision record](decisions.md)): archives removed, `skill://index.json` replaced by a `skills/list` method, the single per-entry digest replaced by a per-file `resources` manifest, `skills/get` added, and `resources/directory/read` made optional behind a `directoryRead` capability. As of **2026-08-04 the reference server and client have both caught up** — hf-mcp-server migrated in [#219](https://github.com/huggingface/hf-mcp-server/pull/219) (merged 2026-08-03) and fast-agent pins draft revision [`d7490ec`](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640/commits/d7490ecd1a250f7bc8c3ebb0d65450dfec274bad) — after an earlier realignment round on 2026-06-19 ([hf#174](https://github.com/huggingface/hf-mcp-server/pull/174), [fast-agent#825](https://github.com/evalstate/fast-agent/pull/825), [huggingface/skills#172](https://github.com/huggingface/skills/pull/172)). Both now reject the older `skill://index.json` + archive shape outright — while mcpkit (below) still serves the index-catalog shape, so **the ecosystem is split across draft revisions**. Note that the split runs *within* an implementation, not just between them: mcpkit is current on v1's normative security obligations while deliberately holding its index schema pending WG confirmation. Adoption tracks the SEP section by section, so "which draft does X implement" often has no single answer. Since the SEP is still a draft under review, treat any "implemented" claim here as *implements a pinned draft revision* and re-verify against the revision the SEP is at when you read this. The SEP has since moved to [`0eb05fe`](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/0eb05fe9fbd6b4c5e3fbe7e097028dd0b68a10cf/seps/2640-skills-extension.md) (2026-08-05); that delta is editorial for the wire contract — `skills/list`, `skills/get`, and the per-file `resources` manifest are unchanged — so `d7490ec`-pinned implementations remain compatible. It does add one soft constraint (the first `<skill-path>` segment SHOULD be a valid RFC 3986 `reg-name`, since it occupies the authority component), pins the skill root URI as `skill://<skill-path>` with no trailing slash, reopens whether `skills/get` should carry `ttlMs`/`cacheScope`, and makes the security section's host obligations normative rather than a recorded WG position.
|
||
|
||
> See also [**client-mcp-support.md**](client-mcp-support.md) for the matching client-side survey: which open-source MCP hosts already let the model load resources by URI (the prerequisite for any client to consume what these candidates would expose).
|
||
|
||
## Snapshot
|
||
|
||
| Server | Repo | Author / Org | Issue/PR tracker | Notes |
|
||
| :--- | :--- | :--- | :--- | :--- |
|
||
| FastMCP 3.0 Skills | [jlowin/fastmcp](https://github.com/jlowin/fastmcp) — [docs](https://gofastmcp.com/servers/providers/skills) | FastMCP | [#2694](https://github.com/jlowin/fastmcp/issues/2694) | Framework with its own native skills provider using MCP Resources; doesn't yet reflect SEP-2640 |
|
||
| chrome-devtools-mcp | [ChromeDevTools/chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Google (ChromeDevTools) | _none yet_ | Bundles a [`skills/`](https://github.com/ChromeDevTools/chrome-devtools-mcp/tree/main/skills) folder, but requires separate install — not served via MCP |
|
||
| hf-mcp-server | [huggingface/hf-mcp-server](https://github.com/huggingface/hf-mcp-server) | Hugging Face | [#219](https://github.com/huggingface/hf-mcp-server/pull/219), [#174](https://github.com/huggingface/hf-mcp-server/pull/174), [#164](https://github.com/huggingface/hf-mcp-server/pull/164) (all merged) | **SEP-2640 v1 implemented (server side).