Skip to content

Commit 192af6e

Browse files
committed
feat(mcp): prepare ChatGPT and Claude directory listings
Both directories scan the live MCP server before they list it. Each tool now has a title, and descriptions say what a tool does instead of telling the model how to behave. Claude rejects a description that sends the model to fetch instructions from a URL, so the fork hint left get_skill. The toolkit answered 403 to any request with another site's Origin. Claude and ChatGPT origins are now allowed; other origins still fail. OpenAI needs terms of service, a domain challenge, and a plugin package. Claude has a prefilled custom connector link that works before review.
1 parent 6bd14f7 commit 192af6e

18 files changed

Lines changed: 389 additions & 19 deletions

File tree

‎app/app.vue‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,12 @@ watch(() => route.fullPath, () => {
282282
>
283283
Privacy
284284
</NuxtLink>
285+
<NuxtLink
286+
to="/terms"
287+
class="font-mono text-xs text-muted underline-offset-2 hover:underline hover:text-default"
288+
>
289+
Terms
290+
</NuxtLink>
285291
<UButton
286292
icon="i-lucide-keyboard"
287293
color="neutral"
Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# ChatGPT and Claude directory listings
2+
3+
The skilld MCP server at `https://skilld.dev/api/mcp` is listed in two directories.
4+
Both listings point at the same server, so a server deploy updates both.
5+
6+
| Directory | Portal | Listing source |
7+
| --- | --- | --- |
8+
| [ChatGPT](https://chatgpt.com) and Codex plugin directory | [platform.openai.com/plugins](https://platform.openai.com/plugins) | `integrations/openai-plugin/` |
9+
| Claude Connectors Directory | [claude.ai/directory/manage](https://claude.ai/directory/manage) | the Claude listing fields below |
10+
11+
## What review checks
12+
13+
Both portals scan the tools from the live server. Every tool must keep these properties:
14+
15+
- A `title`, and explicit `readOnlyHint`, `destructiveHint`, and `openWorldHint` values.
16+
- A description that says what the tool does. It must not tell the model how to behave, call other apps, or fetch instructions from a URL.
17+
- Output that holds only what the request needs. Do not add request IDs, trace IDs, or debug fields.
18+
19+
`layers/mcp/shared/mcp-tools.ts` holds the tools. The toolkit answers 403 to a request whose `Origin` header is not in `mcp.security.allowedOrigins` in `nuxt.config.ts`.
20+
21+
## Change a tool
22+
23+
1. Deploy the change.
24+
2. In the [OpenAI](https://openai.com) portal, open the plugin, select **MCPs**, then **Rescan**. OpenAI also scans once a day.
25+
3. A new tool stays unavailable in ChatGPT until the scan approves it. Keep the old input schema working until then.
26+
4. Claude syncs tools from the server. If the portal flags a tool, fix it on the server.
27+
28+
## OpenAI plugin
29+
30+
The publisher must be an OpenAI organization owner or hold **Apps Management Write**.
31+
The organization must complete individual verification for the name in `developerName`.
32+
A project with EU data residency cannot submit a plugin with an MCP server.
33+
34+
1. Build the ZIP from the package directory:
35+
36+
```sh
37+
cd integrations/openai-plugin && zip -r "$TMPDIR/skilld-openai-plugin.zip" plugin.json mcp.json assets
38+
```
39+
40+
2. Upload the ZIP. Select **Upload new or existing plugin** and choose the verified developer identity.
41+
3. Connect the `skilld` MCP server and choose **No authentication**.
42+
4. The portal shows a domain-verification token. Set it as a Worker secret:
43+
44+
```sh
45+
pnpm exec wrangler secret put NUXT_OPENAI_APPS_CHALLENGE --config wrangler.jsonc
46+
```
47+
48+
Then check that `https://skilld.dev/.well-known/openai-apps-challenge` prints the token, and complete the challenge.
49+
5. Scan the tools and resolve every finding.
50+
6. In **Review details**, add the demo video URL. The review needs a video of the five positive test cases in ChatGPT.
51+
7. Submit for review, accept the policy attestations, and publish after approval.
52+
53+
To change the listing text, the test cases, or the icon, edit `plugin.json`, raise `version`, and upload a new ZIP.
54+
55+
## Claude connector
56+
57+
Any paid Claude plan can submit. Use these fields in the portal.
58+
59+
| Field | Value |
60+
| --- | --- |
61+
| Server URL | `https://skilld.dev/api/mcp` |
62+
| Server name | skilld |
63+
| One-liner | Search curated agent skills, see who wrote each one, and get the command that runs it in your coding agent. |
64+
| Description | `longDescription` in `integrations/openai-plugin/plugin.json` |
65+
| Categories | Developer tools |
66+
| Documentation URL | `https://skilld.dev/developers?setup=mcp&app=claude` |
67+
| Privacy policy URL | `https://skilld.dev/privacy` |
68+
| Support contact | `https://github.com/skilld-dev/skilld.dev/issues` |
69+
| Icon | `public/logo-icon.png` |
70+
| Slug | `skilld`. The slug is permanent after publication |
71+
| Use cases | Find agent skills by topic, check provenance before a run, open curated collections, get run and install commands |
72+
| Requirements | None. Every tool works without an account |
73+
| Data access | Reads data only |
74+
| Company | Harlan Wilton, `https://skilld.dev`, `harlan@harlanzw.com` |
75+
| Authentication | No authentication |
76+
| Data handling | First-party API. No health data. No sponsored content |
77+
| Test account | None. Every tool works without sign-in |
78+
79+
Before you submit, add the server in Claude as a custom connector and call each tool once.
80+
After submission, Anthropic scans the server and lists it as a Community connector.
81+
Status and reviewer feedback appear in the portal. Escalations go to `mcp-review@anthropic.com`.
