From 18ab6a940e39e70ad0941a1318863607f0cbc986 Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Wed, 28 Oct 2026 12:43:19 +0000 Subject: [PATCH 1/2] Move kernel-mcp skill to top-level skills/ and copy it into the Grok plugin --- .github/workflows/check-plugin-skills.yml | 16 ++++++ README.md | 2 +- grok/.grok-plugin/plugin.json | 2 +- grok/README.md | 2 +- grok/skills/kernel-mcp/SKILL.md | 2 +- scripts/sync-plugin-skills.sh | 36 +++++++++++++ skills.sh.json | 7 +++ skills/kernel-mcp/SKILL.md | 63 +++++++++++++++++++++++ 8 files changed, 126 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/check-plugin-skills.yml create mode 100755 scripts/sync-plugin-skills.sh create mode 100644 skills/kernel-mcp/SKILL.md diff --git a/.github/workflows/check-plugin-skills.yml b/.github/workflows/check-plugin-skills.yml new file mode 100644 index 0000000..a3115ed --- /dev/null +++ b/.github/workflows/check-plugin-skills.yml @@ -0,0 +1,16 @@ +name: Check plugin skill copies + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - run: scripts/sync-plugin-skills.sh --check diff --git a/README.md b/README.md index 868946f..e321a42 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ Install from the Grok Build plugin marketplace: /plugin # search "kernel" and install ``` -The Grok plugin lives in [`grok/`](grok) and bundles Kernel's hosted MCP server with a skill for using its tools. +The Grok plugin lives in [`grok/`](grok) and bundles Kernel's hosted MCP server with the [`kernel-mcp`](skills/kernel-mcp) skill for using its tools. ### Any Agent ```bash diff --git a/grok/.grok-plugin/plugin.json b/grok/.grok-plugin/plugin.json index 6c7c1a1..7c0303e 100644 --- a/grok/.grok-plugin/plugin.json +++ b/grok/.grok-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "kernel", - "version": "1.1.0", + "version": "1.1.1", "description": "cloud browsers for grok. KERNEL launches stealth chromium sessions in <30ms through our hosted mcp server. drive them with playwright, a persistent browser repl, or computer-use actions, reuse logged-in profiles and managed auth, and record replays.", "author": { "name": "KERNEL", diff --git a/grok/README.md b/grok/README.md index f4d989e..9074e0f 100644 --- a/grok/README.md +++ b/grok/README.md @@ -15,7 +15,7 @@ grok plugin install kernel --trust | component | path | purpose | |---|---|---| | mcp server | `.mcp.json` | our hosted mcp server at `https://mcp.onkernel.com/mcp` (streamable http) | -| skill | `skills/kernel-mcp/SKILL.md` | when and how grok should use the KERNEL mcp tools | +| skill | `skills/kernel-mcp/SKILL.md` | when and how grok should use the KERNEL mcp tools. copied from the repo's top-level [`skills/kernel-mcp`](../skills/kernel-mcp); edit it there and run `scripts/sync-plugin-skills.sh` | ## auth and network access diff --git a/grok/skills/kernel-mcp/SKILL.md b/grok/skills/kernel-mcp/SKILL.md index c28c362..1412900 100644 --- a/grok/skills/kernel-mcp/SKILL.md +++ b/grok/skills/kernel-mcp/SKILL.md @@ -7,7 +7,7 @@ description: use KERNEL cloud browsers through the KERNEL mcp server. create ste the KERNEL mcp server gives you hosted chromium sessions. nothing runs on the user's machine. every browser is a cloud vm that you create, drive, and delete through mcp tools. -on first use, grok opens a browser window so the user can sign in to KERNEL over oauth. during authorization the user can grant org-wide access or limit it to one KERNEL project. +on first use, the user signs in to KERNEL over oauth in their browser. during authorization they can grant org-wide access or limit it to one KERNEL project. ## tools diff --git a/scripts/sync-plugin-skills.sh b/scripts/sync-plugin-skills.sh new file mode 100755 index 0000000..2e1dca2 --- /dev/null +++ b/scripts/sync-plugin-skills.