GitHub Skills MCP
This project provides an MCP server for working with skill libraries stored in one or more GitHub repositories.
It is designed for the workflow you described:
- search across a growing collection of skill repos
- inspect a matching skill directly from GitHub
- download a skill locally when the agent should install it
- return a grounded starter scaffold when a close match exists but a direct download is not the right move
What the server exposes
github_skills_list_repositoriesgithub_skills_search_skillsgithub_skills_get_skillgithub_skills_install_skillgithub_skills_suggest_skill_scaffold
Configuration
The server ships with these built-in default sources:
pinkpixel-dev/skills-collection-1pinkpixel-dev/skills-collection-2
That means the server works out of the box with no repos.json at all.
Users can add more repositories in either of these ways:
- Create
repos.jsonin the project root by copyingrepos.example.json - Or set
GITHUB_SKILLS_REPOSto a JSON array with the same schema
Each repo entry supports:
name: short alias used in skill slugsowner: GitHub owner or orgrepo: GitHub repo nameref: branch or tag to read fromroot: optional subdirectory that contains skillsgithub_token_env: optional environment variable holding a GitHub token
For public repositories, a GitHub token is optional. Users can run anonymously, or provide their own GITHUB_TOKEN for higher rate limits.
For private repositories, each user should provide their own token with the access they need. Do not ship your personal token with the server.
Default and custom source behavior
- By default, custom repos are added on top of the built-in two repos.
- If a custom repo uses the same
nameas a built-in repo, the custom one wins. - To disable the built-in repos entirely, set
GITHUB_SKILLS_REPLACE_DEFAULTS=true. - To disable built-in repos without replacement, set
GITHUB_SKILLS_INCLUDE_DEFAULTS=false.
Install
uv sync
If a user wants to add more sources, they can create repos.json from the example:
cp repos.example.json repos.json
Run
For stdio transport:
uv run agentskills-mcp
For a quick smoke test without leaving a hanging process:
timeout 5s uv run agentskills-mcp
Example Claude Code registration
claude mcp add github-skills --env GITHUB_TOKEN=$GITHUB_TOKEN -- uv run agentskills-mcp
For public repos, users can also add the server without any token:
claude mcp add github-skills -- uv run agentskills-mcp
If you also want a default install target for downloaded skills:
claude mcp add github-skills \
--env GITHUB_TOKEN=$GITHUB_TOKEN \
--env GITHUB_SKILLS_INSTALL_ROOT=/absolute/path/to/skills \
-- uv run agentskills-mcp
PyPI and uvx
Once published, users can run the server without cloning the repo:
uvx pinkpixel-agentskills-mcp
For release steps, see PUBLISHING.md.
Notes
- Skill discovery is currently based on finding
SKILL.mdfiles in configured repos. - Built-in defaults make the server usable immediately, while optional config lets users extend the source list.
- Search ranking is intentionally simple for the first version and can be upgraded later with repo-specific metadata or embeddings.
- The scaffold tool is meant to help another agent create a new skill grounded in existing examples; it does not replace a full generation pipeline by itself.
- Public-repo access works without credentials; tokens are an optional per-user enhancement, not a baked-in server secret.
Metadata
Release files for pinkpixel-agentskills-mcp 0.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| pinkpixel_agentskills_mcp-0.1.1.tar.gz | 12.1 kB | Without provenance | Details for pinkpixel_agentskills_mcp-0.1.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl | Python 3 | none | any | Details for pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl |
Total release size: 23.1 kB
Release files / pinkpixel_agentskills_mcp-0.1.1.tar.gz
| Download URL | pinkpixel_agentskills_mcp-0.1.1.tar.gz |
|---|---|
| Size | 12.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
12c321dc0f81f6f292fb9bf98982907a80f73de86d6ffafa0775f64769444221
|
|
BLAKE2b-256 checksum How to use checksums |
3bb455814a0bf8ceb9119547aed8cfe6e306c86aeff6bc72aea20801168962a7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.10.10 {"installer":{"name":"uv","version":"0.10.10","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"CachyOS Linux","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Release files / pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl
| Download URL | pinkpixel_agentskills_mcp-0.1.1-py3-none-any.whl |
|---|---|
| Size | 11.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7d05b1796b74031c8976cbd3544495a5b9b3d983851c82fac33d1ef97104bf35
|
|
BLAKE2b-256 checksum How to use checksums |
ba20b63c1e742206af402cce1f3c714535fa23e3a4b00aa56f4aba4e2f51aeb2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.10.10 {"installer":{"name":"uv","version":"0.10.10","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"CachyOS Linux","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Security for pinkpixel-agentskills-mcp 0.1.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.