Skillbase/spm

Unlike npm-based approaches that piggyback onnode_modules, spm has its own registry, its own format, and works with any AI client — not just code editors.

# Install npm install -g @skillbase/spm # Initialize in your project spm init # Connect to your AI client spm connect claude # Claude Desktop / Claude Code spm connect cursor # Cursor spm connect vscode # VS Code (Copilot) spm connect windsurf # Windsurf spm connect jetbrains # Any JetBrains IDE # Install a skill spm add skillbase/arch-code-review # Install a persona (a bundle of skills with a defined role) spm persona add skillbase/sec

Once connected, your AI automatically discovers and loads skills when it encounters a matching task. No manual invocation needed.

spm registers as an MCP server. Your AI client gets five tools:

Lazy loadingis key to the design. The AI sees a lightweight index of all installed skills. When it encounters a task that matches a skill's trigger, it loads just that skill's full instructions. This keeps context windows clean and lets you install dozens of skills without overhead.

User: "Review this pull request for architecture issues" ↓ AI sees skill_list → finds arch-code-review (trigger matches) ↓ AI calls skill_load("arch-code-review") ↓ Full review methodology loads into context ↓ AI performs structured code review

A skill is a directory. At its core is aSKILL.mdfile — structured Markdown with YAML frontmatter:

# Link your repo to a Sync project spm sync init # Install everything the project requires spm sync # Check what's missing without installing spm sync --status

When Sync is connected, your AI agent also gets access to shared team knowledge — decisions, constraints, and context captured by teammates. No more starting from scratch when someone else picks up a task.

The registry hosts skills across several domains:

Development—python-backend,python-testing,db-mongodb,arch-code-review,arch-api-design,arch-system-design

Security—appsec,smart-contract-audit,web3-threat-modeling,prompt-injection-detector,jailbreak-scanner,prompt-safety-validator

DeFi & Trading—yield-analysis,leverage-calc,onchain-signals,mev-awareness,trade-journal

Growth & Strategy—defi-growth-strategy,growth-airdrop-design,web3-grant-writing

Meta—prompt-engineering-craft(learn to write better prompts and skills)

Install directly— one command, auto-converts and installs:

spm add vercel-labs/agent-skills/web-design-guidelines

That's it. spm fetches the skill from GitHub, detects the format, converts it to SPM on the fly, and installs it locally. Ready to use immediately — no flags, no extra steps.

Or convert first, then publish— if you want to review, edit, and share with the community:

# 1. Fetch and convert to a local directory spm convert vercel-labs/agent-skills/web-design-guidelines -o ./ # 2. Review and edit SKILL.md if needed # 3. Publish to the spm registry spm publish ./web-design-guidelines

Author defaults to the GitHub repo owner. Override with--author <name>if needed. The--skill <name>flag is also supported as an alternative:spm add vercel-labs/agent-skills --skill web-design-guidelines.

What spm adds on top of the original skill:

You can also list all available skills in a repository before installing:

spm convert vercel-labs/agent-skills # → lists all skills in the repo's skills/ directory

Works with any GitHub repo that containsSKILL.mdfiles — not limited to Vercel's repositories.

# Scaffold a new skill from scratch spm create my-skill # Or convert an existing prompt file spm convert my-prompt.md --author myname # Or import from GitHub (auto-converts Vercel Skills) spm convert owner/repo/skill-name -o ./ # Edit SKILL.md, then publish spm publish

Studio requires spm to be running locally (spm status-server startor click "Connect spm" in the UI). All publishing uses your existingspm logincredentials.

Skills are free to publish and free to use. The registry is open.

spm works with any client that supports MCP:

Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, Cline, Roo Code, JetBrains IDEs (all), Zed, OpenAI Codex, Emacs, Neovim, and others.

# See all supported clients spm connect --list

Some projects bundle AI skills inside npm packages. spm takes a different approach:

- Own registry— skills are first-class citizens, not a side-effect of npm install. Discovery, search, versioning, and confidence scores are built in.
- Not tied to Node.js— spm skills work with any AI client on any platform. You don't need anode_modulesfolder.
- Lazy loading via MCP— skills load into AI context on demand, not all at once. This is critical when you have dozens of skills.
- Feedback loop—skill_feedbacklets users rate skills. Confidence scores surface the most effective skills.
- Personas— bundle skills into roles. npm has no concept of this.
- Extensible format— a skill can grow from pure instructions to include scripts, templates, and data without changing how it's installed or loaded.
- Compatible, not locked-in— import skills from Vercel Skills, GitHub, or local prompt files.spm converthandles format conversion automatically.

All skills and personas in the public registry go through a security review before publication. Auxiliary files bundled with skills are scanned with antivirus and additional automated security tooling. spm uses token-scoped authorization for publishing — only verified authors can update their packages.

TheSKILL.mdformat is plain Markdown with structured metadata — there's nopostinstallscript execution or hidden side effects.

We welcome skills, bug reports, feature requests, and documentation improvements.

Chia Health MCP Server — Patient workflow integration for a licensed US telehealth platform. Browse GLP-1 medications (semaglutide, tirzepatide), peptide therapies (sermorelin, NAD+, glutathione), and longevity treatments. Check eligibility, complete intake, sign consents, and manage treatment plans. 30 tools, HIPAA-compliant. All prescriptions evaluated by licensed US healthcare providers and delivered from FDA-regulated pharmacies across 50 states + DC.

Broker + MCP server for last-bidder-wins games on Solana — agents register, auto-fund a Privy wallet, and bid via streamable HTTP

AI-powered no-code app builder with 17 MCP tools — create projects, generate pages from natural language, AI text/image generation (GPT, Claude, Gemini, 14+ models), page CRUD, workflow execution, publish & version control. SSE transport, API key auth.

An mcp server for your food ordering needs.

Agent-to-Agent handoff certification for multi-agent systems — validates context preservation, verifies agent capabilities before handoff, logs transfer chains, and ensures no data loss in agent orchestration.

Unified MCP & skill management gateway with progressive disclosure. Manages multiple MCP servers as Agent Apps, loading tool schemas on demand for 99% context token savings. Shared across Claude Code, Codex, OpenCode and more.

A collection of Model Context Protocol (MCP) servers for various tasks and integrations, supporting both Python and Node.js environments.

Open-souSecurely feeds real security refreshed rules into Cursor, Claude Code, and Windsurf — zero config, no API key.

Health intelligence MCP — access biomarkers, biological age, and personalized longevity action plans from your Aniva profile.