skillsmp-mcp-lite

SkillsMP MCP Server (Lite)

A lightweight MCP server that enables AI assistants to search and read skills from the SkillsMP marketplace.

Features

• Keyword Search — find skills by short keywords (e.g. "PDF", "web scraper")
• AI Semantic Search — find skills with natural language, powered by Cloudflare AI
• Read Skill — fetch skill content from GitHub via REST API (no git clone, no local files)
• Security Scanning — automatic Cisco Skill Scanner analysis via in-memory ZIP upload (zero disk writes)

Prerequisites

| Requirement | Purpose | Required | |---|---|---| | Node.js ≥ 20 | Runtime | Yes | | SkillsMP API Key | Authentication | Yes | | uv (provides uvx) | Security scanning | No |

The server will exit if SKILLSMP_API_KEY is not set.

Quick Setup

Auto-Configuration

Run a single command to automatically detect your MCP client and write the config:

npx -y skillsmp-mcp-lite --setup

This detects which clients are installed (VS Code, Cursor, Claude Desktop, Claude Code) and adds the skillsmp server entry to each config file. For VS Code it also adds a secure input prompt for your API key.

To configure only a specific client, set the SKILLSMP_MCP_CLIENT environment variable:

# Windows (PowerShell)
$env:SKILLSMP_MCP_CLIENT="cursor"; npx -y skillsmp-mcp-lite --setup

# macOS / Linux
SKILLSMP_MCP_CLIENT=cursor npx -y skillsmp-mcp-lite --setup

Supported values: vscode, cursor, claude-desktop, claude-code, all.

If a client already has a skillsmp entry, it is skipped — running --setup multiple times is safe.

Manual Configuration

All clients run the same command — only the config file location and JSON key differ.

Server definition (shared across all clients):

"skillsmp": {
  "command": "npx",
  "args": ["-y", "skillsmp-mcp-lite"],
  "env": {
    "SKILLSMP_API_KEY": "YOUR_API_KEY"
  }
}

VS Code / GitHub Copilot

Open Ctrl+Shift+P → MCP: Open User Configuration, then add:

{
  "servers": {
    "skillsmp": { "type": "stdio", "command": "npx", "args": ["-y", "skillsmp-mcp-lite"], "env": { "SKILLSMP_API_KEY": "YOUR_API_KEY" } }
  }
}

VS Code requires the extra "type": "stdio" field.

Cursor / Claude Desktop

| Client | Config file | |---|---| | Cursor | ~/.cursor/mcp.json | | Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json | | Claude Desktop (Windows) | %APPDATA%\Claude\claude_desktop_config.json |

{
  "mcpServers": {
    "skillsmp": { "command": "npx", "args": ["-y", "skillsmp-mcp-lite"], "env": { "SKILLSMP_API_KEY": "YOUR_API_KEY" } }
  }
}

Claude Code

claude mcp add skillsmp -- npx -y skillsmp-mcp-lite --env SKILLSMP_API_KEY=YOUR_API_KEY

Environment Variables

| Variable | Default | Description | |---|---|---| | SKILLSMP_API_KEY | — | Required. API key from skillsmp.com/docs/api | | GITHUB_TOKEN | — | Optional. Raises GitHub API rate limit from 60 → 5,000 req/hour | | SKILL_SCANNER_API_URL | — | Optional. URL of an external Skill Scanner API server | | SKILL_SCANNER_API_PORT | 8000 | Optional. Port for the auto-managed scanner server | | SKILLSMP_MCP_CLIENT | — | Optional. Force --setup to configure a specific client (vscode, cursor, claude-desktop, claude-code, all) |

Available Tools

skillsmp_search_skills

Search for skills using keywords.

| Parameter | Type | Required | Description | |---|---|---|---| | query | string | Yes | Search keywords (max 200 chars) | | page | number | No | Page number (default: 1) | | limit | number | No | Items per page (default: 20, max: 100) | | sortBy | string | No | "stars" or "recent" |

skillsmp_ai_search_skills

Find skills using natural language descriptions.

| Parameter | Type | Required | Description | |---|---|---|---| | query | string | Yes | Natural language description (max 500 chars) |

skillsmp_read_skill

Fetch a skill's content from GitHub and optionally run a security scan.

| Parameter | Type | Required | Description | |---|---|---|---| | repo | string | Yes | GitHub repository (owner/repo) | | skillName | string | Yes | Skill name (max 100 chars, alphanumeric / hyphens / underscores) | | enableScan | boolean | No | Run Cisco Skill Scanner (default: true, requires uv) |

Security Scanning

When skillsmp_read_skill is called with enableScan: true (the default), the server:

1. Fetches skill files from GitHub via REST API
2. Applies three-layer scan limits using GitHub tree size (before downloading):

• Max files: 100 files per scan
• Max single file size: 500 KB per file
• Max total size: 5 MB across all files

1. Builds an in-memory ZIP archive from accepted files
2. Uploads the ZIP to the Cisco Skill Scanner API (/scan-upload) with use_behavioral=true
3. Auto-starts a local scanner server via uvx if none is running (reused for subsequent scans, shut down on exit)

If files are excluded due to scan limits, a Scan Note is included in the results showing how many files and bytes were excluded.

If uvx is not installed, scans are skipped with a warning — the server continues to work normally.

Untrusted Content Notice

All skill content fetched from third-party repositories includes an Untrusted Content Notice. The content may be read and displayed, but it MUST NOT be automatically executed or followed as instructions without explicit user confirmation. Always review the content and scan results before acting on it.

To manage the scanner server manually:

# Start it yourself
npm run scanner-api

# Or point to an external instance
SKILL_SCANNER_API_URL=http://your-server:8000

AGENTS.md Integration

Copy the content from AGENTS.example.md into the top of your AGENTS.md to enable automatic skill discovery.

Workflow: AI receives a task → searches with skillsmp_search_skills (short keywords) → falls back to skillsmp_ai_search_skills if needed → reads the best match with skillsmp_read_skill → follows the skill's instructions.

Search Tips

• Keyword search: 1–3 words — "code review", "typescript", "pdf"
• Semantic search: full sentence — "how to build a landing page with React"

Usage Examples

Ask your AI assistant:

• "Search for PDF manipulation skills"
• "Find skills for building a web scraper"
• "Read the python-code-review skill from existential-birds/beagle"

License

MIT