Content
# MCP Skill Hub
🚀 **Enterprise-grade MCP Skill Marketplace and Distribution Platform**
[](https://golang.org)
[](LICENSE)
[](https://hub.docker.com)
---
## 📖 Introduction
MCP Skill Hub is a standardized **Model Context Protocol (MCP) Skill Release and Discovery Platform**, helping enterprises and individual developers:
- 📦 **Publish Skills**: Encapsulate custom capabilities as standard MCP skills
- 🔍 **Discover Skills**: Browse, search, and rate high-quality skills
- 🔐 **Secure Distribution**: Enterprise-grade permission control and audit logs
- 🚀 **One-click Deployment**: Docker self-hosting, complete data control
> Similar to "npm for Agent Skills" — making AI Agent capabilities as easy to share and reuse as Node.js packages
---
## ✨ Core Features
### For Skill Consumers
- 🔍 Intelligent Search: Filter by category, rating, and download count
- 📊 Quality Rating: Based on code quality, community activity, and security scanning
- 🔐 Security Verification: Automatic scanning for malicious code and permission abuse
- 📥 One-click Installation: `mcp install <skill-name>`
### For Skill Developers
- 📦 Standardized Publishing: Following MCP protocol specifications
- 📈 Data Analysis: Download count, user feedback, and usage statistics
- 🔖 Version Management: Semantic version control
- 💰 Commercial Support: Paid skills and subscription model (future versions)
### For Enterprises
- 👥 Permission Management: RBAC role-based permission system
- 📋 Audit Logs: Complete operation tracking
- 🔒 Private Repository: Intranet isolated deployment
- 🛡️ Security Compliance: SOC2-ready architecture
---
## 🚀 Quick Start
### Docker Deployment (Recommended)
```bash
# 1. Clone repository
git clone https://github.com/qycnet/mcp-skill-hub.git
cd mcp-skill-hub
# 2. Configure environment variables
cp .env.example .env
# Edit .env file with actual configuration
# 3. Install Trivy (required for security scanning)
# macOS
brew install trivy
# Ubuntu/Debian
sudo apt-get install trivy
# or visit https://aquasecurity.github.io/trivy/latest/getting-started/installation/
# 4. Start with one command
make docker-up
# 5. Access services
# Web interface: http://localhost:8080
# API: http://localhost:8080/api/v1
# MinIO Console: http://localhost:9001
```
> ⚠️ **Important Security Configuration**:
> - Must configure `JWT_SECRET` (at least 32 characters)
> - Must configure `DATABASE_PASSWORD` (strong password)
> - Must configure `STORAGE_SECRET_KEY` (MinIO key)
> - Production environment must configure `CORS_ALLOWED_ORIGINS` (specific domain)
> - Otherwise, the service cannot start
### Local Development
```bash
# Install dependencies
go mod download
# Start service
make dev
# Run tests
make test
# Frontend development
cd web && npm install && npm run dev
```
### CLI Tool
```bash
# Install
cd cli && go install
# Login
mcp login
# Search skills
mcp search "code analysis"
# Install skill
mcp install claude-context
# Publish skill
mcp publish ./my-skill
```
---
## 📦 Usage Examples
### Web Interface
Visit http://localhost:8080 to browse the skill marketplace:
- Homepage: Popular skills, high-rated skills, and search
- Skill Library: Filter, sort, and paginate
- Skill Details: Information, versions, ratings, and comments
- Personal Center: Profile, my skills, and API keys
- Publish Skill: Upload ZIP or manually fill in
### REST API
```bash
# Get skill list
curl http://localhost:8080/api/v1/skills
# Search skills
curl "http://localhost:8080/api/v1/search?q=code"
# Get skill details
curl http://localhost:8080/api/v1/skills/1
# User registration
curl -X POST http://localhost:8080/api/v1/auth/register \