8.01 KB
Loading
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
3+
"mcpServers": {
4+
"skilld": {
5+
"type": "streamable-http",
6+
"url": "https://skilld.dev/api/mcp"
7+
}
8+
}
9+
}
Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
3+
"name": "skilld",
4+
"version": "1.0.0",
5+
"description": "Search skilld.dev, a curated registry of agent skills, read who wrote each skill, and get the command that runs it.",
6+
"author": {
7+
"name": "Harlan Wilton",
8+
"email": "harlan@harlanzw.com",
9+
"url": "https://skilld.dev"
10+
},
11+
"homepage": "https://skilld.dev/developers?setup=mcp",
12+
"repository": "https://github.com/skilld-dev/skilld.dev",
13+
"license": "MIT",
14+
"keywords": ["agent skills", "SKILL.md", "coding agents", "codex", "developer tools"],
15+
"extensions": {
16+
"com.openai": {
17+
"interface": {
18+
"displayName": "skilld",
19+
"shortDescription": "Curated agent skills by humans",
20+
"longDescription": "skilld searches skilld.dev, a curated registry of agent skills. A skill is a SKILL.md file that a maintainer writes in their own GitHub repository. It teaches a coding agent how to use a library, a framework, or a workflow.\n\nAsk for a skill by topic, such as Tailwind CSS, Nuxt, or database migrations. skilld returns the matching skills with their author, source repository, GitHub star count, and skilld.dev page. For one skill, it shows the exact SKILL.md and commit on GitHub, when the skill last changed, and the full skill text, so you can read a skill before you run it. It also opens curated collections, where a curator explains why each skill is in the set.\n\nEvery skill comes with its commands. npx skilld run gives the skill to a coding agent for one session and writes no files. npx skilld install keeps the skill in a project. skilld runs and installs nothing itself. You run the command in your own terminal or coding agent.\n\nskilld needs no account and reads public registry data only.",
21+
"developerName": "Harlan Wilton",
22+
"category": "Developer Tools",
23+
"capabilities": ["Search agent skills", "Show skill provenance and source", "Open curated collections", "Return run and install commands"],
24+
"websiteURL": "https://skilld.dev",
25+
"supportURL": "https://github.com/skilld-dev/skilld.dev/issues",
26+
"privacyPolicyURL": "https://skilld.dev/privacy",
27+
"termsOfServiceURL": "https://skilld.dev/terms",
28+
"defaultPrompt": [
29+
"Find a skill for Tailwind CSS and give me the run command.",
30+
"Who wrote the web-design-guidelines skill, and when did it last change?",
31+
"What is in the Agent builder essentials collection on skilld?"
32+
],
33+
"brandColor": "#E11D48",
34+
"brandColorDark": "#FB7185",
35+
"composerIcon": "./assets/logo.png",
36+
"logo": "./assets/logo.png"
37+
},
38+
"review": {
39+
"test_cases": {
40+
"positive": [
41+
{
42+
"description": "Search skills by topic",
43+
"prompt": "Find a skill for Tailwind CSS.",
44+
"tools_triggered": "search_skills",
45+
"expected_behavior": "Lists Tailwind CSS skills from skilld.dev. Each result names the skill, its GitHub owner and repository, and its GitHub star count, with a skilld.dev page link and an npx skilld run command."
46+
},
47+
{
48+
"description": "Show who wrote a skill and when it changed",
49+
"prompt": "Who wrote the web-design-guidelines skill in vercel-labs/agent-skills, and when did it last change?",
50+
"tools_triggered": "get_skill",
51+
"expected_behavior": "Names Vercel Labs as the publisher. Links the SKILL.md file on GitHub and gives its commit, the last repository push date, and the last skill change date."
52+
},
53+
{
54+
"description": "Read a skill before running it",
55+
"prompt": "Show me the SKILL.md of vercel-labs/agent-skills/web-design-guidelines before I run it.",
56+
"tools_triggered": "get_skill",
57+
"expected_behavior": "Returns the SKILL.md text with a link to its source file on GitHub, and the npx skilld run command for the skill."
58+
},
59+
{
60+
"description": "Open a curated collection",
61+
"prompt": "What is in the agent-building-stack collection by harlan-zw on skilld?",
62+
"tools_triggered": "get_collection",
63+
"expected_behavior": "Returns the Agent builder essentials collection: its skills, the curator's reason for each skill, and the npx skilld add @harlan-zw/agent-building-stack command that installs the whole collection."
64+
},
65+
{
66+
"description": "Get the run command for one skill",
67+
"prompt": "Give me the command to try anthropics/skills/skill-creator without installing it.",
68+
"tools_triggered": "install_command",
69+
"expected_behavior": "Returns npx skilld run anthropics/skills/skill-creator and says that it writes no files. Offers npx skilld install anthropics/skills/skill-creator to keep the skill. States that the user runs the command, and does not claim that anything ran."
70+
}
71+
],
72+
"negative": [
73+
{
74+
"description": "Generate a new skill. skilld indexes skills that maintainers wrote and does not write skills.",
75+
"prompt": "Write a new SKILL.md for my React project and publish it on skilld."
76+
},
77+
{
78+
"description": "Change registry data. Every skilld tool is read only.",
79+
"prompt": "Delete the tailwind skill from skilld.dev."
80+
},
81+
{
82+
"description": "A request unrelated to agent skills. skilld should not be called.",
83+
"prompt": "What is the weather in Sydney today?"
84+
}
85+
]
86+
},
87+
"commerce": false,
88+
"commerce_description": "skilld sells nothing and processes no payments."
89+
},
90+
"publication": {
91+
"countries": [],
92+
"release_notes": "First release. Search skilld.dev for agent skills, show who wrote each skill and where its source lives, open curated collections, and return run and install commands."
93+
}
94+
}
95+
}
96+
}

