Skillery is a directory for the AI capabilities your team builds — the skills, prompts, MCP references, and repos people give their AI tools. Anyone can publish a capability, browse what others have made, and help refine it. A social and curation layer keeps the good ones discoverable and trusted; an embedded MCP server lets your agents do all of it without leaving the editor. It's open source under MIT — fork it and run your own instance.

One Artifact model with a type, so the social and curation machinery is shared across all of them:

Reference types (MCP, Repo) carry a verification status — an admin or an appointed reviewer eyeballs them before they're trusted. Cataloging a reference is low-risk; the risk lives in execution, which Skillery never does.

• Discovery — browse, search, filter, and sort the catalog across Featured, New, Most Liked, and Most Adopted views.
• Get = adoption — the consumption action records who got what, and which revision. The adoption count is real usage, not a vanity number.
• Suggest → approve → promote — a lightweight PR-style revision flow with one owner per artifact. Anyone can suggest a full edit; the owner approves, rejects, and promotes. Rejected suggestions stay in history as social credit.
• Social & curation — hearts, comments, reports, an org-blessed Official badge, contributor and artifact leaderboards, and staleness flagging that nudges owners to review dormant entries.
• Bundles & spaces — curated, versioned sets of artifacts behind one link, and private invite-only groups with their own publish flow.
• The event log is the backbone — adoptions, hearts, comments, and revision actions are rows in one append-only log. Trending, "used by N people," staleness, and leaderboards are all just queries over it; the counters on each artifact are a rebuildable cache.
• MCP server, built in — search / browse / get / preview / submit / suggest_edit / interact / mine / archive, bearer-authed by API tokens, so agents work the catalog directly.
• Bring-your-own auth — OIDC SSO, GitHub, and local email + password accounts; server-side revocable sessions; an admin console for providers and users.

• Self-hostable & forkable — one command to run; portable to any company. MIT-licensed, no copyleft strings.
• Reference, don't execute — MCP and repo entries are metadata behind a vetting gate. Skillery never fetches, runs, or proxies a referenced target.
• Bring-your-own-SSO — works with whatever auth a company already runs, and falls back to local accounts for small teams.

Beta — feature-complete, packaged, and tested on both database engines. The v1 surface (discovery, authoring, social, bundles, spaces, MCP, auth) is built. The integration suite runs green on both SQLite and Postgres (CI runs both engines on every push), and Docker / Compose packaging ships in-repo. What's left before a production-ready tag is a final security-coverage audit (CSRF and rate limits re-verified across every route). A few capabilities remain designed-but-unbuilt — MCP OAuth, a public flagship instance, and role-tiered MCP tooling.

sqlc is invoked through go run (pinned in the Makefile), so no separate install is needed. SQLite is the default database and is pure-Go (modernc.org/sqlite) — no C toolchain or external server required.

Prefer containers? Run with Docker instead — no local Go or Node needed.

The frontend must be built before the backend: the Go binary embeds frontend/dist via go:embed, so that directory has to exist before go build / go run.

export SKILLERY_SESSION_SECRET="$(openssl rand -base64 48)"
export SKILLERY_SECRETS_KEY="$(openssl rand -base64 32)"
make run

make run builds the frontend (pnpm install --frozen-lockfile && pnpm build), builds the server to ./bin/skillery with CGO_ENABLED=0, and runs it. The session signing secret and the provider-secret encryption key have no dev default — the boot refuses to start without them.

By default it listens on :8080 — open http://localhost:8080. It writes a SQLite database to skillery.db in the working directory and applies migrations on boot.

Before exposing an instance: local-account signup is open by default, and the first account to sign up becomes admin. Claim the admin account while the instance is still private, then turn open signup off (or restrict it to an allowed email-domain list) in Auth Settings — see the hardening checklist in docs/DEPLOY.md.

The multi-stage Dockerfile builds everything and ships a ~17 MB distroless/static image running as a non-root user. The included docker-compose.yml brings up Skillery + Postgres 16:

cp env.example .env    # then set the two required secrets in .env
docker compose up --build

For a standalone container (your own database, SQLite volume, reverse-proxy notes), see the Docker section of docs/DEPLOY.md.

Once frontend/dist exists, you can iterate on the backend directly:

go run ./cmd/skillery
go run ./cmd/skillery -no-migrate   # skip applying migrations on boot

Configuration is YAML with ${VAR:-default} env-expansion; the default file is configs/dev.yaml. The block above is the minimal local run — every value has a dev default except SKILLERY_SESSION_SECRET and SKILLERY_SECRETS_KEY, which are required and fail the boot loudly when unset.

For production — the full configuration reference, database/Postgres setup, TLS and reverse-proxy requirements, OIDC provider callbacks, admin bootstrap, and the pre-exposure hardening checklist — see docs/DEPLOY.md.

Frontend hot-reload during development: cd frontend && corepack pnpm dev.

• cmd/skillery/ — server entry point (config → logger → db → HTTP, LIFO shutdown).
• internal/ — library code: db (the SQLite/Postgres store seam), web (Inertia delivery), httpserver, config, events, and supporting packages.
• internal/db/migrations/ — goose migrations, embedded package-locally.
• frontend/ — Svelte + Vite sources, built and embedded into the binary.
• docs/ — deployment and operational documentation.

Contributions are welcome — CONTRIBUTING.md covers setup, the test commands, and PR expectations. Security issues go to SECURITY.md, never the public tracker.

Skillery was built spec-first and human-directed, with substantial help from AI coding assistants — Claude (Anthropic) and Codex (OpenAI). The design, the code, and the docs were written in collaboration with them under human review and direction.

MIT © 2026 Mohammad AlGhezawi