** Verified at [`d794b10`](https://github.com/huggingface/hf-mcp-server/commit/d794b10) (v0.4.6, 2026-08-03). Implements `skills/list`, `skills/get`, `resources/read`, and optional `resources/directory/read`; entries carry `uri` + verbatim `frontmatter` + a per-file `{uri, digest}` `resources` manifest ([`skill-types.ts`](https://github.com/huggingface/hf-mcp-server/blob/main/packages/app/src/server/skills/skill-types.ts), [`skill-resources.ts`](https://github.com/huggingface/hf-mcp-server/blob/main/packages/app/src/server/skills/skill-resources.ts)). Advertises `io.modelcontextprotocol/skills` with `directoryRead: true` plus `resources: { subscribe: false, listChanged: false }` ([`capability-utils.ts`](https://github.com/huggingface/hf-mcp-server/blob/main/packages/app/src/server/utils/capability-utils.ts)). No `skill://index.json`, no archives — both removed by [#219](https://github.com/huggingface/hf-mcp-server/pull/219) (merged 2026-08-03), which migrated from the 2026-06-05 shape that [#174](https://github.com/huggingface/hf-mcp-server/pull/174) had landed. Operational shape: skills come from a prebuilt snapshot (`HF_SKILLS_DIR`) with every digest verified before an atomic in-memory swap, a three-hour freshness TTL with stale-while-revalidate, and **HTTP transports only — skills are not served over long-lived STDIO**. First server we interoperated with end-to-end (against **fast-agent**, see [client-mcp-support.md](client-mcp-support.md)). #164 adds a client denylist (default `cursor-vscode`) after that client's `resources/subscribe` retry-loop flooded the server (~100k req/min). Distribution producer: [huggingface/skills#172](https://github.com/huggingface/skills/pull/172) |
|
||
| mcpkit (`ext/skills`) | [panyam/mcpkit](https://github.com/panyam/mcpkit) | Sri Panyam | [#780](https://github.com/panyam/mcpkit/issues/780) (open, index-schema tracking); [#1185](https://github.com/panyam/mcpkit/pull/1185), [#1187](https://github.com/panyam/mcpkit/pull/1187) (merged) | **Partially migrated, and tracking the SEP deliberately.** Go SDK covering both server and host: SKILL.md, `skill://` resources, progressive disclosure via a `skill://index.json` catalog + a host-side `load_skill` tool, per-supporting-file digests with verified reads, resource-fetch size and per-server byte budgets, and `resources/directory/read`; no code-execution surface (enforced by a build-failing test). Released in v0.3.0. **Already on v1 for the security section** — [#1185](https://github.com/panyam/mcpkit/pull/1185) (merged 2026-08-04) implements origin-tagging and per-origin resolve, citing SEP lines L179/L183/L185, i.e. the host obligations `0eb05fe` made normative; [#1187](https://github.com/panyam/mcpkit/pull/1187) adds a SEP-2640 security/conformance harness as a WG demo. **Deliberately holding on the index schema** — [#780](https://github.com/panyam/mcpkit/issues/780) is an explicit tracking vehicle (body rewritten 2026-07-14) that has already absorbed the archives removal and the `resources: [{uri, digest}]` direction, but is waiting on WG confirmation before refactoring; its conformance fork "deliberately holds provenance at pre-PR-97 commit `556154c`." Not yet absorbed: the carrier change — no issue or code references `skills/list`/`skills/get`, so the index-resource → method move is still unbooked. Also **resolved the archive deferral differently from fast-agent**: archives are retained as an explicitly non-spec "extended surface" rather than deleted, a useful counter-case for whether deferring a feature actually removes it from the ecosystem. The only Go implementation tracked, and the only one pairing a server and host in one SDK |
|
||
| github-mcp-server | [github/github-mcp-server](https://github.com/github/github-mcp-server) | GitHub | [#2428](https://github.com/github/github-mcp-server/pull/2428) (WIP demo, not for merge) | SEP-2640 demo branch |
|
||
| Azure Skills Plugin | [microsoft/azure-skills](https://github.com/microsoft/azure-skills) | Microsoft | _none yet_ | 25 Azure SKILL.md skills bundled with [Azure MCP Server](https://github.com/microsoft/mcp/tree/main/servers/Azure.Mcp.Server) + Foundry MCP; distributed as a plugin, not via MCP |
|
||
| Figma MCP | _TBD_ | Figma | _none yet_ | Contact: Discord `adityamuttur` — candidate for SEP-2640 testing |
|
||
| Adobe MCP | _TBD_ | Adobe | _none yet_ | Contact: Discord `justinmathew8592` — candidate for SEP-2640 testing |
|
||
| Slack | _TBD_ | Slack | _none yet_ | Expressed interest in SEP-2640 — candidate for testing |
|
||
| Bloomberg | _internal_ | Bloomberg | _none yet_ | Using skills-over-MCP internally; not public |
|