- MDX 96.1%
- TypeScript 3.9%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
64db7eaf72* docs: add threat model for skills over MCP (SEP-2640) Add docs/threat-model.md covering the delivery and host-handling layer for skills served over MCP. Recommends the install (materialize to a host-private, immutable store) path as the baseline over load-on-demand, enumerates non-archive threats (T1-T7) with a full per-fixture mapping to the dangerous-skills-mcp corpus and to SEP-2640 clauses, folds in the mcpkit reference-implementation findings, and keeps the archive threat model as an appendix (archives are slated for removal from this version). Index the new doc in the README repository-contents table. 🦉 Generated with Claude Code * docs: refine threat model by removing out-of-scope content and clarifying core boundaries * docs: reconcile threat model with current SEP-2640 revision Update the threat model to track the canonical sep/skills-extension revision instead of the stale local working draft, and address review feedback on PR #108. - Retire skill://index.json terminology in favor of skills/list + skills/get and the per-file `resources` digest set. - Mark the B1 supporting-file-digest gap closed: `resources` now enumerates every file with a digest and unlisted reads are verification failures. Flip adv-supporting-file-digest-swap status. - Reframe archives as a deferred feature (SEP Appendix: Deferred Features); mark archive fixtures Deferred and `refunds` Resolved (skills are keyed by uri, not name). - Add T8 cross-origin name-collision impersonation, T9 nested-skill consent, and a directory-walk subtree-escape row under T5, each flagged as not yet exercised by the corpus. - Add a Scope note on skill-catalog metadata confidentiality. - Add the missing "Residual gaps and future directions" section (previously referenced but absent), covering the unsigned-digest trust-anchor gap and the third-party attestation direction. 🦉 Generated with [Claude Code](https://claude.com/claude-code) * docs: add discovery-surface grounding and enumeration-exhaustion threat - Add a "Protocol surface" paragraph to the system model naming skills/list, skills/get, and resources/directory/read and what each exposes, so threats can reference them against a stated baseline. - Add enumeration/pagination exhaustion to T6: a server returning an unbounded skills/list or resources/directory/read stream via an endless nextCursor exhausts the host at discovery time, before any file is fetched. SEP bounds neither page nor entry count; flagged as no corpus fixture yet. Reflected in the fixture map and residual gaps. 🦉 Generated with [Claude Code](https://claude.com/claude-code) * docs: copy-edit threat model to reduce em-dash and antithesis density Style-only pass over prose I wrote. No change to any technical claim, normative keyword, fixture reference, or table. Thins the em-dash habit (convert appositive/dramatic dashes to periods, commas, or parens) and de-duplicates the "X, not Y" closer, keeping only the load-bearing contrasts. Definition-list and reference-list dashes left as-is. 🦉 Generated with [Claude Code](https://claude.com/claude-code) |
||
| .github | ||
| docs | ||
| .gitignore | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| README.md | ||
Skills Over MCP Working Group
⚠️ Experimental — This repository is an incubation space for the Skills Over MCP Working Group. Contents are exploratory and do not represent official MCP specifications or recommendations.
Charter: modelcontextprotocol.io/community/skills-over-mcp/charter — mission, scope, membership, active work items, and success criteria. Project board: Skills Over MCP WG Meeting notes: Skills Over MCP WG discussions Discord: #skills-over-mcp-wg Open work: Pull requests — proposals, decisions, implementations, and other in-flight contributions welcome.
Why Skills Over MCP?
MCP servers give agents tools, but tools alone are insufficient for complex workflows — tool descriptions tell an agent what a tool does, not how to orchestrate multiple tools to achieve a goal. Skills bridge this gap. They are structured "how-to" knowledge: multi-step workflows, conditional logic, and orchestration instructions that can run to hundreds of lines.
Skills are context, and MCP is a context protocol. Agents already connect to remote services over MCP to get tools — they can get the know-how to use those tools through the same channel. A remote MCP server can serve both its tools and the instructions for using them together, as a single atomic unit. This also enables automatic discovery (connect to a server, find its skills), dynamic updates (server-side changes flow without reinstall), multi-server composition (skills orchestrating tools across servers), and enterprise distribution (RBAC, multi-tenant, version-adaptive content) — all through infrastructure MCP servers already provide.
See why-and-when.md for the full value proposition and a guide for when MCP distribution applies vs. simpler alternatives. For an accessible external framing of the premise, see Angie Jones's "Skills Over MCP" (Agentic AI Foundation) — "ship the manual with the product."
Problem Statement
Native "skills" support in host applications demonstrates demand for rich workflow instructions, but there's no convention for exposing equivalent functionality through MCP primitives. Current limitations include:
- Server instructions load only at initialization — new or updated skills require re-initializing the server
- Complex workflows exceed practical instruction size — some skills require hundreds of lines of markdown with references to bundled files
- No discovery mechanism — users installing MCP servers don't know if there's a corresponding skill they should also install
- Multi-server orchestration — skills may need to coordinate tools from multiple servers
See problem-statement.md for full details.
Repository Contents
| Document | Description |
|---|---|
| Problem Statement | Current limitations and gaps |
| Why Skills Over MCP? | Value proposition and decision guide |
| Use Cases | Key use cases driving this work |
| Approaches | Approaches being explored (not mutually exclusive) |
| SEP-2640: Skills Extension | Proposal to serve skills over MCP via the Resources primitive. Original working draft: docs/sep-draft-skills-extension.md. Comments and review happen on the PR. |
| Open Questions | Unresolved questions with community input (see also issues and meeting notes) |
| Experimental Findings | Results from implementations and testing |
| Related Work | SEPs, implementations, and external resources |
| Threat Model | Threat model for skills served over MCP (SEP-2640), with delivery-model recommendations and an archive appendix |
| Decision Log | Record of key decisions with context and rationale |
Contributing
See CONTRIBUTING.md for how to participate.