> ## Documentation Index
> Fetch the complete documentation index at: https://docs.0mcp.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Skills over MCP

> Create, publish, and test Agent Skills through the experimental SEP-2640 MCP extension.

0mcp can publish text-only [Agent Skills](https://agentskills.io/specification) through the draft `io.modelcontextprotocol/skills` extension. The feature follows the latest SEP-2640 draft. It does not support the older `skill://index.json` convention.

<Warning>
  Skills over MCP is experimental. SEP-2640 can change before it becomes an accepted MCP extension. Your MCP client must explicitly support the extension to discover and load skills automatically.
</Warning>

## Create or import a skill

Open your server and select **Skills** in the left navigation. Click **Create or import skill**.

You can:

* paste or edit a `SKILL.md` file;
* import a local folder; or
* add and edit supporting text files in 0mcp.

0mcp accepts `.md`, `.txt`, `.json`, `.yaml`, `.yml`, `.toml`, and `.csv` files. It rejects binaries, symlinks, executables, unsupported file types, and invalid paths. An import succeeds only when every file passes validation.

Each skill must contain a root `SKILL.md` with valid YAML frontmatter:

```md theme={null}
---
name: refund-processing
description: Process customer refunds according to company policy.
---

# Refund processing

Follow the approval and verification steps in `references/policy.md`.
```

The `name` becomes the skill path. 0mcp generates the URI and keeps the `skill://` prefix locked:

```text theme={null}
skill://refund-processing/SKILL.md
skill://refund-processing/references/policy.md
```

## Limits and security

One server can contain up to 50 skills. One skill can contain up to 20 files, with a 1 MiB limit per file and a 5 MiB total limit. Paths can contain up to 10 directory levels.

0mcp stores and serves skill files. It never executes uploaded content. Treat skill instructions as untrusted model input.

Published skills use the same authentication boundary as their MCP server. Anyone who can read an unauthenticated server can read its published skills.

## Save and publish

The skill editor uses an explicit **Save draft** action. 0mcp validates and saves the complete file set atomically. If another browser tab changed the skill, reload the latest draft before saving again.

Creating, editing, disabling, or deleting a skill does not change the live MCP endpoint immediately. Publish the new server version to expose the complete skill snapshot. Restoring an older version restores its skill metadata, file URIs, and digests.

The server advertises `io.modelcontextprotocol/skills` only when all of these conditions apply:

* the deployment preview is enabled;
* **Skills over MCP** is enabled for the server; and
* the published version contains at least one enabled skill.

## MCP methods

Compatible clients can use:

| Method                     | Purpose                                                 | Counts as skill usage |
| -------------------------- | ------------------------------------------------------- | --------------------- |
| `skills/list`              | Discover published skills and their digest manifests    | No                    |
| `skills/get`               | Retrieve current metadata and digests for one skill URI | Yes                   |
| `resources/read`           | Read `SKILL.md` or a supporting file                    | Yes                   |
| `resources/directory/read` | List one skill directory's direct children              | No                    |

Each `skills/list` and `skills/get` entry includes the complete frontmatter object and a SHA-256 digest for every file. Clients should verify the exact bytes returned by `resources/read` before using them.

## Test in the Playground

Publish a version that contains an enabled skill. Open **Playground**, then select the **Skills** panel.

The panel lets you:

* run `skills/list` and `skills/get`;
* browse a skill directory;
* read individual files; and
* compare the returned bytes with the advertised SHA-256 digest.

Clients that do not understand the Skills extension can still use your server's tools, ordinary resources, and prompts. They do not automatically discover skills.