[Demo] SEP-2640 v1 Skills over MCP: skills/list + skills/get + directory read

[olaservo]

Summary

Server-side demo of SEP-2640 v1 — the Skills extension as scoped down in the July 2026 rework. From-scratch replacement for #2428 / #2360, which targeted the earlier skill://index.json revision of the SEP. WIP demo fork, not intended for upstream merge as-is.

What's in this branch

• 28 bundled SKILL.md skills at skill://github/<name>/SKILL.md via //go:embed, served as individually addressable resources. Names and descriptions come from SKILL.md frontmatter — no Go-side duplication.
• skills/list + skills/get protocol methods (go-sdk AddReceivingCustomMethod): entries carry verbatim YAML frontmatter rendered as JSON and a complete per-file sha256: resources set, so hosts can verify and content-bind approvals per the SEP's integrity model. List results carry SEP-2549 ttlMs/cacheScope.
• resources/directory/read, gated behind directoryRead: true in the io.modelcontextprotocol/skills capability declaration; subdirectories marked inode/directory.
• Per-repo surface (non-default skills toolset): the skill://{owner}/{repo}/{skill_name}/{+file_path} resource template and list_repo_skills tool carry over from the earlier demo, and — new for v1 — skills/get answers dynamically for repo-hosted skill URIs: the server fetches the skill directory, digests every file, and returns a content-bindable entry for skills no listing mentions (the SEP's unenumerable-catalog case). resources/directory/read walks repo skill trees the same way.
• Retired v1-incompatible surface removed: no skill://index.json, no mcp-resource-template index entries (both superseded in the 2026-07-16 v1 scope-down).

Verified end-to-end

Live stdio JSON-RPC against the built binary:

• initialize declares "io.modelcontextprotocol/skills": {"directoryRead": true}
• skills/list → 28 entries with verbatim frontmatter, digests, ttlMs/cacheScope
• skills/get round-trips a listed skill; unknown URIs answer -32602
• resources/directory/read on skill://github → 28 inode/directory children

Test plan

• go build ./... clean; gofmt/go vet clean
• Unit tests: frontmatter verbatim round-trip, digest format, entry completeness, directory semantics, -32602 cases, repo-hosted dynamic entries
• In-memory client/server test exercising the full extension surface
• Docs regenerated for the skills toolset

Related

• Supersedes [Demo] SEP-2640 Skills over MCP: bundled + per-repo + discovery #2428 (open draft) and [Demo] SEP-2640 Skills over MCP: bundled + per-repo + discovery #2360 (closed) — both target the retired index.json draft
• feat(skills): publish skill://index.json + advertise skills extension (SEP-2640) #2762 also targets the retired draft (index.json + allowedTools index field)
• Skills Over MCP WG decision log — 2026-07-16 v1 scope entry records the rework this implements

🤖 Generated with Claude Code