-H "Content-Type: application/json" \
-d '{"username":"test","email":"test@example.com","password":"secure123"}'
# User login
curl -X POST http://localhost:8080/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"secure123"}'
```
---
## 🏗️ Architecture Design
```
┌─────────────────────────────────────────────────────────────┐
│ MCP Skill Hub │
├─────────────────────────────────────────────────────────────┤
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────┐ │
│ │ Web UI │ │ CLI Tool │ │ REST API /gRPC │ │
│ │ (React) │ │ (Go) │ │ (Go) │ │
│ └──────┬──────┘ └──────┬──────┘ └──────────┬──────────┘ │
│ │ │ │ │
│ └────────────────┼──────────────────────┘ │
│ │ │
│ ┌───────────▼───────────┐ │
│ │ Core Services │ │
│ ├───────────────────────┤ │
│ │ - Skill Registry │ │
│ │ - Search Engine │ │
│ │ - Auth & RBAC │ │
│ │ - Security Scanner │ │
│ │ - Analytics │ │
│ └───────────┬───────────┘ │
│ │ │
│ ┌────────────────┼────────────────┐ │
│ │ │ │ │
│ ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼──────┐ │
│ │ PostgreSQL │ │ MinIO │ │ Redis │ │
│ │ (Metadata) │ │ (Storage) │ │ (Cache) │ │
│ └─────────────┘ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────┘
```
---
## 📁 Project Structure
```
mcp-skill-hub/ (open-source version)
├── cmd/
│ └── server/
│ └── main.go # main service entry
├── internal/
│ ├── api/ # HTTP handlers
│ │ ├── handlers.go # skill CRUD interface
│ │ └── auth_handlers.go # authentication interface
│ ├── auth/ # authentication service (JWT)
│ │ ├── model.go # User/APIKey model
│ │ ├── service.go # JWT/password encryption
│ │ ├── middleware.go # JWT middleware
│ │ └── service_test.go # unit test
│ ├── skill/ # skill management
│ │ ├── model.go # Skill data model
│ │ ├── service.go # CRUD logic
│ │ ├── service_test.go # unit test
│ │ └── upload.go # ZIP upload/parse
│ ├── cache/ # Redis cache
│ │ └── service.go # cache service
│ ├── i18n/ # internationalization
│ │ ├── locales.go # translator
│ │ └── translations/ # translation files
│ │ ├── locale_en.json # English
│ │ └── locale_zh.json # Chinese
│ ├── middleware/ # middleware
│ │ ├── ratelimit.go # rate limiting
│ │ └── audit.go # audit log
│ ├── storage/ # object storage
│ │ └── minio.go # MinIO integration
│ └── email/ # email service
│ └── service.go # SMTP email
├── cli/ # command-line tool (16 files)
│ ├── cmd/mcp/ # 11 commands
│ │ ├── main.go # CLI entry
│ │ ├── login.go # login
│ │ ├── search.go # search
│ │ ├── install.go # install
│ │ ├── list.go # list
│ │ ├── info.go # details
│ │ ├── publish.go # publish
│ │ ├── update.go # update
│ │ ├── uninstall.go # uninstall
│ │ ├── version.go # version
│ │ ├── config.go # configuration
│ │ └── whoami.go # current user
│ ├── internal/ # CLI internal library
│ │ ├── api/client.go # API client
│ │ └── config/config.go # configuration loading
│ └── README.md # CLI documentation
├── web/ # React frontend (15 files)
│ ├── src/
│ │ ├── pages/ # 8 pages
│ │ │ ├── HomePage.jsx # homepage
│ │ │ ├── SkillListPage.jsx # skill list
│ │ │ ├── SkillDetailPage.jsx # skill details
│ │ │ ├── LoginPage.jsx # login/register
│ │ │ ├── ProfilePage.jsx # profile
│ │ │ ├── PublishPage.jsx # publish skill
│ │ │ ├── PricingPage.jsx # pricing
│ │ │ └── SubscriptionPage.jsx # subscription management
│ │ ├── components/ # reusable components
│ │ │ ├── Layout.jsx # layout
│ │ │ └── LanguageSwitcher.jsx # language switcher
│ │ ├── stores/ # state management
│ │ │ └── authStore.js # authentication state
│ │ └── api/ # API client
│ │ └── client.js # Axios wrapper
│ └── (configuration files)
├── docs/ # documentation
│ ├── QUICKSTART.md # 5-minute quick start