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash +# Copies shared skills from skills/ into plugin directories that are installed +# on their own. Marketplaces copy only the plugin directory, so a symlink out of +# it would dangle; the copy is committed instead. +# +# scripts/sync-plugin-skills.sh update the copies +# scripts/sync-plugin-skills.sh --check fail if a copy is out of date +set -euo pipefail + +cd "$(dirname "$0")/.." + +# source skill dir -> plugin copy +copies=( + "skills/kernel-mcp:grok/skills/kernel-mcp" +) + +check=false +[[ "${1:-}" == "--check" ]] && check=true + +status=0 +for pair in "${copies[@]}"; do + src="${pair%%:*}" + dst="${pair#*:}" + if $check; then + if ! diff -r "$src" "$dst" >/dev/null 2>&1; then + echo "$dst is out of date with $src. Run: scripts/sync-plugin-skills.sh" >&2 + status=1 + fi + else + rm -rf "$dst" + mkdir -p "$(dirname "$dst")" + cp -R "$src" "$dst" + echo "copied $src -> $dst" + fi +done +exit $status diff --git a/skills.sh.json b/skills.sh.json index 0a77e9c..8960174 100644 --- a/skills.sh.json +++ b/skills.sh.json @@ -24,6 +24,13 @@ "kernel-python-sdk" ] }, + { + "title": "Kernel MCP", + "description": "Use Kernel cloud browsers through the hosted MCP server.", + "skills": [ + "kernel-mcp" + ] + }, { "title": "Video", "description": "Render smooth MP4 videos from web pages.", diff --git a/skills/kernel-mcp/SKILL.md b/skills/kernel-mcp/SKILL.md new file mode 100644 index 0000000..1412900 --- /dev/null +++ b/skills/kernel-mcp/SKILL.md @@ -0,0 +1,63 @@ +--- +name: kernel-mcp +description: use KERNEL cloud browsers through the KERNEL mcp server. create stealth browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that blocks bots, a logged-in session, or screenshots of a live page. +--- + +# KERNEL mcp + +the KERNEL mcp server gives you hosted chromium sessions. nothing runs on the user's machine. every browser is a cloud vm that you create, drive, and delete through mcp tools. + +on first use, the user signs in to KERNEL over oauth in their browser. during authorization they can grant org-wide access or limit it to one KERNEL project. + +## tools + +### session lifecycle +- **manage_browsers**: `create`, `list`, `get`, `update`, `delete`, and `get_telemetry` for browser sessions. `create` returns a session id, cdp url, and live view url. options include `stealth`, `headless`, `proxy_id`, `profile_name`, `viewport_width`/`viewport_height`, and `timeout_seconds`. +- **manage_browser_pools**: pre-warmed pools for high-throughput work. create a pool, `acquire` a browser, and `release` it when done. + +### driving a browser +- **execute_playwright_code**: run playwright typescript against an existing session. `page` is already in scope. return a value to get it back. +- **browser_repl**: persistent javascript repl inside the browser vm with playwright, patchright, and raw cdp. state survives across calls. start with `repl.help()`. +- **computer_action**: mouse, keyboard, scroll, and screenshot actions. batch several actions per call and end with a screenshot. +- **webmcp**: call structured tools a page exposes through webmcp. check for these before writing selectors for a site action. +- **browser_curl**: send http requests from inside the browser session, using its cookies and network path. +- **exec_command**: run shell commands inside the browser vm, for example to check dns, files, or logs. + +### state and auth +- **manage_profiles**: saved cookies and local storage. `setup` opens a guided session so the user can log in once. pass `profile_name` to `manage_browsers` `create` to reuse it. +- **manage_auth_connections**: managed auth for third-party sites. before a task that needs an account, `list` connections for the domain. if none is authenticated, `login` starts a hosted sign-in flow the user completes in their own browser, so credentials and mfa stay out of chat. +- **manage_proxies**: datacenter, isp, residential, mobile, or custom proxies with country, state, or city targeting. +- **manage_extensions**: list and manage uploaded chrome extensions. + +### other +- **manage_replays**: `start` and `stop` mp4 recordings of a session (paid plans). +- **manage_apps**: list apps, check deployment status, and invoke KERNEL apps. +- **search_docs**: search the KERNEL documentation. + +## workflows + +### browse or scrape a page +1. `manage_browsers` `create` with `stealth: true` if the site has bot detection. +2. `execute_playwright_code` to navigate and extract: + ```typescript + await page.goto("https://news.ycombinator.com"); + return await page.