Install
Other clients
Use any Agent Skills consumer or MCP client, and understand local versus remote MCP servers.
Everything in the registry is reachable with curl, shasum and tar. No client-specific tooling is required.
Any Agent Skills consumer
V=1.2.0; S=<slug>; N=<namespace>
BASE=https://skills.spboucher.ai/api/v1/artifacts/$N/$S/versions/$V
curl -fsSLo $S-$V.tar.gz $BASE/download # 1. download
curl -fsS $BASE/checksum | shasum -a 256 -c - # 2. verify
tar -tzf $S-$V.tar.gz # 3. inspect
mkdir -p <skills-dir>/$S && tar -xzf $S-$V.tar.gz -C <skills-dir>/$S # 4. extract
<skills-dir> is wherever your agent looks for skills. Many tools read ~/.agents/skills (user) and .agents/skills (project); the directory name must equal the skill's name, which is the artifact slug.
With the CLI:
skills install @<namespace>/<slug> --client generic-agent-skills # ~/.agents/skills/<slug>
skills install @<namespace>/<slug> --client generic-agent-skills --dir ./vendor/skills/<slug>
Release archives are plain gzip-compressed tar files containing only regular files with relative paths. The registry rejects archives with links, absolute paths or .. segments before they are published.
Any MCP client
Ask for the facts and wire them into your client's own configuration:
curl -s "https://skills.spboucher.ai/api/v1/artifacts/<namespace>/<slug>/versions/latest/install?client=generic-mcp" | jq .
The response gives the transport, the command and arguments or the URL, the environment variables the server expects, and any warnings.
Local server or remote endpoint?
| Local (stdio) | Remote (Streamable HTTP) | |
|---|---|---|
| Who runs it | You, on your machine | The publisher, on their infrastructure |
| What you configure | A command and arguments | A URL, sometimes a header |
| Where your data goes | Stays local unless the server itself calls out | To the operator of the endpoint |
| What to check first | The source code you are about to run | Who operates it, and their terms |
| Secrets | Environment variables on your machine | A token issued by that operator |
In both cases the registry is only the directory. It never receives your secrets and does not sit between you and the server.
Three separate decisions
- Download — fetching and verifying an archive changes nothing on your system.
- Configure — adding an entry to a client makes the server available to it.
- Execute — the server actually runs when your client starts it or connects.
The registry and its CLI stop after the first two and never run a package's installer or scripts on your behalf.
Pinning and updating
Always install a specific version in shared or reproducible setups (@namespace/slug@1.2.0). To update, read the release notes and the file changes of the new version, then install it; the CLI keeps the previous copy so you can roll back. See Versioning and safe updates.