
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
claude-skill-search
Advanced tools
Tool Search Tool for Claude Skills - Dynamic skill discovery with intelligent search
Implementation of Anthropic's Tool Search Tool pattern for Claude Code skills. Enables on-demand skill discovery through intelligent search, reducing context bloat while maintaining access to the full skills ecosystem.
From Anthropic's Engineering Blog:
"Rather than consuming 50-100K tokens loading hundreds of tools, Claude dynamically discovers only needed tools through search."
skills-search-mcp brings this pattern to Claude skills with registry-powered search.
✅ Dynamic Discovery - Search 100+ skills without loading all upfront
✅ Token Efficient - Only load skills you actually need
✅ Discovery Views - Browse by popularity (popular_skills) and recency (recent_skills)
✅ Rich Metadata - Tags, download stats, author info (ratings planned)
✅ Context-Aware - Task-based skill recommendations (discover_skills)
npx -y skills-search-mcp
Prerequisite: install the CCPM CLI (
npm install -g @daymade/ccpm) soccpmis available on PATH. For registry-backed tools (info/popular/recent), setSUPABASE_ANON_KEYorVITE_SUPABASE_PUBLISHABLE_KEY.
Add to your Claude Desktop config:
{
"mcpServers": {
"skill-search": {
"command": "npx",
"args": ["-y", "skills-search-mcp"]
}
}
}
Restart Claude Desktop.
You: "I need to work with PDFs"
Claude: [searches dynamically via MCP]
Found 3 relevant skills:
1. pdf-processor (1.2k downloads) - Extract text from PDFs
2. pdf-merger (856 downloads) - Merge multiple PDFs
3. pdf-to-markdown (634 downloads) - Convert PDFs to Markdown
Want to install pdf-processor?
You: "Yes"
Claude: [installs only the needed skill]
| Feature | Anthropic's Tool Search | skills-search-mcp |
|---|---|---|
| Dynamic discovery | ✅ defer_loading: true | ✅ Registry search on-demand |
| Token efficiency | ✅ 85% reduction | ✅ Load only queried skills |
| Search algorithm | Regex / BM25 | ✅ Full-text + filters |
| Popularity data | ❌ Not available | ✅ Download stats |
| Metadata | JSON Schema only | ✅ Tags, authors, descriptions |
| Community insights | ❌ Not available | ✅ Download stats (reviews/trending planned) |
| Tool | Description |
|---|---|
search_skills | Find skills by keyword + filters |
discover_skills | Context-aware recommendations (smart search) |
popular_skills | Top downloaded skills |
recent_skills | Latest published/updated skills |
info_skill | Get skill details (supports detailed) |
install_skill | Install a skill (user/project scope) |
list_skills | List installed skills |
uninstall_skill | Uninstall a skill |
Token usage depends on response size; the core win is avoiding loading the full skills catalog into context.
Claude Desktop
↓ MCP Protocol
skills-search-mcp
↓ CLI wrapper (execa)
ccpm (CLI)
↓ Registry / GitHub sources
Filtered results only
Before (traditional approach):
// Load all 100 skills upfront
const skills = await loadAllSkills(); // 50-100K tokens!
// Most skills never used
After (Tool Search Tool pattern):
// Search dynamically when needed
const results = await searchSkills("pdf"); // ~200 tokens
// Load only relevant skills
Token savings: 99.6% reduction in typical use cases
| Capability | Anthropic's Approach | skills-search-mcp |
|---|---|---|
| Deferred loading | ✅ Manual defer_loading flag | ✅ All skills deferred by default |
| Search implementation | DIY (regex/BM25) | ✅ Built-in full-text search |
| Ranking | Manual implementation | ✅ Source-priority + dedicated popular/recent tools |
| Discovery | Text-based only | ✅ Tags, downloads (ratings planned) |
| Metadata | Static JSON | ✅ Live registry data |
You: "Find skills for image processing"
Claude: [searches: query="image processing"]
→ 5 results with download stats
You: "I'm building a documentation generator"
Claude: [discovers: context="documentation", "markdown", "generator"]
→ Recommends: markdown-renderer, doc-builder, api-docs
You: "What are the most popular skills?"
Claude: [calls popular_skills(limit=10)]
→ Top 10 by downloads
ccpm CLI:
npm install -g @daymade/ccpm
For Claude Code users who prefer skills over MCP configuration:
ccpm install skills-search
# Restart Claude Code
Then simply ask:
You: "Find PDF skills"
Claude: [uses skills-search skill]
Found: pdf-processor, pdf-merger, pdf-to-markdown...
Dual Implementation:
| Component | Type | Best For |
|---|---|---|
skills-search-mcp | MCP Server | Claude Desktop, MCP tools |
skills-search | Claude Code Skill | Native Claude Code usage |
Both wrap the same ccpm CLI - choose based on your workflow.
MIT - See LICENSE
Powered by CCPM - Claude Code Package Manager Inspired by Anthropic's Tool Search Tool
FAQs
Claude skill search server via MCP
We found that claude-skill-search demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.