Agent tooling · source implementation
Finding a capability is only the beginning
A skill registry that separates discovery, package inspection, policy and execution across agent environments.
- My part
- Developed the registry with coding agents, separating discovery, package inspection, policy decisions and execution.
- Where it stands
- Source implementation with MCP and client interfaces. This story describes the mechanisms; it is not a formal security assessment or fresh execution test.
I’ve been developing a skill registry with coding agents: a way to find and inspect reusable capabilities and make them available across different agent environments.
The repository contains discovery and ranking, manifests describing a skill’s files, verification of those files, policy checks and an execution path. It exposes an MCP server and client interfaces.
Make the stages distinguishable
A search result can explain why it ranked. A package can describe the files that belong to it. Execution can require an explicit entrypoint and an approval decision. Finding something relevant is only one of those steps.
The source includes a fresh-container execution path with network isolation at runtime. Dependency preparation and execution have different behavior and need to be understood separately. This is an implementation mechanism, not a blanket assurance that arbitrary code is safe.
What this account establishes
The implementation and its source are the work sample here. This account does not present a fresh sandbox run or a formal security assessment. I’m interested in what an agent—and the person responsible for it—can know before taking the next step.
From relevance to action
A simplified reading of the registry’s stages.
Discover
Find candidates and inspect why they match the task.
Inspect
Read the manifest, package contents and verification information.
Decide
Apply policy and any required approval before execution.
Run and examine
Use a declared execution path and inspect its result and artifacts.