[rgarcia]

Summary

Adds the MCP Skills extension (io.modelcontextprotocol/skills, SEP-2640, Final). The server now ships the kernel-mcp skill from kernel/skills along with its tools, so hosts that support the extension can find and load it from the server they're connected to.

• scripts/build-skills.mjs fetches kernel/skills at a pinned commit and writes src/lib/mcp/skills/generated/skills.ts. That module holds each skill's verbatim frontmatter and its files, with sha256 digests and sizes. It's committed, the same way the managed-auth App bundle is, so neither deploys nor tests reach out to GitHub. bun run check:skills runs in CI and fails if the module doesn't match the pin. Symlinks and skills over the spec's per-skill limits are rejected.
• registerSkills declares the extension (without directoryRead) and implements skills/list and skills/get. Unknown URIs return -32602, as the spec requires. Every skill file is registered as a skill://<name>/<path> resource. SKILL.md has the skill's name and description, so clients without skills support can still see it in resources/list.
• Skills are registered on every connection, the same as prompts. They aren't tied to a toolset.
• The advertised-language test now also covers skill descriptions and prose, so served skills follow the same wording rules as tool metadata.

Pin

SKILLS_COMMIT points at the head of kernel/skills#49, which moves the skill out of grok/ into skills/kernel-mcp/. After #49 merges I'll bump the pin to the merge commit and regenerate.

Testing

• bun test: everything passes, including new unit tests and a /mcp route test for both v1 (initialize) and v2 (server/discover, 2026-07-28) clients.
• bunx tsc --noEmit is clean. bun run check:skills passes.
• MCP Inspector 2.12.0 --method skills/list --verify and skills/get --verify, run against the test HTTP fixture: verified 1 skill and 1 file with no conformance errors.
• format:check still flags AGENTS.md, which was already failing before this change.

Client support

The spec is final, but few hosts load skills from servers yet. MCP Inspector, fast-agent and MCPJam have partial support, and ChatGPT imports them when a plugin is submitted. Claude, Cursor and VS Code don't support it yet. This lays the groundwork; the plugin marketplaces are still the main way people get the skill.

Reviewed with sol-loop: 1 round with openai-codex/gpt-6.1-sol on extra-high reasoning. Sol verdict: approved.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 28, 2026 12:51pm UTC

[rgarcia]

Picked masnwilliams to review these related PRs (kernel/skills#49, #260): touched the changed code in skills; 10 pending

[masnwilliams]

lgtm. two small things worth fixing before merge, plus an fyi.

fix before merge

• digest/size vs served text: build-skills.mjs hashes the raw bytes but serves new TextDecoder("utf-8", { fatal: true }).decode(bytes), which strips a UTF-8 BOM by default. a SKILL.md saved with a BOM would advertise a size/digest that doesn't match what resources/read returns. ignoreBOM: true fixes it. (latent today, the current file has no BOM.)
• cache hints on skill files: skills/list / skills/get return ttlMs: 1h, cacheScope: "public", but the skill:// resources get the default 0 / private on resources/read. passing cacheHint: SKILLS_CACHE to registerResource makes them consistent (and typing SKILLS_CACHE as the sdk's CacheHint would be nice).

fyi / follow-up
@modelcontextprotocol/server 2.4.0 (out 2026-10-23) ships a built-in skills extension at @modelcontextprotocol/server/ext/skills: SkillsExtension / SkillCatalog.load(memorySkillFiles(...)), skillEntry(), SKILL_LIMITS, typed cache hints, pagination, directoryRead. once we bump from 2.0.0 most of skills/index.ts, types.ts, and the digest/frontmatter/limit logic in the build script could go away, and the generated module could just be a path → content record. not worth blocking this on a 4-minor sdk bump (and attach() is still @experimental), but worth a follow-up.

nits, take or leave

• BundledSkill.name duplicates frontmatter.name
• there are three frontmatter regexes across the build script and two tests; the one in prompts.test.ts doesn't handle CRLF
• the check-or-write tail of build-skills.mjs is copied from build-managed-auth-app.mjs; could be a shared helper
• the server/discover test in skills.test.ts overlaps the new modern-era test in dual-era.test.ts