‎layers/marketing/app/pages/developers.vue‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import {
66
API_OPENAPI_PATH,
77
apiSamples,
88
apiSnippets,
9+
claudeConnectorUrl,
910
cursorInstallUrl,
1011
mcpApps,
1112
setupModes,
@@ -220,11 +221,19 @@ const uiClass = 'font-medium text-default'
220221
</template>
221222

222223
<template v-else-if="app === 'claude'">
223-
<ol class="list-decimal space-y-2 pl-5">
224-
<li>Open <a href="https://claude.ai/customize/connectors" target="_blank" rel="noopener" :class="uiClass" class="underline underline-offset-2">Customize &gt; Connectors</a> in claude.ai or the Claude desktop app.</li>
225-
<li>Select <strong :class="uiClass">Add custom connector</strong>. Name it skilld and paste the server URL. If Claude asks about authentication, choose <strong :class="uiClass">No sign-in</strong>.</li>
226-
<li>In a chat, open the <strong :class="uiClass">+</strong> menu, select <strong :class="uiClass">Connectors</strong>, and check that skilld is on.</li>
227-
</ol>
224+
<UButton
225+
:to="claudeConnectorUrl()"
226+
external
227+
label="Add to Claude"
228+
icon="i-lucide-external-link"
229+
class="min-h-11 hover:bg-primary-600 active:bg-primary-700"
230+
/>
231+
<p class="mt-5">
232+
Claude opens the <strong :class="uiClass">Add custom connector</strong> dialog with skilld filled in. Check the name and the server URL, then confirm. In a chat, open the <strong :class="uiClass">+</strong> menu, select <strong :class="uiClass">Connectors</strong>, and check that skilld is on.
233+
</p>
234+
<p class="mt-4">
235+
Or open <a href="https://claude.ai/customize/connectors" target="_blank" rel="noopener" :class="uiClass" class="underline underline-offset-2">Customize &gt; Connectors</a> in claude.ai or the Claude desktop app. Select <strong :class="uiClass">Add custom connector</strong>, name it skilld, and paste the server URL.
236+
</p>
228237
<p class="mt-4">
229238
Every plan can add a custom connector. The Free plan allows one. On a Team or Enterprise plan, an Owner adds it for the organization first.
230239
<a href="https://claude.com/docs/connectors/custom/add-unlisted" target="_blank" rel="noopener" class="underline underline-offset-2 hover:text-default">Read Anthropic's guide</a>.
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<script setup lang="ts">
2+
const { data } = await useMarketingArticle({
3+
collection: 'pages',
4+
path: '/terms',
5+
canonicalPath: '/terms',
6+
})
7+
</script>
8+
9+
<template>
10+
<MarketingArticle v-if="data" :page="data" />
11+
</template>

