Connect your agent in 30 seconds.

Super Agent Skill speaks MCP natively. Any agent runtime that supports MCP — Claude, Cursor, Codex, OpenClaw, Hermes, Grok — can connect with a single capability declaration.

1. Add the MCP server

Drop the Super Agent Skill gateway into your agent's MCP config.

{
  "mcpServers": {
    "superagentskill": {
      "url": "https://superagentskill.com/api/public/mcp",
      "auth": { "type": "oauth", "scopes": ["registry:read", "agent:upgrade"] }
    }
  }
}

Or install with the open Skills CLI

Every published SAK skill is mirrored as a standard SKILL.md package, so the open skills.sh CLI can install them into 17+ agents — Claude Code, Cursor, Codex, Copilot, Windsurf, Gemini CLI, Cline, Zed and more. No account, no MCP.

# the whole graded catalog
npx skills add criptogus/agent-evolve-network

# a single skill
npx skills add criptogus/agent-evolve-network/<slug>

# refresh installed skills
npx skills update

Or load an Agent Plugin (v1.0.0)

Every published skill is also served as a portable Agent Plugins package — the vendor-neutral format stewarded by Amazon, Cursor, Microsoft, OpenAI, Vercel. One manifest, the standard SKILL.md component and our MCP server in one directory, so a conformant client loads the graded skill with no account.

<slug>/
├── plugin.json          # Agent Plugins v1.0.0 manifest
├── mcp.json             # our MCP server (streamable-http)
├── SIGNATURE.json       # Ed25519 signature over the package payload
└── skills/
    └── <slug>/
        ├── SKILL.md
        └── references/examples.md

# download one portable plugin package
curl -LO https://superagentskill.com/api/public/plugins/<slug>.zip

# manifest only
curl https://superagentskill.com/api/public/plugins/<slug>/plugin.json

# MCP server config only
curl https://superagentskill.com/api/public/plugins/<slug>/mcp.json

# discovery index of every graded plugin
curl https://superagentskill.com/api/public/plugins.json

This repository is itself a conformant plugin: root plugin.json + mcp.json + skills/. Authorization stays client-managed — we never ship credentials in a manifest.

Connect an agent using /plugin.json and /mcp.json

Any MCP-compatible agent can load a SAK skill in four steps without an account. Replace <slug> with the skill's short name from the marketplace.

curl https://superagentskill.com/api/public/plugins/<slug>/plugin.json

curl https://superagentskill.com/api/public/plugins/<slug>/mcp.json

{
  "mcpServers": {
    "super-agent-skill": {
      "url": "https://superagentskill.com/api/public/mcp"
    }
  }
}

> Use the Super Agent Skill MCP to call overview

→ Server: super-agent-skill
→ Tools:  list_packages, search_registry, get_package, review_skill, …
→ Status: connected

Verify the signature

Every package download is signed with our Ed25519 release key. The archive carries an embedded SIGNATURE.json (valid even after extracting or repacking), and a detached sidecar pins the sha256 of the exact bytes we served. Signature data also travels in X-SAK-* response headers.

# detached signature + our public key
curl -O https://superagentskill.com/api/public/plugins/<slug>/signature.json
curl -O https://superagentskill.com/api/public/signing-key.pem

# integrity check (hash + Ed25519 signature + key id)
node scripts/verify-package-signature.mjs <slug>-agent-plugin.zip signature.json signing-key.pem

2. Trigger the upgrade

Once connected, give your agent the keywords. It does the rest.

> Super Agent Skill: check for updates and improvements

→ Self-assessing context........... primary care, pediatrics
→ Identified gaps.................. 3
→ Recommended packages............. 5
→ Installing...................... ✓
→ New trust score................. 96.1 / 100

3. The four primitives

Every agent runs on the same stack: skills, playbooks, souls, and guardrails.

4. SkillForge: the evolution loop

Every install reports anonymized feedback. SkillForge processes the signal and ships improved package versions to the entire network. Your agent gets smarter while you sleep.

5. Certification API

POST /api/public/certify runs any skill file — even one you host yourself — through the same review engine as the review_skill MCP tool and issues a permanent audit badge bound to the file's SHA-256, with a public verification record. See the certification guide for the full flow.

6. Security & permissions

The MCP gateway is deliberately narrow. Read-only tools — overview, get_methodology, review_skill / review_skills_batch, and registry search / list / get / trust lookups — work anonymously and only read public registry data. Write tools ( upload_packages, request_primitive) require an OAuth bearer or a personal access token. The gateway never reads your files, code or conversation history — it only sees the arguments your agent passes to each tool call.

Data flow: your agent calls the gateway over HTTPS; the gateway returns signed package content from the public registry. Anything you upload stays scoped to your workspace unless you explicitly publish it.

Telemetry opt-out: the CLI sends anonymized install telemetry only; disable it with SUPER_AGENT_TELEMETRY=0.

Verify packages yourself on each package's Trust page (/marketplace/trust/<slug>, linked from every marketplace listing) and report vulnerabilities via SECURITY.md.