Skip to main content

GitHub Skills MCP

This project provides an MCP server for working with skill libraries stored in one or more GitHub repositories.

It is designed for the workflow you described:

  • search across a growing collection of skill repos
  • inspect a matching skill directly from GitHub
  • download a skill locally when the agent should install it
  • return a grounded starter scaffold when a close match exists but a direct download is not the right move

What the server exposes

  • github_skills_list_repositories
  • github_skills_search_skills
  • github_skills_get_skill
  • github_skills_install_skill
  • github_skills_suggest_skill_scaffold

Configuration

The server ships with these built-in default sources:

  • pinkpixel-dev/skills-collection-1
  • pinkpixel-dev/skills-collection-2

That means the server works out of the box with no repos.json at all.

Users can add more repositories in either of these ways:

  1. Create repos.json in the project root by copying repos.example.json
  2. Or set GITHUB_SKILLS_REPOS to a JSON array with the same schema

Each repo entry supports:

  • name: short alias used in skill slugs
  • owner: GitHub owner or org
  • repo: GitHub repo name
  • ref: branch or tag to read from
  • root: optional subdirectory that contains skills
  • github_token_env: optional environment variable holding a GitHub token

For public repositories, a GitHub token is optional. Users can run anonymously, or provide their own GITHUB_TOKEN for higher rate limits.

For private repositories, each user should provide their own token with the access they need. Do not ship your personal token with the server.

Default and custom source behavior

  • By default, custom repos are added on top of the built-in two repos.
  • If a custom repo uses the same name as a built-in repo, the custom one wins.
  • To disable the built-in repos entirely, set GITHUB_SKILLS_REPLACE_DEFAULTS=true.
  • To disable built-in repos without replacement, set GITHUB_SKILLS_INCLUDE_DEFAULTS=false.

Install

uv sync

If a user wants to add more sources, they can create repos.json from the example:

cp repos.example.json repos.json

Run

For stdio transport:

uv run agentskills-mcp

For a quick smoke test without leaving a hanging process:

timeout 5s uv run agentskills-mcp

Example Claude Code registration

claude mcp add github-skills --env GITHUB_TOKEN=$GITHUB_TOKEN -- uv run agentskills-mcp

For public repos, users can also add the server without any token:

claude mcp add github-skills -- uv run agentskills-mcp

If you also want a default install target for downloaded skills:

claude mcp add github-skills \
  --env GITHUB_TOKEN=$GITHUB_TOKEN \
  --env GITHUB_SKILLS_INSTALL_ROOT=/absolute/path/to/skills \
  -- uv run agentskills-mcp

PyPI and uvx

Once published, users can run the server without cloning the repo:

uvx pinkpixel-agentskills-mcp

For release steps, see PUBLISHING.md.

Notes

  • Skill discovery is currently based on finding SKILL.md files in configured repos.
  • Built-in defaults make the server usable immediately, while optional config lets users extend the source list.
  • Search ranking is intentionally simple for the first version and can be upgraded later with repo-specific metadata or embeddings.
  • The scaffold tool is meant to help another agent create a new skill grounded in existing examples; it does not replace a full generation pipeline by itself.
  • Public-repo access works without credentials; tokens are an optional per-user enhancement, not a baked-in server secret.

Metadata

Release files for pinkpixel-agentskills-mcp 0.1.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pinkpixel-agentskills-mcp 0.1.1
File Size Uploaded Provenance Actions
pinkpixel_agentskills_mcp-0.1.1.tar.gz 12.1 kB Without provenance Details for pinkpixel_agentskills_mcp-0.1.1.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for pinkpixel-agentskills-mcp 0.1.1
File Interpreter ABI Platform Actions
pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl Python 3 none any Details for pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl

Total release size: 23.1 kB

Release files / pinkpixel_agentskills_mcp-0.1.1.tar.gz

Download URL pinkpixel_agentskills_mcp-0.1.1.tar.gz
Size 12.1 kB
Tags Source
SHA-256 checksum
How to use checksums
12c321dc0f81f6f292fb9bf98982907a80f73de86d6ffafa0775f64769444221
BLAKE2b-256 checksum
How to use checksums
3bb455814a0bf8ceb9119547aed8cfe6e306c86aeff6bc72aea20801168962a7
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via uv/0.10.10 {"installer":{"name":"uv","version":"0.10.10","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"CachyOS Linux","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}

Release files / pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl

Download URL pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl
Size 11.0 kB
Tags Python 3
SHA-256 checksum
How to use checksums
7d05b1796b74031c8976cbd3544495a5b9b3d983851c82fac33d1ef97104bf35
BLAKE2b-256 checksum
How to use checksums
ba20b63c1e742206af402cce1f3c714535fa23e3a4b00aa56f4aba4e2f51aeb2
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via uv/0.10.10 {"installer":{"name":"uv","version":"0.10.10","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"CachyOS Linux","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}

Security for pinkpixel-agentskills-mcp 0.1.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.1 This release

2 release files No provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page