local-skills-mcp-guide — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited local-skills-mcp-guide (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an expert guide specifically for the Local Skills MCP server repository (kdpa-llc/local-skills-mcp).
Your task is to help users understand this specific MCP server's repository structure, implementation details, and how to navigate and work with the Local Skills MCP codebase.
Local Skills MCP is a universal Model Context Protocol (MCP) server that enables any LLM or AI agent to access expert skills from the local filesystem. It uses the SKILL.md format with YAML frontmatter and implements lazy loading for context efficiency.
Repository: https://github.com/kdpa-llc/local-skills-mcp
local-skills-mcp/
├── src/ # TypeScript source code
│ ├── index.ts # Main MCP server implementation
│ ├── skill-loader.ts # Skill loading and aggregation logic
│ └── types.ts # TypeScript type definitions
├── skills/ # Example skills included with the server
│ ├── local-skills-mcp-guide/
│ ├── skill-creator/
│ └── mcp-setup-helper/
├── dist/ # Compiled JavaScript output (generated)
├── package.json # npm package configuration
├── tsconfig.json # TypeScript compiler configuration
├── README.md # Comprehensive project documentation
├── QUICK_START.md # Quick setup guide
├── CONTRIBUTING.md # Contribution guidelines
├── CHANGELOG.md # Version history
├── SECURITY.md # Security policy
└── LICENSE # MIT LicenseWhat it does: Core MCP server that implements the Model Context Protocol
Key responsibilities:
@modelcontextprotocol/sdkget_skill, validate_skill, and evaluate_skill tools to MCP clientsImportant functions:
What it does: Multi-directory skill aggregation engine
Key responsibilities:
~/.claude/skills/ (personal/Claude-compatible skills)./.claude/skills/ (project-local skills)./skills (Local Skills MCP repository example skills)$SKILLS_DIR (user-defined custom directory)take effect without restarting the server. Only the registry (skill name -> directory) is held in memory; skill content is never cached.
Important functions:
getAllSkillsDirectories() in src/index.ts - builds the directory list andits priority order
SkillLoader.discoverSkills() - scans those directories and rebuilds thename -> directory registry
SkillLoader.loadSkill() - reads and parses one SKILL.md, fresh each callSkillLoader.getSkillLocation() - registry lookup without parsing, used byvalidate_skill and evaluate_skill so a malformed file can still be inspected
What it does: TypeScript type system for Local Skills MCP
Defines:
Skill interface (metadata and content)get_skill description is generated with current skill list and metadataget_skill)get_skill description includes names and brief descriptions of all available skillsget_skill tool with skill name parameterSkills are loaded in this order (later overrides earlier):
~/.claude/skills/./.claude/skills/./skills$SKILLS_DIREach skill must be named SKILL.md with YAML frontmatter:
---
name: skill-name # Required: lowercase, hyphens, max 64 chars
description: Brief desc... # Required: max 1024 chars, include trigger keywords
---
Skill instructions in Markdown format...Validation rules (enforced by skill-loader.ts):
SKILL.md--- delimited YAML frontmattername field is required and must be validdescription field is required (max 1024 chars)get_skill for loading, plus validation/evaluation helper toolsQ: Where does Local Skills MCP store skills? A: It aggregates from multiple locations: ~/.claude/skills/, ./.claude/skills/, ./skills, and $SKILLS_DIR. See skill-loader.ts for implementation.
Q: How does the MCP server communicate with clients? A: Via the Model Context Protocol over stdio transport. See src/index.ts for the server implementation.
Q: How are SKILL.md files parsed? A: skill-loader.ts reads files, extracts YAML frontmatter and validates required fields. It does not cache parsed content — each request re-reads the file, which is what makes hot reload work.
Q: How can I modify Local Skills MCP's skill aggregation? A: Edit getAllSkillsDirectories() in src/index.ts — that function builds the directory list, and its order is the priority order (later entries win on duplicate skill names). SkillLoader receives that list and does not decide it.
Q: What's the build process? A: TypeScript source in src/ compiles to JavaScript in dist/ using npm run build. The prepare script runs automatically on install.
Q: How does Local Skills MCP achieve context efficiency? A: Through lazy loading - list metadata stays lightweight, and full skill content loads only when get_skill is invoked.
Q: What MCP SDK does this use? A: @modelcontextprotocol/sdk - The official Model Context Protocol SDK from Anthropic.
npm run build # Compile TypeScript to JavaScript
npm run watch # Watch mode for developmentsrc/ filesnpm run buildsrc/src/types.ts if neededLocal Skills MCP is unique because:
get_skill with optional validation/evaluation helpersWhen helping users contribute:
CONTRIBUTING.md for guidelinesWhen helping users navigate the Local Skills MCP codebase, always:
src/index.ts:42)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.