Status: pre-alpha. This README describes what we are building. docs/roadmap.md says what exists today. Nothing here is a commitment to a public API yet.
A git repository that holds skills, playbooks and documents is a pack: an organization's, a brand's or a person's. Point an agent at skillcdn.ai/gh/<owner>/<repo> and it gets the whole pack as tools. No hosting, no packaging, no publish step: the repo is the pack.
skillcdn.ai/gh/<owner>/<repo> default branch, latest
skillcdn.ai/gh/<owner>/<repo>@v1.2.0 pinned tag or commit
skillcdn.ai/gh/<owner>/<repo>@main/skills/ads sub-path inside the repo
Why
Agent skills are already distributed as folders of Markdown in git repos. The missing piece is the last mile: getting that folder into an agent that only speaks MCP, keeping it up to date, and doing it for private repos with the permissions you already have on your git host.
- Address, not install. A URL is the whole onboarding. It works with any client that can add a remote MCP server.
- Git is the source of truth. We never host content. We read, index and serve. Pin a ref and the skill you reviewed yesterday is the skill you run today.
- Your git-host permissions are our permissions. Public repo: no auth, no signup. Private repo: a GitHub App installed on the org plus standard MCP OAuth. There is no separate user or team table for you to manage.
- Same image everywhere. One container image, one PostgreSQL. It runs on our cloud, on your own box, or inside your own network against GitHub Enterprise Server; other git hosts are planned behind the same port.
How it works
Public repo
- An agent connects to
skillcdn.ai/gh/owner/repo. - The first request triggers a lazy index of the repo (Markdown, small JSON, skill manifests). The index is cached per repo and commit and shared by everyone.
- The agent sees a small, fixed set of meta tools rather than one tool per skill.
- A branch or a tag is looked up again after a short while. With the GitHub App installed, a push is served by the very next request, and only what changed is fetched.
Private repo
- An org admin installs the SkillCDN GitHub App and selects which repos it may read. Permissions are contents and metadata, read-only.
- A user adds the address to their agent. The agent is told where to ask for access and starts MCP OAuth; we hand off to GitHub login and receive a user token. The GitHub token stays server-side; the agent only ever holds a SkillCDN token, good for that one address. Signing in on the site opens the same repositories in the browser.
- On every request we ask GitHub whether this user can see this repo and cache the yes/no for a short time. Teams, outside collaborators, internal repos, SSO enforcement: GitHub decides, we relay. A repository someone may not see answers exactly like one that does not exist.
- Indexing uses the App installation token, never a user token. GitHub's webhooks end a cached answer at once: a repository made private, the App removed, a person who revoked it, and, where the App may read an organization's members, a change of collaborators, teams or members.
Authorization is optional: a public repository never asks for it. An agent that has nobody to sign in, such as a scheduled job or a server, is given a repository token: made on their account pages by anyone who can read the repository, good for that one repository, read-only and revocable, with an end or without one. It reads as the person who made it, so GitHub still decides what it opens: there is no permission layer of our own. Both tokens are taken over MCP and by the REST API, so a program built on the API, a console or a job, reads a private repository as an agent does.
Every account has a page at skillcdn.ai/gh/<owner> with its public repositories as GitHub lists them, the ones already indexed with skills first.
Tools exposed to the agent
One use_skill(path) prompt starts loading a skill. The server introduces the pack and its folders when an agent connects; browsing and search provide the rest. Names are display metadata, and every content path keeps its actual spelling from the repository root.
An agent whose host implements the MCP skills extension receives the same skills as skills: listed with a digest for every file, and each SKILL.md served as a plain Agent Skills document with its inherited rules and required files inside it, under skill://gh/<owner>/<repo>/<path>.
Connect the pack's root by default, so one connection reaches skills for different tasks and their shared Markdown references. Sub-path connections remain available when a narrower scope is wanted. Optional SKILLCDN.md files describe folders, add common rules and explicitly exclude files or subtrees; nested rules arrive with each skill in order. Repositories without those manifests still work through their real folder structure and optional README introductions. Discovery stays brief; agents load instructions and references only when needed.
The repo declares things; it never ships code that we execute. This is a deliberate security boundary: SkillCDN runs no third-party code, on the server or on the user's machine.
What we do with content
SkillCDN reads, indexes and serves what a repository publishes, keeps copies only to serve them, and takes them down on request. The license a skill carries decides whether its content is passed on or only described with a link to its source: permissive licenses are served with their notice, restrictive ones are described unless the repository is verified, and a repository without a license is served with its provenance and never featured (licenses). Where to send a takedown request is part of each deployment's own pages.
