
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
local-skills-mcp
Advanced tools
Universal MCP server enabling any LLM or AI agent to utilize expert skills from your local filesystem. Reduces context consumption through lazy loading - only skill names visible initially, full content loads on-demand. Works with Claude, Cline, custom ag
Enable any LLM or AI agent to utilize expert skills from your local filesystem via MCP
Quick Start • Features • Usage • FAQ • Contributing
A universal Model Context Protocol (MCP) server that enables any LLM or AI agent to access expert skills from your local filesystem. Your skills become portable, reusable prompt libraries that work across Claude Code, Claude Desktop, Cline, Continue.dev, custom agents, or any MCP-compatible client.
Transform AI capabilities with structured, expert-level instructions for specialized tasks. Lazy loading preserves context—only skill names and descriptions load initially; full content loads on-demand.
~/.claude/skills, ./.claude/skills, ./skills, and custom pathsget_skill) with dynamic skill discoveryFrom npm (recommended):
npm install -g local-skills-mcp
Alternative: From GitHub:
npm install -g github:kdpa-llc/local-skills-mcp
Or clone locally:
git clone https://github.com/kdpa-llc/local-skills-mcp.git
cd local-skills-mcp
npm install # The prepare script auto-builds
Requirements: Node.js 18+, any MCP-compatible client
Add to your MCP client configuration (e.g., ~/.config/claude-code/mcp.json):
If installed globally:
{
"mcpServers": {
"local-skills": {
"command": "local-skills-mcp"
}
}
}
If cloned locally:
{
"mcpServers": {
"local-skills": {
"command": "node",
"args": ["/absolute/path/to/local-skills-mcp/dist/index.js"]
}
}
}
For Cline: Same config in VS Code Settings → "Cline: MCP Settings"
For other MCP clients: Use the same command/args structure according to their MCP server setup.
The server auto-aggregates skills from multiple directories in this priority order (lowest to highest):
~/.claude/skills/ - Your global skills./.claude/skills/ - Project-specific skills./skills - Default project skills$SKILLS_DIR - Custom directory (if set)Later directories override earlier ones, allowing you to customize built-in skills.
Option 1: Ask Claude to Create Skills (Recommended)
After installing Local Skills MCP, you can ask Claude to create skills for you:
You: "Create a Python expert skill that helps me write clean, idiomatic Python code"
Claude: [Creates ~/.claude/skills/python-expert/SKILL.md with appropriate content]
✅ Created python-expert skill! It's immediately available thanks to hot reload.
You: "Make a skill for reviewing pull requests focusing on security and best practices"
Claude: [Creates the skill with detailed PR review instructions]
✅ The pr-reviewer skill is ready to use right away!
Claude will use the built-in skill-creator skill to generate well-structured skills with proper YAML frontmatter, trigger keywords, and best practices.
Option 2: Create Manually
Create ~/.claude/skills/my-skill/SKILL.md:
---
name: my-skill
description: What this skill does and when to use it
---
You are an expert at [domain]. Your task is to [specific task].
Guidelines:
1. Be specific
2. Provide examples
3. Be helpful
Using Skills:
Request any skill in your AI client: "Use the my-skill skill"
The AI auto-discovers available skills and loads them on-demand. All changes apply instantly thanks to hot reload—no restart needed!
Every skill is a SKILL.md file with YAML frontmatter:
---
name: skill-name
description: Brief description of what this skill does and when to use it
---
Your skill instructions in Markdown format...
Required Fields:
name - Skill identifier (lowercase, hyphens, max 64 chars)description - Critical for skill selection (max 200 chars)Writing Effective Descriptions:
Pattern: [What it does]. Use when [trigger conditions/keywords].
Claude uses language understanding to decide when to invoke skills—specific trigger keywords help Claude make better decisions.
Single Tool: get_skill - loads expert prompt instructions for specific tasks
How it works:
get_skillBuilt-in Skills: The package includes three self-documenting skills that explain how to use Local Skills MCP and create new skills. These are available immediately after installation:
local-skills-mcp-usage - Quick usage guidelocal-skills-mcp-guide - Comprehensive documentationskill-creator - Skill authoring best practicesSkill Aggregation: Auto-aggregates from package built-in skills, ~/.claude/skills/, ./.claude/skills/, ./skills, and $SKILLS_DIR (if set). Later directories override duplicates.
Custom Directory: Add via environment variable:
{
"command": "local-skills-mcp",
"env": {
"SKILLS_DIR": "/custom/path/to/skills"
}
}
Example Skill:
---
name: code-reviewer
description: Reviews code for best practices, bugs, and security. Use when reviewing PRs or analyzing code quality.
---
You are a code reviewer with expertise in software engineering best practices.
Analyze the code for:
1. Correctness and bugs
2. Best practices
3. Performance and security issues
4. Maintainability
Provide specific, actionable feedback.
| Feature | Local Skills MCP | Built-in Claude Skills |
|---|---|---|
| Portability | Any MCP client | Claude Code only |
| Storage | Multiple directories aggregated | ~/.claude/skills/ only |
| Invocation | Explicit via MCP tool | Auto-invoked by Claude |
| Context Usage | Lazy loading (names only) | All skills in context |
Any MCP-compatible client: Claude Code, Claude Desktop, Cline, Continue.dev, or custom agents.
Works with any MCP client (not just Claude), aggregates from multiple directories, explicit invocation control, and better context efficiency via lazy loading.
Yes! Auto-aggregates from ~/.claude/skills/ along with other directories.
No! Full hot reload is supported. All changes (new skills, content edits, deletions) apply immediately without restart. Skills are discovered dynamically on every tool list request.
Minimal! Only names/descriptions initially (~50 tokens/skill). Full content loads on-demand, preserving 95%+ of context.
Yes! Auto-aggregates from package built-in skills, ~/.claude/skills/, ./.claude/skills/, ./skills, and $SKILLS_DIR.
Later directories override earlier ones: package built-in → ~/.claude/skills → ./.claude/skills → ./skills → $SKILLS_DIR. This lets you customize built-in skills.
The package includes three self-documenting skills: local-skills-mcp-usage (quick usage guide), local-skills-mcp-guide (comprehensive documentation), and skill-creator (skill authoring guide). These are available immediately after installation.
Yes! Works with any MCP-compatible LLM setup. Skills are structured prompts that work with any model.
Yes! Runs entirely on local filesystem (though your LLM may need internet depending on the model).
Follow SKILL.md format. Use clear descriptions with trigger keywords, specific instructions, and examples.
Open an issue on GitHub.
More: See CONTRIBUTING.md, SECURITY.md, CHANGELOG.md
Contributions welcome! See CONTRIBUTING.md for guidelines.
Quick start:
Note: This project follows a Code of Conduct.
If you find Local Skills MCP useful, please consider supporting its development!
Ways to support:
MIT License - see LICENSE file. Copyright © 2025 KDPA
Built with Model Context Protocol SDK • Inspired by Claude Skills
Made with ❤️ by KDPA
FAQs
Universal MCP server enabling any LLM or AI agent to utilize expert skills from your local filesystem. Reduces context consumption through lazy loading - only skill names visible initially, full content loads on-demand. Works with Claude, Cline, custom ag
We found that local-skills-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.