mthamil107

Skills Gateway — Security skill for Claude Code

Security community

Governed, identity-aware server for Agent Skills (SKILL.md): OIDC + default-deny policy per fetch, immutable digest-verified versions, audit log, native sync for every coding agent, and MCP (SEP-2640).

How to install Skills Gateway

This entry records only its repository, not the path inside it, so there is no exact command to give. Open mthamil107/skills-gateway and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Skills Gateway does

Alternatives in Security

Google Workspace Cloud Identity — Manage Cloud Identity groups and memberships 21.6k ★
Azure Identity Go — Azure Identity for Go 1.8k ★
ThinkWatch — Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII 817 ★

README

Skills Gateway

**A governed, identity-aware server for [Agent Skills](https://agentskills.io).** Publish a skill once. Every agent in the organisation (Claude Code, Codex, Cursor, Copilot, Gemini CLI, Kiro, Windsurf) receives the skills its user is allowed to use, in the layout that agent expects, with a verifiable digest and an audit trail.

            publish (OIDC identity, policy check, immutable version)
  author ─────────────────────────────────────────────┐
                                                       ▼
                                          ┌──────────────────────┐
                                          │    Skills Gateway    │
                                          │ OIDC · policy · audit│
                                          │ SQLite · digests     │
                                          └──┬────────┬───────┬──┘
                          REST /v1           │        │       │  MCP /mcp (SEP-2640 + tools)
                 ┌───────────────────────────┘        │       └─────────────────┐
                 ▼                                    ▼                         ▼
          sgw sync / CI                         any HTTP client            MCP clients
   .claude/skills  .agents/skills                                    skills/list, skills/get,
   .cursor/skills  .github/skills  ...                               list_skills, get_skill

**Status: v0.1, early.** The API and the [protocol spec](docs/spec/skills-gateway-protocol.md) can still change. Feedback and issues are welcome.

Why

Agent Skills made the skill *format* portable: `SKILL.md` directories are now read natively by every mainstream coding agent. Distributing skills inside an organisation is still mostly file copying. Nothing records who may use which skill, pins what a project installed, or shows who fetched what.

Skills Gateway adds that layer, and it is small enough to run as one binary: