
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Generate a ready‑to‑use "SKILL" folder from any MCP server. mcp2skill connects to a Model Context Protocol (MCP) server (stdio or Streamable HTTP), enumerates its tools, and emits a portable skill package containing:
Generate a ready‑to‑use "SKILL" folder from any MCP server. mcp2skill connects to a Model Context Protocol (MCP) server (stdio or Streamable HTTP), enumerates its tools, and emits a portable skill package containing:
SKILL.md with clear, schema‑first usage guidancetools/*.json input schemas for each toolscripts/call-tool.js helper to invoke tools by namemcp-config.json capturing how to reconnect to the MCP serverThis lets you install and reuse MCP tools as a standalone skill in other agent setups or workflows, without guessing inputs or wiring.
The CLI discovers tools from an MCP server and writes a self‑contained skill directory.
npx mcp2skill \
--skill-name <skill name> \
--mcp-name <mcp server name> \
--transport <http|sse|stdio> \
--out-dir <output root> \
[URL or -- <command> [args...]]
Options
--skill-name (required): Name of the skill folder to create.--mcp-name (required): Human‑friendly MCP server name recorded in SKILL.md.--transport (required): stdio or http (see note on sse below).--out-dir (required): Directory where the skill folder is created.--env KEY=VALUE (repeatable, stdio only): Environment variables for the spawned MCP server process.--header 'Key: Value' (repeatable, http/sse only): Placeholder for future header support. See limitations.Notes
stdio, pass the command after --. You may repeat --env KEY=VALUE to inject environment variables.http, pass exactly one URL positional argument.Given --out-dir ~/.claude/skills and --skill-name my-skill, the CLI writes:
~/.claude/skills/my-skill/
├─ SKILL.md # Usage protocol and checklist
├─ mcp-config.json # How to connect to the MCP server
├─ scripts/
│ └─ call-tool.js # Helper to invoke tools by name
└─ tools/
├─ <toolA>.json # JSON Schema for <toolA> input
└─ <toolB>.json # JSON Schema for <toolB> input
npx mcp2skill \
--skill-name local-stdio-skill \
--mcp-name local-stdio \
--transport stdio \
--out-dir ~/.claude/skills \
-- node ./server/example-mcp.js
npx mcp2skill \
--skill-name http-skill \
--mcp-name http-demo \
--transport http \
--out-dir ~/.claude/skills \
http://localhost:3000/mcp
@modelcontextprotocol/sdk) using:
StdioClientTransport for local/stdio serversStreamableHTTPClientTransport for HTTP serverstools/*.json from each tool’s inputSchemaSKILL.md with a schema‑first protocol and safety checklistscripts/call-tool.js that uses mcp-config.json to connect and call tools--transport sse, the current client only connects via stdio or Streamable HTTP. SSE fallback is not implemented.--header is accepted by the CLI but not yet persisted in mcp-config.json or applied by the client transport. If you need auth, prefer stdio or run your MCP server without custom headers for now.mcp2skill is MIT licensed.
FAQs
Generate a ready‑to‑use "SKILL" folder from any MCP server. mcp2skill connects to a Model Context Protocol (MCP) server (stdio or Streamable HTTP), enumerates its tools, and emits a portable skill package containing:
We found that mcp2skill demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.