Private registry Enterprise
A real, hosted registry your whole team shares — versioned and access-controlled. This is where skills your org owns actually live, not a folder someone forked.
The lifecycle layer for agent skills
Author, version, deprecate, and govern the skills your team owns
Skills spread across teams faster than anyone can govern them — forked, copy-pasted, and scattered across gists with no source of truth and no audit trail. Skillsmith gives them a lifecycle instead: a private, versioned registry your team actually owns.
What makes the lifecycle real
You've felt this: someone forks a skill, tweaks it, and a month later nobody's sure which copy is the real one. A registry is only as good as what backs it.
Private skills Team
Mark a skill private on your machine today, hidden from public search. Team-wide sync is on the roadmap (not yet shipped) — for a fully shared registry now, see Enterprise.
Governance, end to end
Deprecate a version without deleting it. Query and export an audit trail. Generate compliance reports. Every indexed skill is security-scanned and quarantined automatically if flagged. Full breakdown below.
One lifecycle, four surfaces
Capabilities marked via MCP for VS Code mean the extension actively spawns the MCP server to deliver them — not every tool the MCP server happens to expose.
| Capability | MCP | CLI | VS Code |
|---|---|---|---|
| Search / get / install / uninstall | yes | yes | via MCP |
| In-session contextual recommendation (skill_suggest) | yes | Not supported | via MCP |
| Side-by-side compare with LLM-readable rationale | yes | Not supported | via MCP |
| Inline install during an agent chat session | yes | Not supported | Not supported |
| Sidebar tree, quick-pick UI, rendered detail panel | Not supported | Not supported | yes |
| SKILL.md frontmatter intellisense + diagnostics | Not supported | Not supported | yes |
| Create-skill wizard (4-step, GUI) | Not supported | partial | yes |
| Skill authoring (init / validate / subagent / transform / mcp-init) | Not supported | yes | Not supported |
| CI-safe exit codes + JSON output | Not supported | yes | Not supported |
| Offline local search after sync | Not supported | yes | Not supported |
| Device-code login (RFC 8628) | Not supported | yes | Not supported |
| Single API key works across all three | yes | yes | yes |
Working in an MCP-compatible agent (Claude Code, Cursor, Copilot, Codex, Windsurf)? Use the MCP server. Scripting, CI, or authoring? Use the CLI. Living in VS Code? Use the extension.
Lifecycle & governance capabilities
Registry, audit, and compliance capabilities, and which surface delivers each one today. See pricing for full tier details.
| Capability | MCP | CLI | Website | Tier |
|---|---|---|---|---|
| Private registry publish Publish a versioned skill to your team-scoped, RLS-enforced hosted registry. | yes | Not supported | Not supported | Enterprise |
| Deprecate / restore a version Mark a registry version stale, or undo it — the version stays, it just stops being installed by default. | yes | Not supported | Not supported | Enterprise |
| Namespace-collision audit + guided rename Find naming collisions across your local skills/commands/agents and apply suggested fixes, with undo. | yes | yes | Not supported | Every tier |
| CycloneDX AI-BOM export Export a CycloneDX 1.5 AI/ML bill-of-materials of your installed skills, with dependency graph, for compliance evidence. | yes | Not supported | Not supported | Team+ |
| Compliance reports Generate SOC 2-oriented, JSON, or CycloneDX reports from your local skill inventory and audit trail. | yes | Not supported | Not supported | Team+ |
| Security scoring + quarantine Every indexed skill is scanned and scored; flagged skills are quarantined out of search automatically. | yes | yes | Not supported | Every tier |
| Audit log query + export Query and export the persistent trail of security and registry-lifecycle events. | yes | Not supported | Not supported | Enterprise |
| SIEM export Export audit events as JSON for ingestion into your SIEM pipeline. | yes | Not supported | Not supported | Enterprise |
| Team workspaces Shared, RLS-secured spaces for your team to organize and share skills. | yes | Not supported | yes | Team+ |
| Team member roles + invites Invite teammates and manage owner/admin/member roles. | Not supported | Not supported | yes | Team+ |
| Cross-device skill inventory Opt-in, read-only view of which skills are installed across your machines and harnesses. | Not supported | Not supported | yes | Every tier |
MCP server
@skillsmith/mcp-server
Pick this if: Working in any MCP-compatible agent (Claude Code, Cursor, Copilot, Codex, Windsurf).
Read the docs →CLI
@skillsmith/cli
Pick this if: Scripting, CI, or authoring your own skills.
Read the docs →VS Code extension
skillsmith-vscode
Pick this if: You live in VS Code and want point-and-click discovery.
Get on the Marketplace →Website dashboard
account.skillsmith.app
Pick this if: Managing billing, seats, team members, or reviewing your cross-device skill inventory.
Go to your account →Read the deep dive →All three client surfaces read the same local SQLite database at
~/.skillsmith/skills.db. Search runs against an FTS5 full-text index (SQLite's built-in keyword search) by default; semantic search is opt-in and uses local ONNX embeddings (an open ML model format that runs on CPU, no API call) — your queries never leave your machine. The private registry is a separate, hosted layer above that: a Supabase-backed store with row-level security, not a copy of the local database.