Start
Concepts
Skills, MCP servers, the ten artifact types, and what a registry entry does and does not promise.
What is an Agent Skill?
A skill is a directory of instructions and supporting files that an agent loads when a task calls for it. Its entry point is SKILL.md: YAML frontmatter with a name and a description, followed by Markdown instructions. It may include scripts/, references/ and assets/.
---
name: citation-check
description: Checks that every citation in a manuscript resolves to a reference. Use when reviewing a paper draft.
---
# Citation check
1. List every citation key in the manuscript…
The format is an open specification (agentskills.io). Claude Code, Codex and Cursor read it from a skills directory. A skill runs inside your agent, with your agent's permissions. Installing one means copying files.
What is an MCP server?
A Model Context Protocol server is a program that exposes tools (and optionally resources and prompts) to an agent over a protocol. It runs as its own process:
- stdio: your client starts a command on your machine and talks to it over standard input and output.
- Streamable HTTP: your client connects to a URL operated by someone.
Installing one means adding an entry to your client's MCP configuration.
How they differ
| Agent Skill | MCP server | |
|---|---|---|
| What it is | Instructions and files | A running program with typed tools |
| Where it runs | Inside the agent's own context | A separate local process or a remote service |
| Install | Copy a directory | Add a configuration entry |
| Needs secrets | Rarely | Often (API keys, set locally by you) |
| Main risk | Instructions or scripts you did not read | Code you run, or a remote operator you send data to |
They combine well: a skill can describe how to use the tools an MCP server provides.
A listing is not a hosted server
An MCP entry in this registry is metadata: transport, the command or URL, required environment variables, tool descriptions, source link, and usually a source archive. The registry does not run, proxy or vouch for the server.
- For a stdio server, you run the command on your machine.
- For a remote server, the endpoint belongs to the publisher. Your requests go to them.
The one MCP server the registry itself operates is its own: the registry MCP endpoint, for searching and publishing.
The ten artifact types
| Type id | What it is |
|---|---|
skill | Directory with a standards-compatible SKILL.md |
mcp-server | MCP server listing: transport, install data, tools |
agent | Reusable agent persona, role, instructions and constraints |
prompt-pack | Curated, versioned prompts and templates |
workflow | Multi-step agent pipeline with examples |
connector | API adapter or agent-callable utility |
hook | Event-driven local or server-side extension |
bundle | Group of registry items with locked dependency versions |
eval-kit | Benchmark harness, test cases, fixtures |
template | Starter project or agent configuration scaffold |
The type of an artifact is fixed when it is created.
Capability labels
Types do not share install semantics, so each artifact also carries explicit capability labels. Publishers may state them; otherwise they are derived from facts in the release.
| Label | Meaning |
|---|---|
downloadable | A release archive exists. |
installable | A supported client can install it by copying files or adding configuration. |
remote-endpoint | It points at a service operated by the publisher. |
documentation-only | Nothing to install or run. |
source-linked | A source repository is declared. |
executable | The archive contains scripts, executables or binaries. |
Nothing in the registry is executed by the registry.
Names, versions and immutability
- An artifact is named
@namespace/slug. A namespace belongs to one publisher. - Versions are strict semantic versions (
1.2.0,2.0.0-beta.1). - A published version is immutable. A fix is a new version. A dangerous version is revoked: it stays in the history with a public reason and can no longer be downloaded.
latestis the highest stable published version; a prerelease islatestonly when no stable version exists.
Visibility and state
| Visibility | Who can see it |
|---|---|
public | Everyone; appears in search and listings |
unlisted | Anyone with the link; not in search or listings |
private | Only the publisher |
| State | Meaning |
|---|---|
draft | Created, no published release yet |
active | Has at least one published release |
deprecated | Still downloadable; the publisher recommends something else and says why |
archived | Closed to new releases; hidden from listings, reachable by link |
taken down | Removed by moderators |
Declared permissions
A manifest can declare what the package needs: filesystem:read, filesystem:write, network, shell, env, mcp, browser, credentials. These are the publisher's statements, shown before install. The scanner notes when scripts appear to use the network or spawn processes without declaring it. Declarations are not enforced by the registry; your client's own permission system is what enforces anything.