Self-hosted · Open source
Agent skills, with a release process.
Skill Dock is a self-hosted registry for agent skills. Bundles live in your npm registry. The catalog decides which release an agent gets and records every change to that decision.
docker compose up --build -dStarts the catalog, Postgres, and a local npm registry.
- integrity
- sha512-9f2c…
- manifest
- sha256:6a1d…
- policy
- resolvable
Example release record
Agent coverage
One CLI, 56 agent targets.
The same bundle installs into Claude Code, Codex, Cursor, OpenCode, and the directories other agents read. Choose project or global scope.
- Claude Code
- Codex
- Cursor
- OpenCode
- GitHub Copilot
- Gemini CLI
- Windsurf
- Cline
- Amp
- Goose
- Kiro
- Qwen Code
- Trae
- Zed
- Continue
- Roo
- Crush
- OpenHands
- Junie
- Mux
Release discipline
A git ref is not a release.
A skill can change how an agent works. It can also ship scripts. If the source is a branch, the same name can point at different files tomorrow. Skill Dock gives each bundle an exact version, an integrity hash, and a record of whether it is installable.
Exact versions
Install 1.4.0, not whatever happens to be on main.
Verified bytes
The CLI checks the tarball integrity and the SKILL.md digest before it writes files.
One release record
Published, deprecated, and yanked are catalog states, not npm dist-tags.
An audit trail
Every lifecycle change stores the actor, reason, and time.
How it works
Publish, resolve, govern.
The catalog sits between the CLI and your npm registry. It decides what a version means and who can install it.
Package the source, then write the release record.
The catalog validates SKILL.md, normalizes the source, builds the tarball, and publishes it to your npm registry. The version becomes installable only after the catalog writes its release record.
skills publish ./my-skillResolve a version, then verify it.
The CLI asks the catalog for an install target. The response pins the version, integrity, and manifest digest. The CLI downloads the tarball and checks all three before it writes to an agent directory.
skills add @acme.skill/my-skill --version 1.4.0Change access without moving bytes.
Retire a skill, deprecate a version, or yank it. The tarball stays in npm. The next install resolution follows the new policy.
POST /api/v1/skills/@acme.skill%2Fmy-skill/versions/1.4.0/governance-changesWhat the catalog owns
The catalog layer.
Your npm registry already stores packages. The catalog adds the release decisions that packages do not carry.
Release records
Each version is a package name and an exact semver. Published versions are immutable. The record carries integrity, manifest digest, and components.
Install resolution
The server picks the latest resolvable version. It does not fall back to an older release or guess from dist-tags.
Lifecycle
Retire a skill. Deprecate or yank a version. Set an install policy. Add a replacement recommendation.
Audit
Governance changes and audit events record the actor, target, reason, and time.
npm storage
Bundles live in Nexus, Artifactory, Verdaccio, or another npm-compatible registry. Keep your retention, replication, and scanning.
Delivery
Fetch tarballs through the catalog proxy, or let clients go direct to the registry with their own npm credentials.
Architecture
Three pieces, one release path.
The catalog is a service you run. Postgres holds release records and governance data. Your npm registry holds the bundle bytes. The CLI runs on a developer machine or in CI.
Catalog
Owns release records, install resolution, lifecycle state, and audit events. It never stores bundle bytes.
The catalog never stores bundle bytes. It stores the release record, the manifest digest, and the install policy. The npm registry stores the tarball.
Quick start
Run it locally.
The Compose stack starts the catalog, Postgres, and a local npm registry. You can swap the registry for Nexus or Artifactory when you deploy.
- 01
Clone and configure
Replace the sample passwords and tokens in .env before you start the stack.
git clone https://github.com/ZenlixAI/skill-dock.gitcd skill-dockcp .env.example .env - 02
Start the stack
Compose starts the catalog, Postgres, and a local npm registry.
docker compose up --build -dcurl -fsS http://localhost:8080/readyz
- 01
Build the CLI
The CLI lives in the same repository. Install it globally after the build.
npx -y pnpm@10.17.1 --dir apps/skills-cli installnpx -y pnpm@10.17.1 --dir apps/skills-cli buildnpm install -g ./apps/skills-cli - 02
Point it at the catalog
Use the publisher token for authoring. Use the reader token for installs.
export SKILLS_REGISTRY_URL=http://localhost:8080export SKILLS_REGISTRY_TOKEN=<publisher-token> - 03
Publish and install
The example uses the scoped package name the catalog expects.
skills import-local ./my-skill \ --package-name @acme.skill/my-skill \ --version 1.4.0 skills add @acme.skill/my-skill
For production, use zarf/compose/production.yml, set SKILL_REGISTRY_ARTIFACT_READ_URL to your npm registry, and put the catalog behind TLS.
FAQ
Questions that come up.
Short answers to the questions that come up before a first deployment.
No. Skill Dock stores release metadata and resolves tarball URLs. The bundle bytes stay in your npm registry.
Start here
Start with the catalog.
The repository has a Compose stack, a production Compose file, and the CLI source. No hosted account is required.