
Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
@olaservo/skill-jack-mcp
Advanced tools
MCP server that discovers and serves Agent Skills. I know kung fu.
An MCP server that jacks Agent Skills directly into your LLM's brain.
Recommended: For best results, use an MCP client that supports
tools/listChangednotifications (e.g., Claude Code). This enables dynamic skill discovery - when skills are added or modified, the client automatically refreshes its understanding of available skills.
tools/listChanged so clients can refresh available skillsskill:// URIs with batch collection supportnotifications/resources/updatednpm install @olaservo/skill-jack-mcp
Or run directly with npx:
npx @olaservo/skill-jack-mcp /path/to/skills
git clone https://github.com/olaservo/skill-jack-mcp.git
cd skill-jack-mcp
npm install
npm run build
Configure one or more skills directories containing your Agent Skills:
# Single directory
skill-jack-mcp /path/to/skills
# Multiple directories (separate args or comma-separated)
skill-jack-mcp /path/to/skills /path/to/more/skills
skill-jack-mcp /path/to/skills,/path/to/more/skills
# Using environment variable (comma-separated for multiple)
SKILLS_DIR=/path/to/skills skill-jack-mcp
SKILLS_DIR=/path/to/skills,/path/to/more/skills skill-jack-mcp
Each directory is scanned along with its .claude/skills/ and skills/ subdirectories for skills. Duplicate skill names are handled by keeping the first occurrence.
Windows note: Use forward slashes in paths when using with MCP Inspector:
skill-jack-mcp "C:/Users/you/skills"
The server implements the Agent Skills progressive disclosure pattern with dynamic updates:
tools/listChangedskill tool to load full SKILL.md contentskill-resource to load additional files┌─────────────────────────────────────────────────────────┐
│ Server starts │
│ • Discovers skills from configured directories │
│ • Starts watching for SKILL.md changes │
│ ↓ │
│ MCP Client connects │
│ • Skill tool description includes available skills │
│ ↓ │
│ LLM sees skill metadata in tool description │
│ ↓ │
│ SKILL.md added/modified/removed │
│ • Server re-discovers skills │
│ • Updates skill tool description │
│ • Sends tools/listChanged notification │
│ • Client refreshes tool definitions │
│ ↓ │
│ LLM calls "skill" tool with skill name │
│ ↓ │
│ Server returns full SKILL.md content │
│ ↓ │
│ LLM calls "skill-resource" for additional files │
│ • Scripts, snippets, references, assets, etc. │
└─────────────────────────────────────────────────────────┘
skillLoad and activate an Agent Skill by name. Returns the full SKILL.md content.
Input:
{
"name": "skill-name"
}
Output: Full SKILL.md content including frontmatter and instructions.
skill-resourceRead files within a skill's directory (scripts/, references/, assets/, snippets/, etc.).
This follows the Agent Skills spec's progressive disclosure pattern - resources are loaded only when needed.
Read a single file:
{
"skill": "mcp-server-ts",
"path": "snippets/tools/echo.ts"
}
Read all files in a directory:
{
"skill": "algorithmic-art",
"path": "templates"
}
Returns all files in the directory as multiple content items.
List available files (pass empty path):
{
"skill": "mcp-server-ts",
"path": ""
}
Security: Path traversal is prevented - only files within the skill directory can be accessed.
Skills are also accessible via MCP Resources using skill:// URIs.
| URI | Returns |
|---|---|
skill://{name} | Single skill's SKILL.md content |
skill://{name}/ | All files in skill directory (collection) |
skill://{name}/{path} | Specific file within skill |
Clients can subscribe to resources for real-time updates when files change.
Capability: resources: { subscribe: true, listChanged: true }
Subscribe to a resource:
→ resources/subscribe { uri: "skill://mcp-server-ts" }
← {} (success)
Receive notifications when files change:
← notifications/resources/updated { uri: "skill://mcp-server-ts" }
Unsubscribe:
→ resources/unsubscribe { uri: "skill://mcp-server-ts" }
← {} (success)
How it works:
skill:// URISkills are treated as trusted content. This server reads and serves skill files directly to clients without sanitization. Only configure skills directories containing content you trust.
Protections in place:
MAX_FILE_SIZE_MB env var)Not protected against:
The server watches skill directories for changes. When SKILL.md files are added, modified, or removed:
skill tool's description is updated with current skill names and metadatatools/listChanged notification is sent to connected clientsThe skill tool description includes metadata for all available skills in XML format:
# Skills
When a user's task matches a skill description below: 1) activate it, 2) follow its instructions completely.
<available_skills>
<skill>
<name>mcp-server-ts</name>
<description>Build TypeScript MCP servers with composable code snippets...</description>
<location>C:/path/to/mcp-server-ts/SKILL.md</location>
</skill>
</available_skills>
This metadata is dynamically updated when skills change - clients supporting tools/listChanged will automatically refresh.
Skills are discovered at startup from the configured directories. For each directory, the server checks:
.claude/skills/ subdirectoryskills/ subdirectoryEach skill subdirectory must contain a SKILL.md file with YAML frontmatter including name and description fields.
# Build first
npm run build
# Test with MCP Inspector
npx @modelcontextprotocol/inspector@latest node dist/index.js /path/to/skills
FAQs
MCP server that discovers and serves Agent Skills. I know kung fu.
The npm package @olaservo/skill-jack-mcp receives a total of 0 weekly downloads. As such, @olaservo/skill-jack-mcp popularity was classified as not popular.
We found that @olaservo/skill-jack-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.