Repository Public MIT
1import type { Metadata } from "next";2import Link from "next/link";3import { CodeBlock } from "@/components/code";4import { LIMITS } from "@skills/registry-core";56export const metadata: Metadata = { title: "Publish", description: "How to publish skills, MCP servers and other agent capabilities to the Skills registry." };78const STEPS: [string, string][] = [9 ["Package", "Put an agent-registry.json wrapper manifest next to your existing files. Your SKILL.md, package.json or pyproject.toml stay exactly as they are."],10 ["Validate", "The CLI checks the manifest, paths, sizes and SKILL.md frontmatter, and scans for credentials and risky patterns. Nothing is executed."],11 ["Dry run", "Review the exact file list, declared permissions, target namespace, visibility and checksum before anything leaves your machine."],12 ["Publish", "A scoped token uploads the archive. The server re-validates it and creates an immutable release, or quarantines it for human review."],13 ["Verify", "The CLI re-downloads the release and compares its SHA-256 with what you built."],14];1516export default function Page() {17 return (18 <div className="container-page pb-10 pt-12">19 <header className="mb-12 max-w-3xl">20 <p className="eyebrow mb-3">Open publishing</p>21 <h1 className="text-3xl font-semibold tracking-tight sm:text-4xl">Publish to the registry</h1>22 <p className="mt-3 text-lg text-muted">23 Reading and downloading never need an account. Publishing does: every release is authenticated, scoped to a namespace you own, audited and attributable.24 </p>25 </header>2627 <ol className="grid gap-px overflow-hidden rounded-[10px] border border-line bg-line md:grid-cols-5">28 {STEPS.map(([title, body], i) => (29 <li key={title} className="bg-graphite p-5">30 <p className="font-mono text-xs text-faint">0{i + 1}</p>31 <h2 className="mt-2 text-base font-medium">{title}</h2>32 <p className="mt-2 text-sm text-muted">{body}</p>33 </li>34 ))}35 </ol>3637 <div className="mt-14 grid gap-10 lg:grid-cols-2">38 <section aria-labelledby="cli-h">39 <h2 id="cli-h" className="mb-4 text-xl font-semibold tracking-tight">From your terminal</h2>40 <CodeBlock prompt label="Publish a skill" code={`skills login\nskills init ./my-skill --type skill --name @you/my-skill\nskills validate ./my-skill\nskills publish ./my-skill --dry-run\nskills publish ./my-skill --visibility public`} />41 <p className="mt-4 text-sm text-muted">42 Full reference: <Link className="link" href="/docs/cli">CLI</Link> · <Link className="link" href="/docs/publishing">manifest and validation rules</Link> · <Link className="link" href="/docs/publishing-claude-code">publishing from Claude Code</Link>.43 </p>44 </section>45 <section aria-labelledby="acct-h">46 <h2 id="acct-h" className="mb-4 text-xl font-semibold tracking-tight">Getting a publisher account</h2>47 <div className="card space-y-3 p-6 text-sm text-muted">48 <p>49 Self-service sign-up is not open yet. Publisher accounts and namespaces are currently created by the registry operator after a short identity check, so that a namespace means something.50 </p>51 <p>52 To request one, write through the <Link className="link" href="/contact">contact page</Link> with the namespace you would like and a link that establishes who you are (institutional page, repository host profile or personal site).53 </p>54 <p>55 Already have an account? <Link className="link" href="/login">Sign in</Link> to create artifacts, upload releases from the browser and issue scoped API tokens.56 </p>57 </div>58 </section>59 </div>6061 <section aria-labelledby="rules-h" className="mt-14">62 <h2 id="rules-h" className="mb-4 text-xl font-semibold tracking-tight">What the registry enforces</h2>63 <ul className="grid gap-4 text-sm text-muted sm:grid-cols-2 lg:grid-cols-3">64 {[65 ["Immutable releases", "A published version can never be changed or replaced. Corrections are new versions; compromised versions are revoked, not erased."],66 ["Scoped tokens", "Tokens carry only the scopes and namespaces you grant, expire, can be rotated and revoked, and are stored only as a keyed hash."],67 ["Static inspection only", "Archives are parsed in memory and scanned. The registry never extracts them to disk or runs their content."],68 ["Honest trust signals", "Verified identity and verified source are separate badges. Passing static checks is never presented as “secure”."],69 ["Hard limits", `Archives up to ${LIMITS.maxArchiveBytes / 1024 / 1024} MB, ${LIMITS.maxUnpackedBytes / 1024 / 1024} MB unpacked, ${LIMITS.maxFiles} files. No symlinks, no path traversal, no VCS data or key files.`],70 ["Blocked on secrets", "A release containing what looks like a private key or an API credential is rejected before publication."],71 ].map(([title, body]) => (72 <li key={title} className="card p-5">73 <h3 className="mb-1.5 font-medium text-text">{title}</h3>74 <p>{body}</p>75 </li>76 ))}77 </ul>78 </section>79 </div>80 );81}82