Universal Skills, One MCP Server

Load Markdown skills from arbitrary folders into any MCP-capable LLM tool — Claude Code, Codex CLI, Cursor, or your own client. Lazy-by-design. Cross-tool. Open source.

v1.7.1 MIT licensed Node ≥ 20

What's new

Latest release, pulled live from the changelog.

Skill sprawl is real

Every LLM tool ships its own skill format and discovery mechanism. Team-shared bundles end up duplicated across ~/.claude/, ~/.codex/, project repos, and a thousand pastebins.

Tool-specific formats

Each LLM tool invents its own skill manifest. Cross-pollination requires manual transcription.

Eager auto-load

Tools load 100+ skill metadata blocks on every cold start. Tokens burn before the user even types a prompt.

No team registry

No standard way to ship a curated skill bundle across a team or organisation.

Scripts = security hole

Tools that allow executable skills rarely sandbox them. One malicious skill, one stolen token.

SkillForge solves it

One MCP server, one Markdown format, five tools. Drop-in for any MCP-aware client.

Universal Markdown format

Single Markdown + YAML frontmatter contract. Four dialects (Claude / Codex / persona / custom) auto-detected.

Lazy by design

skills__list returns metadata only. Full body fetched on skills__invoke. Cold start stays fast at any skill count.

Cross-tool, one config

Multi-folder cascade with priority. Blacklist filter. Hot reload via filesystem watcher. Same server feeds Claude Code, Codex, Cursor.

Honest security

PatternScanner audit. Double opt-in for scripts. Sandbox via env whitelist, mkdtemp cwd, AbortSignal kill. Threat model explicit, out-of-scope items called out.

Token savings calculator

Eager-loading skills burns tokens on every cold start. SkillForge lazy-loads — adjust the inputs to see your monthly savings.

Tokens burned per session (eager)
Tokens burned per session (lazy)
Saved per session
Saved per day
Monthly tokens saved

Approximation. Assumes 30 sessions/month per session-count input. Actual savings vary with skill metadata size and how aggressively your tool caches metadata across sessions.

Install in 60 seconds

One command wires SkillForge into every detected tool — or pick a tab below for the manual config.

# Installs into Claude Code, Codex CLI, Cursor and Hermes in one shot
npx -y @lyupro/skillforge-mcp install --all
# 1. Install the MCP server
claude mcp add skillforge -- npx -y @lyupro/skillforge-mcp serve

# 2. Point it at your skills folder (from the terminal, or via skills__configure in-session)
skillforge folders add /abs/path/to/your/skills --alias core

# 3. Use it
skills__list
skills__invoke { name: "apple-hig-check", input: "..." }

10 sample skills shipped

Production-quality, ready to invoke. Covers all three strategies.

apple-hig-checkprompt · 8-axis HIG audit
refactor-suggesterprompt · structured suggestions
commit-message-writerprompt · conventional commits
prompt-optimizerprompt · token-aware rewrite
idea-onepagerprompt · venture brief
obsidian-resumeprompt · context restore
dependency-checkerscript · npm audit digest
markdown-linterscript · stdlib Python
changelog-generatorhybrid · git log → prompt
git-blame-summaryhybrid · blame digest

Documentation

Every artifact ships with the package.

README

Quick start, 60-second install, pain/solution matrix.

INSTALL

4 wiring tracks, folder-config 3 ways, troubleshooting matrix.

SKILL_FORMAT

Frontmatter contract, 4 dialects, strategy decision tree, 5 worked examples.

CONFIGURATION

Env vars, persisted JSON, full schema, configure-tool actions.

ARCHITECTURE

Module map, 9 design patterns, full invocation flow trace, extension points.

SECURITY

Threat model, sandbox contract, defence layers, responsible disclosure.