Specifications: address scheme · the SkillCDN Format: what a pack is · tools · REST API · people and private repositories.
Architecture
[agent] any MCP client
| skillcdn.ai/gh/<owner>/<repo>[@ref][/path] OAuth, or anonymous for public read
[api] stateless MCP over HTTP · sign-in and OAuth · permission check · meta tools · REST for the web app · webhook receiver · indexes a commit on first request
[check] read a working tree with the same indexer, for authors before they push: the image's role, or the skillcdn command (no database)
[postgres] content index (full-text) · permission cache · file bodies by content hash
[git host] GitHub (App), GitHub Enterprise Server
One image with several roles, one database, caches keyed per repo and never per user, an optional web UI, and git hosts behind one adapter interface. A worker role that indexes ahead of requests, other git hosts behind that interface and search by meaning are planned (docs/roadmap.md). The full picture is in docs/architecture.md; the decisions behind it are in docs/adr/.
Repository layout
TypeScript monorepo: pnpm workspaces, Turborepo, Node.js 24, PostgreSQL 18.
apps/
server/ the single deployable; roles: api | migrate | check | purge (worker: not yet) Hono + MCP SDK
web/ optional web UI: landing page and explorer Vite + React
packages/
core/ address parser, the SkillCDN Format, permission rules, tool and REST contracts, search word rules, ports pure TS
db/ schema, migrations, query layer Drizzle + PostgreSQL
github/ GitHub App, user-token and contents adapter implements the git-host port
indexer/ the reading rules: a commit or a working tree read into an index Node.js, no database
reader/ the reads of a mount over an index, wherever the index is kept
client/ the REST API as typed functions, for Node.js and the browser
serve/ the MCP surface and the REST address routes as a library over a reader
cli/ the skillcdn command: check a pack, read one as an agent gets it, serve a directory bin
brand/ the pictures of the brand as files, under the trademark policy no code
apps/server/fixtures/.repositories/ test-only repository fixtures
deploy/ Dockerfile, compose files, the contract for whoever operates the image
docs/ architecture, specs, ADRs, roadmap
On npm, under the @skillcdn scope, released together at one version, each with its own changelog (ADR-0046, ADR-0058). Install them at one version and move them together: a patch changes nothing that exists, a minor may, and says so first in its changelog.
Related repositories. skillcdn/skills is the reference pack, the one the explorer offers to try. skillcdn/console is the reference console: where an organization runs its work with AI agents, a board of the work, the agents at it, and the decisions that wait for a person. Like the reference pack, it is an example that follows the standard and is meant for real use, packaged on npm so that anyone can start from it; it builds on the published packages and the REST API like any other consumer, defines nothing of the specification, and nothing here depends on it (ADR-0047).
Hosted and self-hosted run the same image against any PostgreSQL 18, with file bodies in the database; a compose bundle for self-hosting, a published image and a blob store on S3-compatible storage are planned (docs/roadmap.md, ADR-0004).
Development
pnpm install # needs pnpm 12+; the Node.js runtime is pinned and fetched by pnpm
pnpm check # lint, build, typecheck, test
Setup details and the contribution process are in CONTRIBUTING.md. The rules of the codebase, for people and AI agents alike, are in CLAUDE.md. Secrets are never committed; .env.example holds example values only.
License
SkillCDN is source-available under the Functional Source License, Version 1.1, ALv2 Future License (FSL-1.1-ALv2).
- Use it, modify it, self-host it and build on it, commercially or not.
- The one thing reserved is offering this software, or something substantially similar built from it, to others as a competing commercial product or service.
- Every release becomes Apache 2.0 two years after it is published.
This summary is not the license; LICENSE.md is. The specifications in docs/specs/ are licensed under the Apache License 2.0, so that anyone may implement the format and the tools. "SkillCDN" and its logos are trademarks of KDX Labs Corp. and are not licensed with the code; see TRADEMARKS.md, which also allows everyone the format's file name and front-matter key. The hosted service at skillcdn.ai is operated by KDX Labs. Fonts bundled with the web UI have licenses of their own; see THIRD-PARTY-NOTICES.md. To report a vulnerability, see SECURITY.md.
Built by KDX Labs. Copyright (c) 2026 KDX Labs Corp.
