Skills over MCP

Compatibility

fast-agent implements the stable Skills Extension (io.modelcontextprotocol/skills) wire shapes for its local-copy installer.

It uses skills/list and skills/get, reading declared files with resources/read.

When a connected MCP server advertises this capability, fast-agent shows it as an MCP-backed skills registry. Opening /skills registry calls the paginated skills/list method. Installing a listed skill refreshes its entry with skills/get, downloads every file named by its resources manifest through resources/read, and requires each downloaded file to match its declared byte size and SHA-256 digest before writing the local copy. Sidecar metadata records the host-assigned MCP server identity, skill URI, and resource manifest.

Skill names are labels rather than identifiers. fast-agent preserves same-named entries in an MCP listing and uses their URIs to disambiguate them. The local managed skills directory can contain only one installed skill with a given name. Because a server may return a partial or empty list, you can also install a skill omitted from the listing when you know its URI:

/skills add skill://acme/example/SKILL.md

The selected MCP server confirms that URI through skills/get. Skills with resources: "dynamic" are shown in listings, but installation is explicitly unsupported: there is no complete manifest for integrity checks or update revisions.

Trying it

Run or connect to a server using the stable Skills wire format described above. This example uses the hosted Hugging Face MCP Server:

/mcp connect --name hf https://huggingface.co/mcp
/mcp
/skills registry
/skills available --registry hf
/skills search datasets --registry hf
/skills add <number|name> --registry hf

/mcp shows when a server advertises the io.modelcontextprotocol/skills extension and points you to the one-shot /skills available --registry <server> browse command. Use /skills registry <server> when you want to make that server the active source for subsequent skills commands.

Listings show integrity: SHA-256 manifest; checked on install when the server supplies a complete resource manifest. A listing has not yet checked the served file bytes.

Current scope

This implementation uses MCP as an eager, integrity-checked local-copy installer. It does not expose MCP-served skill resources directly to the model or retain an active MCP resource reader after installation. Installed content is an explicit local copy, not a transparent MCP cache. Only add trusted Skills from an MCP Server. Installation signals your approval for running.

/skills update calls skills/get and compares the complete resource-set revision with the installed revision. Any file addition, removal, URI change, or digest or declared-size change creates a new revision. Updates re-fetch the complete resource set and check every file's size and SHA-256 digest against the refreshed server manifest; this is not publisher verification. The top-level fast-agent skills CLI remains marketplace/file/GitHub oriented; select MCP registries from an interactive session after connecting the MCP server.

Thanks to olaservo for contributing this feature.