Repository Public MIT
1/** Shared constants of the registry. Changing a limit here changes it for the CLI, the API and the MCP server. */23export const SCHEMA_VERSION = "1.0";4export const MANIFEST_FILE = "agent-registry.json";56export const ARTIFACT_TYPES = [7 "skill",8 "mcp-server",9 "agent",10 "prompt-pack",11 "workflow",12 "connector",13 "hook",14 "bundle",15 "eval-kit",16 "template",17] as const;18export type ArtifactType = (typeof ARTIFACT_TYPES)[number];1920export const TYPE_LABELS: Record<ArtifactType, { singular: string; plural: string; blurb: string }> = {21 skill: { singular: "Agent Skill", plural: "Agent Skills", blurb: "Directories with a standards-compatible SKILL.md, references, scripts and assets." },22 "mcp-server": { singular: "MCP Server", plural: "MCP Servers", blurb: "Model Context Protocol servers: metadata, transport, install instructions and tool descriptions." },23 agent: { singular: "Agent Definition", plural: "Agent Definitions", blurb: "Reusable agent personas, roles, instructions and constraints." },24 "prompt-pack": { singular: "Prompt Pack", plural: "Prompt Packs", blurb: "Curated, versioned prompts and templates with usage notes." },25 workflow: { singular: "Workflow", plural: "Workflows", blurb: "Multi-step agent pipelines with dependency manifests and examples." },26 connector: { singular: "Tool Connector", plural: "Tool Connectors", blurb: "API adapters, integrations and agent-callable utilities." },27 hook: { singular: "Hook / Automation", plural: "Hooks & Automations", blurb: "Event-driven local or server-side agent extensions." },28 bundle: { singular: "Bundle", plural: "Bundles", blurb: "Installable groupings of registry items with locked dependency versions." },29 "eval-kit": { singular: "Evaluation Kit", plural: "Evaluation Kits", blurb: "Benchmark harnesses, test cases, fixtures and reproducibility instructions." },30 template: { singular: "Template", plural: "Templates & Scaffolds", blurb: "Starter projects and agent configuration templates." },31};3233/** What a registry entry actually is. An MCP listing is not necessarily a hosted MCP server. */34export const CAPABILITIES = ["downloadable", "installable", "remote-endpoint", "documentation-only", "source-linked", "executable"] as const;35export type Capability = (typeof CAPABILITIES)[number];3637export const CLIENTS = ["claude-code", "codex", "cursor", "generic-agent-skills", "generic-mcp"] as const;38export type Client = (typeof CLIENTS)[number];39export const CLIENT_LABELS: Record<Client, string> = {40 "claude-code": "Claude Code",41 codex: "OpenAI Codex",42 cursor: "Cursor",43 "generic-agent-skills": "Generic Agent Skills consumer",44 "generic-mcp": "Generic MCP client",45};4647/** Permissions a package declares it needs. Declarations are publisher claims, shown to users before install. */48export const PERMISSIONS = [49 "filesystem:read",50 "filesystem:write",51 "network",52 "shell",53 "env",54 "mcp",55 "browser",56 "credentials",57] as const;58export type Permission = (typeof PERMISSIONS)[number];5960export const LIMITS = {61 maxArchiveBytes: 20 * 1024 * 1024,62 maxUnpackedBytes: 64 * 1024 * 1024,63 maxFileBytes: 16 * 1024 * 1024,64 maxFiles: 2000,65 maxPathLength: 240,66 maxPathDepth: 16,67 maxPreviewBytes: 256 * 1024,68 maxManifestBytes: 64 * 1024,69 maxSummaryLength: 300,70} as const;7172/** Clients a usage example (screenshot) can be labelled with. */73export const EXAMPLE_CLIENTS = ["claude-code", "codex", "cursor", "other"] as const;74export type ExampleClient = (typeof EXAMPLE_CLIENTS)[number];75export const EXAMPLE_CLIENT_LABELS: Record<ExampleClient, string> = { "claude-code": "Claude Code", codex: "Codex", cursor: "Cursor", other: "Other clients" };76/** Usage examples shipped inside a release: screenshots listed in the manifest and served from the archive. */77export const EXAMPLE_LIMITS = {78 maxExamples: 8,79 maxImageBytes: 1536 * 1024,80 maxImageDimension: 8192,81 extensions: ["png", "jpg", "jpeg", "webp"],82} as const;8384export const NAMESPACE_RE = /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}$/;85export const SLUG_RE = /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,63}$/;86export const FULL_NAME_RE = /^@([a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38})\/([a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,63})$/;8788export const RESERVED_NAMESPACES = new Set([89 "admin", "api", "app", "www", "docs", "dashboard", "explore", "skills", "mcp", "agents", "workflows", "collections",90 "publish", "legal", "about", "contact", "login", "logout", "static", "assets", "official", "registry", "anthropic",91 "openai", "claude", "cursor", "codex", "security", "support", "root", "system", "null", "undefined",92]);9394/** API-token scopes. See docs/PERMISSIONS.md for the matrix. */95export const SCOPES = {96 "artifacts:read": "Read artifacts in allowed namespaces, including non-public ones",97 "artifacts:create": "Create artifacts in allowed namespaces",98 "artifacts:update": "Update mutable artifact metadata (summary, links, tags, visibility)",99 "artifacts:deprecate": "Deprecate or archive artifacts",100 "uploads:create": "Begin release uploads and send archive bytes",101 "releases:publish": "Finalize an upload into an immutable release",102 "releases:update": "Edit release notes only; never archive content, manifest, version or checksum",103 "releases:revoke": "Revoke a compromised release",104 "tokens:read": "List the owner's API tokens (metadata only)",105 "tokens:write": "Create or revoke API tokens, never broader than the calling token",106 "audit:read": "Read the owner's audit trail",107 "admin:moderate": "ELEVATED — moderate reports, quarantine or take down any artifact",108 "admin:settings": "ELEVATED — manage users, namespaces and collections",109} as const;110export type Scope = keyof typeof SCOPES;111export const ALL_SCOPES = Object.keys(SCOPES) as Scope[];112export const ELEVATED_SCOPES: Scope[] = ["admin:moderate", "admin:settings"];113export const PUBLISHER_SCOPES: Scope[] = ["artifacts:read", "artifacts:create", "artifacts:update", "uploads:create", "releases:publish", "releases:update"];114/** Elevated tokens are short-lived by policy. */115export const ELEVATED_MAX_TTL_HOURS = 24;116export const DEFAULT_TOKEN_TTL_DAYS = 90;117export const MAX_TOKEN_TTL_DAYS = 366;118119export const TOKEN_PREFIX = "skr";120export const TOKEN_RE = /^skr_([a-z0-9]{10})_([A-Za-z0-9_-]{43})$/;121122export const SEVERITIES = ["info", "low", "medium", "high", "critical"] as const;123export type Severity = (typeof SEVERITIES)[number];124125export interface Finding {126 code: string;127 severity: Severity;128 message: string;129 path?: string;130 line?: number;131 /** blocking findings prevent publication; others are advisory. */132 blocking: boolean;133}134135export const SCANNER_VERSION = "static-1.0.0";136