# EveryAI Skills MCP

EveryAI exposes the Skills directory through Model Context Protocol so an agent can discover and inspect capabilities without learning the site’s UI.

The server is intentionally metadata-first. It can search the local 1,650-record snapshot, query the live [Skills.sh](https://skills.sh/) directory, list connected registries, and read a catalogued `SKILL.md` for inspection. It never executes or silently installs a third-party skill.

## Run locally

```bash
npm install
npm run mcp
```

Add the absolute path to `mcp/server.mjs` to an MCP client. Example Claude/Codex-style configuration:

```json
{
  "mcpServers": {
    "everyai-skills": {
      "command": "node",
      "args": ["/absolute/path/to/everyai/mcp/server.mjs"]
    }
  }
}
```

The available tools are:

- `search_skills` — task/topic search with optional live Skills.sh results.
- `get_skill` — inspect one metadata record and its install command.
- `read_skill` — explicitly fetch a catalogued GitHub `SKILL.md` as untrusted text.
- `list_skill_sources` — see connected directories and publisher repositories.

Two read-only resources are available: `everyai://skills/catalog` and `everyai://skills/sources`.

## Remote HTTP mode

For a self-hosted MCP endpoint:

```bash
MCP_TRANSPORT=http MCP_HOST=127.0.0.1 MCP_PORT=8788 npm run mcp:http
```

Before binding to a non-local interface, set `MCP_AUTH_TOKEN` and put the endpoint behind TLS and a rate-limiting reverse proxy. The server refuses non-local binding without a token.

## Refreshing the index

```bash
npm run skills:sync -- --dry-run
npm run skills:sync -- --query "web accessibility"
```

Sync searches public Skills.sh metadata and updates the local snapshot only. It does not crawl arbitrary pages, copy publisher instructions, or execute downloaded code. Add a reviewed source adapter when a registry has a stable API and clear provenance.