$$eval(".titleline > a", els => + els.slice(0, 10).map(e => e.textContent) + ); + ``` +3. `manage_browsers` `delete` when finished. + +### work on a site that needs a login +1. `manage_auth_connections` `list` with the site's domain. +2. if a connection is `AUTHENTICATED`, create the browser with its `profile_name`. otherwise `create` a connection, run `login`, share the hosted url with the user, and `wait` until it completes. +3. run the task, then delete the browser. + +### visual or coordinate-based tasks +1. `computer_action` with a `screenshot` to see the page. +2. batch `click_mouse`, `type_text`, and `press_key`, ending with another `screenshot`. + +## tips +- delete browsers when you are done. set `timeout_seconds` as a backstop. +- use `headless: true` when nobody needs the live view. it starts faster. +- share the live view url when the user needs to watch or take over. +- if a session misbehaves, `manage_browsers` `get_telemetry` works on active and deleted sessions. From 4376bb1057e60d1377fb42dbe41de35689b4aa5a Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Wed, 28 Oct 2026 12:44:13 +0000 Subject: [PATCH 2/2] Use the MCP server's site-compatibility wording in kernel-mcp --- grok/skills/kernel-mcp/SKILL.md | 6 +++--- skills/kernel-mcp/SKILL.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/grok/skills/kernel-mcp/SKILL.md b/grok/skills/kernel-mcp/SKILL.md index 1412900..af740e0 100644 --- a/grok/skills/kernel-mcp/SKILL.md +++ b/grok/skills/kernel-mcp/SKILL.md @@ -1,6 +1,6 @@ --- name: kernel-mcp -description: use KERNEL cloud browsers through the KERNEL mcp server. create stealth browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that blocks bots, a logged-in session, or screenshots of a live page. +description: use KERNEL cloud browsers through the KERNEL mcp server. create cloud browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that rejects ordinary automated clients, a logged-in session, or screenshots of a live page. --- # KERNEL mcp @@ -36,8 +36,8 @@ on first use, the user signs in to KERNEL over oauth in their browser. during au ## workflows -### browse or scrape a page -1. `manage_browsers` `create` with `stealth: true` if the site has bot detection. +### browse a page and extract data +1. `manage_browsers` `create`. set `stealth: true` to apply site-compatibility settings, only on sites the user is authorized to access. 2. `execute_playwright_code` to navigate and extract: ```typescript await page.goto("https://news.ycombinator.com"); diff --git a/skills/kernel-mcp/SKILL.md b/skills/kernel-mcp/SKILL.md index 1412900..af740e0 100644 --- a/skills/kernel-mcp/SKILL.md +++ b/skills/kernel-mcp/SKILL.md @@ -1,6 +1,6 @@ --- name: kernel-mcp -description: use KERNEL cloud browsers through the KERNEL mcp server. create stealth browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that blocks bots, a logged-in session, or screenshots of a live page. +description: use KERNEL cloud browsers through the KERNEL mcp server. create cloud browser sessions, automate pages with playwright, the browser repl, or computer-use actions, reuse logged-in profiles and managed auth connections, and record replays. use whenever a task needs a real browser, a site that rejects ordinary automated clients, a logged-in session, or screenshots of a live page. --- # KERNEL mcp @@ -36,8 +36,8 @@ on first use, the user signs in to KERNEL over oauth in their browser. during au ## workflows -### browse or scrape a page -1. `manage_browsers` `create` with `stealth: true` if the site has bot detection. +### browse a page and extract data +1. `manage_browsers` `create`. set `stealth: true` to apply site-compatibility settings, only on sites the user is authorized to access. 2. `execute_playwright_code` to navigate and extract: ```typescript await page.goto("https://news.ycombinator.com");