‎layers/marketing/app/utils/developer-setup.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,15 @@ export function cursorInstallUrl(url: string = REGISTRY_MCP_URL): string {
4242
return `cursor://anysphere.cursor-deeplink/mcp/install?name=${SERVER_NAME}&config=${encodeURIComponent(config)}`
4343
}
4444

45+
/**
46+
* Claude's link opens its Add custom connector dialog with the name and URL
47+
* filled in. The user still confirms before Claude adds anything.
48+
*/
49+
export function claudeConnectorUrl(url: string = REGISTRY_MCP_URL): string {
50+
const query = new URLSearchParams({ modal: 'add-custom-connector', connectorName: SERVER_NAME, connectorUrl: url })
51+
return `https://claude.ai/customize/connectors?${query}`
52+
}
53+
4554
/** VS Code's install link carries the whole server entry as URI-encoded JSON. */
4655
export function vscodeInstallUrl(url: string = REGISTRY_MCP_URL): string {
4756
return `vscode:mcp/install?${encodeURIComponent(vscodeServerJson(url))}`

‎layers/marketing/app/utils/page-admissions.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ export const FREEZE_AUDIT_PATHS: readonly string[] = [
4545
'/developers',
4646
'/skillgen',
4747
'/privacy',
48+
'/terms',
4849
'/learn/private-repositories',
4950
'/learn/create-agent-skills',
5051
'/learn/author-project-skills',

‎layers/marketing/content/pages/privacy.md‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
title: Privacy
33
description: What skilld.dev stores, why it needs the data, how long it keeps it, and how you delete your account.
4-
label: Last updated 6 October 2026
5-
updatedAt: 2026-10-06
4+
label: Last updated 7 October 2026
5+
updatedAt: 2026-10-07
66
---
77

88
## In short
@@ -12,6 +12,7 @@ updatedAt: 2026-10-06
1212
- An account is optional. You sign in with [GitHub](https://github.com) to like Skills, watch Repositories, get email, or connect the skilld CLI.
1313
- You can delete your account from your dashboard at any time.
1414
- The skilld CLI sends no telemetry.
15+
- The MCP server for [ChatGPT](https://chatgpt.com), Claude, and other MCP apps needs no account. It receives only what each tool needs, such as your search text.
1516

1617
## When you visit
1718

@@ -125,6 +126,21 @@ When you sign in with the CLI, skilld stores a record for that token:
125126

126127
If the client sends your operating system and processor type, such as `darwin-arm64`, device sign-in records it. The sign-in page shows it, so you can check which machine asks for access. You can revoke a device in your [dashboard](/me/devices).
127128

129+
## The MCP server
130+
131+
ChatGPT, Claude, and other MCP apps can search skilld.dev through its MCP server at `https://skilld.dev/api/mcp`. The server needs no account and sets no cookie. Every tool is read only.
132+
133+
When your chat app calls a tool, skilld receives what that tool needs:
134+
135+
- `search_skills` receives your search text and a result count.
136+
- `get_skill` receives the owner, Repository, and name of one Skill.
137+
- `get_collection` receives a curator login and a collection slug.
138+
- `install_command` receives one Skill, Repository, or collection reference.
139+
140+
skilld receives no chat history, no files from the chat, and no account details from the chat app. ChatGPT and Claude call the server from OpenAI or Anthropic servers, so skilld sees their IP address, not yours. Apps on your computer, such as Claude Code or Cursor, call it from your network. Rate limits count requests per IP address, and skilld stores no IP address.
141+
142+
Search text goes to Workers AI, as [Search](#when-you-visit-search) describes. Request logs follow the rules under [When you visit](#when-you-visit). OpenAI and Anthropic handle your chat under their own privacy policies.
143+
128144
## Error reports
129145

130146
skilld uses [Sentry](https://sentry.io) to find and fix errors.
@@ -171,4 +187,4 @@ Skills in your public Repositories stay in the registry, because GitHub is their
171187

172188
## Contact
173189

174-
Email [harlan@harlanzw.com](mailto:harlan@harlanzw.com) with questions about your data. To report a security problem, use [GitHub private vulnerability reporting](https://github.com/skilld-dev/skilld/security/advisories/new).
190+
Harlan Wilton runs skilld.dev. Email [harlan@harlanzw.com](mailto:harlan@harlanzw.com) with questions about your data. To report a security problem, use [GitHub private vulnerability reporting](https://github.com/skilld-dev/skilld/security/advisories/new).

0 commit comments

Comments
 (0)