NetAnlatAkademi/skillforge

<p align="center" <picture <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.svg" <img src="assets/logo.svg" alt="SkillForge" width="296" height="72" </picture </p

SkillForge

A local, open source CLI for the agent ecosystem's supply chain. SkillForge creates, validates, inspects and packages SKILL.md-based skills — and reports where every skill, plugin and MCP server came from, how it gets its next version, whose identity it runs with, how much it opens to an agent, what is wired to what, and whether a registry's claims survive contact with the servers behind them. Console output, JSON, SARIF or Mermaid, and nothing reaches any service unless a command is handed a URL.

SkillForge is not a registry or a marketplace. It is a vendor-neutral security and governance layer that verifies the gap between the capability an agent ecosystem declares and the capability it actually offers — in the context of provenance and policy.

Status: released as 26.250.1 — v0.2 through v0.7 complete: validation, change control, policy-as-code with MCP allow/deny rules, the migration inventory, MCP inspection and tool-surface analysis, provenance, update drift and agent identity. New in v0.8: full tools/list pagination, the asset graph, remote discovery with an ARD and an MCP Registry adapter, and declared-versus-runtime discovery verify. Every command works end to end. CI builds and tests on Linux and Windows, and runs the CLI over the sample skills.

Try it

dotnet run --project src/SkillForge.Cli -- validate ./samples/valid-skill
dotnet run --project src/SkillForge.Cli -- validate ./samples/broken-references --verbose

SkillForge Validate

Skill: broken-references
Path:  ./samples/broken-references

x SF0007 The referenced file 'references/checklist.md' does not exist in the skill. (SKILL.md:16)
x SF0007 The referenced file 'scripts/analyze.ps1' does not exist in the skill. (SKILL.md:17)
! SF1010 No agent compatibility is declared. (SKILL.md:1)

Result: INVALID
Errors: 2  Warnings: 1  Info: 0

Exit codes: 0 clean · 1 validation failure, or a warning under --strict · 2 usage error · 3 unexpected failure. Options: --strict, --quiet, --verbose, --no-color (the NOCOLOR environment variable works too). See SKILLFORGEROADMAP.md for scope and TODO.md for progress.

Why

Agent skills are executable instructions that ship with real permissions. SkillForge lets a developer notice a broken or risky skill in seconds — locally, and in CI — without sending anything to a service.

SkillForge reports concrete diagnostics and risk signals. It deliberately does not label a skill "safe" or "unsafe".

Commands

| Command | Purpose | |---|---| | skillforge init <name | Scaffold a skill that already passes validation | | skillforge validate <path | Validate structure, frontmatter, quality rules and provider compatibility | | skillforge scan <path | The same rules, reported down to the risk signals: what it runs, reaches and asks an agent to do | | skillforge inspect <path | Summarise files, links, scripts and inferred capabilities | | skillforge diff <before <after | Compare two versions by what they can do, not which bytes changed | | skillforge eval <path | Check a skill against the expectations declared under evals/, optionally by asking a model | | skillforge pack <path | Produce a deterministic .skill.zip with a SHA-256 hash and manifest | | skillforge policy check <path | Judge skills, and the MCP servers a configuration declares, against .skillforge/policy.yaml — the one command that judges rather than describes | | skillforge policy diff <before <after | Compare two policy files and report what the later one permits that the earlier did not | | skillforge mcp inspect\|validate\|diff <file | Inspect, gate or compare an MCP configuration file | | skillforge mcp surface <file | Measure how many tools a server puts in an agent's context, and how many of them change things | | skillforge provenance [path] | Report where each skill and plugin came from, and how it gets its next version | | skillforge provenance diff <before <after | Report what drifted: publisher, marketplace, pin, fingerprint | | skillforge update analyze <base <target | Report what an update adds, and what that means given how it arrives | | skillforge identity inspect\|diff <file | Report whose authority an agent reaches each MCP server with | | skillforge graph [path] | Draw what is wired to what — console, JSON or Mermaid, every edge citing the file it was read from | | skillforge discover <query | Search a remote registry and report what it declares, without connecting to any of it | | skillforge discovery verify <query | Compare what a registry declares about its MCP servers with what those servers answer | | skillforge inventory | Report the agent tooling installed here: skills, MCP servers and instruction files, per provider | | skillforge migrate inspect | The same inventory, under the migration group |

Full options are in docs/cli-reference.md; CI usage, including SARIF upload, is in docs/ci.md. The graph's evidence model is in docs/graph.md, and the discovery trust model in docs/discovery.md.

Drawing what is wired to what

skillforge graph . --format mermaid

graph LR
  credential_deploy_token_635b(["DEPLOY_TOKEN"])
  host_prod_company_com_e520("prod.company.com")
  mcp_production_mcp_6411["production-mcp"]
  skill_deploy_skill_94a7["deploy-skill"]

  mcp_production_mcp_6411 -.->|"ReadsCredential (inferred)"| credential_deploy_token_635b
  mcp_production_mcp_6411 -->|"ConnectsTo"| host_prod_company_com_e520
  skill_deploy_skill_94a7 -->|"Invokes"| mcp_production_mcp_6411