Skillbox treats agent prompts like code with revision control and scoped permissions

Skillbox is a self-hosted skills library for AI agents: a versioned, permission-gated store of reusable instruction packages that agents can discover, load, and apply through MCP or a CLI. The core idea is that prompts and procedural knowledge deserve the same treatment as code — revisions, conflict detection, restore points, and explicit grants — rather than being scattered across dotfiles or baked into system prompts.

The architecture is deliberately single-owner. One admin token governs everything; scoped client keys are issued per agent or integration, shown once, and only their hashes are stored. Revoking a key blocks future fetches but cannot retract files already downloaded — the README is explicit about that limit. Profiles carry independent permissions for creating, updating, archiving, and proposing skills, so you can give an agent write access without giving it owner access.

The MCP surface covers both HTTP and a Node/Bun stdio bridge for clients that need it. Base MCP Resources are exposed alongside the tool layer, and there is a compatibility audit command for checking existing packages against the emerging native skills protocol — though the README is careful to note that full io.modelcontextprotocol/skills support is not yet advertised, pending SDK upgrades.

The optional Jev recommendation layer is worth understanding precisely. It sends task text and authorized skill descriptions to either Vercel AI Gateway or TypeSafe AI using your own API key — never a shared application account. The relevance score is an uncalibrated 0–4 rubric, not a probability. Scores below 3 are dropped. The catalog cap is 200 leaf skills or 120,000 serialized characters; beyond that, the system falls back to PostgreSQL full-text search rather than silently ranking a truncated subset. That fallback is explicit in the response: method=search, relevance=null, and a fallbackReason field.

Security posture is conservative throughout. Skillbox never executes uploaded skill code. Fetching validates every path, file hash, size, and executable flag before writing atomically. The admin token is the encryption key for stored provider credentials via AES-256-GCM; changing it makes those credentials unreadable, and the README flags this prominently before the rotation guidance.

Setup requires Docker with Compose v2 and Bash. The setup script generates a .env with unique random credentials at mode 0600 and refuses to overwrite an existing one. No host Bun or Node installation is needed for the Docker path. A local development path exists for those who already have Bun and their own PostgreSQL 16+ instance.

What Skillbox is not: a multi-tenant SaaS, a hosted catalog, or an automatic connection to any paid provider. A new instance starts completely empty. That restraint is a design choice, not an omission.