Quickstart

Connect your agent in 30 seconds.

Super Agent Skill speaks MCP natively. Any agent runtime that supports MCP — Claude, Cursor, Codex, OpenClaw, Hermes, Grok — can connect with a single capability declaration.

1. Add the MCP server

Drop the Super Agent Skill gateway into your agent's MCP config.

mcp.config.json

{
  "mcpServers": {
    "superagentskill": {
      "url": "https://superagentskill.com/api/mcp",
      "auth": { "type": "oauth", "scopes": ["registry:read", "agent:upgrade"] }
    }
  }
}

2. Trigger the upgrade

Once connected, give your agent the keywords. It does the rest.

bash

> Super Agent Skill: check for updates and improvements

→ Self-assessing context........... primary care, pediatrics
→ Identified gaps.................. 3
→ Recommended packages............. 5
→ Installing...................... ✓
→ New health score................. 96.1 / 100

3. The four primitives

Every agent runs on the same stack: skills, playbooks, souls, and guardrails.

Skills

Discrete capabilities — domain reasoning, tool use, structured outputs.

Playbooks

Multi-step workflows that orchestrate skills toward an outcome.

Souls

Personality, tone, and decision-making style as installable packages.

Guardrails

Safety boundaries enforced before output reaches the user.

4. SkillForge: the evolution loop

Every install reports anonymized feedback. SkillForge processes the signal and ships improved package versions to the entire network. Your agent gets smarter while you sleep.

5. Certification API

POST /api/public/certify runs any skill file — even one you host yourself — through the same review engine as the review_skill MCP tool and issues a permanent audit badge bound to the file's SHA-256, with a public verification record. See the certification guide for the full flow.

6. Security & permissions

The MCP gateway is deliberately narrow. Read-only tools — overview, get_methodology, review_skill / review_skills_batch, and registry search / list / get / trust lookups — work anonymously and only read public registry data. Write tools ( upload_packages, request_primitive) require an OAuth bearer or a personal access token. The gateway never reads your files, code or conversation history — it only sees the arguments your agent passes to each tool call.

Data flow: your agent calls the gateway over HTTPS; the gateway returns signed package content from the public registry. Anything you upload stays scoped to your workspace unless you explicitly publish it.

Telemetry opt-out: the CLI sends anonymized install telemetry only; disable it with SUPER_AGENT_TELEMETRY=0.

Verify packages yourself on each package's Trust page (/marketplace/trust/<slug>, linked from every marketplace listing) and report vulnerabilities via SECURITY.md.