XRefKit
XRefKit is a framework for making AI-assisted work repeatable, reviewable, and handoff-ready.
It helps teams structure domain procedures and knowledge so that work can record evidence, preserve human judgment, and apply explicit completion checks.
Why XRefKit?
Using AI for real work creates recurring operating problems:
- the AI can act from incomplete context or unsupported guesses
- procedures, domain facts, and judgment criteria get mixed together in prompts
- execution, checking, and handoff collapse into one opaque step
- work becomes hard to continue across agents, humans, or sessions
- outputs may lack evidence, closure discipline, or auditability
XRefKit provides a repository and runtime model for addressing these problems.
What it provides
- Skills — reusable procedures expressed as SkillDefinitions
- Knowledge — source-backed domain facts and local rules resolved by XID when a Skill run needs them
- Workflow protocol — recorded progress, deterministic workflow-record verification, and closure checks
- Evidence and handoffs — outputs, judgments, concerns, and decisions that remain reviewable after the work is done
- Skill Run Dashboard — inspect recorded Skill execution state, definition identity, runtime binding, referenced XIDs, evidence, judgments, concerns, and handoffs
- XIDs — stable references for connecting procedures, knowledge, and supporting documents
The package includes the resolver, Skill runtime, workflow controls, client tools, and an optional MCP adapter.
Current Skill authoring targets the one-document skill_definition_v1 format.
Existing legacy_split_v1 Skills and unversioned historical run logs remain
readable during migration. The Workflow Runtime Binding
defines how instruction-derived capability, tuning, responsibility, and
execution_mode are captured; these are not fixed SkillDefinition properties.
Knowledge used by a Skill remains separate and is resolved from the XID catalog
when needed.
The Skill Run Dashboard helps people inspect recorded XID retrieval and use together with the run's evidence before a human accepts or hands off the result. The Dashboard reports recorded state and missing observations; it does not accept output quality.
Quick start
XRefKit requires Python 3.11 or later.
python -m pip install xrefkit
xrefkit init
xrefkit --help
For local development:
python -m pip install -e .
xrefkit init
For the optional MCP server:
python -m pip install "xrefkit[mcp]"
xrefkit mcp serve --repo . --transport stdio
This command starts the optional catalog and runtime MCP adapter. This checkout does not implement management upload, staging, sealing, review, or adoption of uploaded SkillDefinition bytes into the active catalog.
Where to go next
- Install XRefKit and register Skill Packages
- Understand the workflow protocol
- Use an instruction-backed workflow
- Understand Skills and Knowledge
- Read the SkillDefinition v1 contract
- Author a Skill with xref
- Browse the complete documentation index
Security
XRefKit does not require provider API keys to explore or install the package.
Do not commit secrets, API keys, access tokens, .env files, or provider
credentials. Authenticate external AI tools through their official provider
mechanisms.
1 maintainer
Metadata
1 maintainer
Release files for xrefkit 0.5.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| xrefkit-0.5.0.tar.gz | 435.3 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| xrefkit-0.5.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 794.2 kB
Release files / xrefkit-0.5.0.tar.gz
| Download URL | xrefkit-0.5.0.tar.gz |
|---|---|
| Size | 435.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ec3c4e064733872da6210759f90778800649b33442a05c3c2b0d76ba7cb10151
|
|
BLAKE2b-256 checksum How to use checksums |
d8e94755a5c48c6ccc1893b2361a0d2b4be61c01c2a6d3469b3754efdb5d2b94
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 19, 2026.
Transparency logRelease files / xrefkit-0.5.0-py3-none-any.whl
| Download URL | xrefkit-0.5.0-py3-none-any.whl |
|---|---|
| Size | 358.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c3851110050489964f19afcc8b8407940b570da63b3273f934cccab4f569ae21
|
|
BLAKE2b-256 checksum How to use checksums |
1c9b475e86f3019ca5028739f9aab61f3f7aa96537949b842ea39d098aaf51a0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 19, 2026.
Transparency logSecurity for xrefkit 0.5.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for xrefkit-0.5.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 19, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