│ └── SNYK_SETUP.md # Snyk configuration
├── .github/workflows/ # CI/CD
│ ├── ci.yml # continuous integration
│ └── snyk.yml # security scanning
├── docker-compose.yml # Docker orchestration
├── Dockerfile # production image
├── Makefile # build commands
├── go.mod # Go dependencies
├── README.md # project introduction
├── CONTRIBUTING.md # contribution guide
└── LICENSE # MIT license
```
---
## 🔐 Security Features
### Core Security Functions
- ✅ **Security Scanning**: Integrated Trivy for automatic vulnerability scanning (HIGH/CRITICAL blocking)
- ✅ **Sandbox Isolation**: Docker container isolation execution, resource limitation (memory/CPU/PID)
- ✅ **Password Encryption**: bcrypt for password hashing
- ✅ **JWT Authentication**: JWT-based stateless authentication mechanism (at least 32-character key)
- ✅ **Permission Isolation**: RBAC-based fine-grained permission control
- ✅ **Rate Limiting**: Multi-level limiting (IP/user/API endpoint), preventing abuse and DDoS
- ✅ **CORS Hardening**: Production environment forces specific domain configuration
- ✅ **Security Configuration**: Sensitive information requires environment variable configuration, no default weak password
- ✅ **Transaction Processing**: Database transactions ensure data consistency
- ✅ **Audit Logs**: Complete operation tracking (enterprise version)
### Sandbox Security Measures
- 🐳 Container isolation execution
- 🔒 Read-only file system mounting
- 👤 Non-root user running (UID 1000)
- 🌐 Network isolation (default no network access)
- ⏱️ Timeout control (default 30 seconds)
- 📊 Resource limitation (memory 512m, CPU 1.0, PIDs 100)
### Planned Features
- 🚧 **Skill Signature**: GPG signature verification
- 🚧 **WebAssembly Runtime**: Lightweight isolation instead of Docker
---
## 📊 Quality Rating System
Skill quality rating (out of 100):
| Dimension | Weight | Evaluation Indicators |
|------|------|----------|
| Code Quality | 25% | Test coverage, Lint score, documentation completeness |
| Security | 25% | Vulnerability scanning, permission minimization, signature verification |
| Community Activity | 20% | Download count, rating, issue response speed |
| Compatibility | 15% | MCP protocol version, cross-platform support |
| Maintainability | 15% | Version update frequency, backward compatibility |
---
## 🧪 Testing
```bash
# Run all tests
make test
# With coverage
go test -cover ./...
# Generate coverage report
go test -coverprofile=coverage.out ./...
go tool cover -html=coverage.out
```
---
## 🛡️ Security Best Practices
### Production Environment Deployment Checklist
- [ ] **Configure Strong Keys**
```bash
# Generate strong JWT key (at least 32 characters)
openssl rand -base64 32
# Generate database password
openssl rand -base64 24
```
- [ ] **Configure CORS**
```bash
# .env
CORS_ALLOWED_ORIGINS=https://yourdomain.com,https://app.yourdomain.com
```
- [ ] **Enable Security Scanning**
```bash
# Install Trivy
brew install trivy # macOS
sudo apt-get install trivy # Ubuntu
# Configure environment variables
SECURITY_SCAN_ENABLED=true
TRIVY_PATH=trivy
```
- [ ] **Configure Rate Limiting**
```bash
# Default limits are configured in the code
# Login: 1 req/s
# Search: 5 req/s
# Admin: 20 req/s
```
- [ ] **Enable Audit Logs** (Enterprise Edition)
```bash
AUDIT_ENABLED=true
AUDIT_RETENTION_DAYS=90
```
### Security Scanning Workflow
```
Skill upload → ZIP parsing → Trivy scanning → Vulnerability assessment
↓
HIGH/CRITICAL → Block upload
MEDIUM/LOW → Allow upload + Warning
```
### Sandbox Execution Process
```
Skill execution request → Create container → Resource limits → Execution → Cleanup
↓
- Memory: 512m
- CPU: 1.0
- Network: None
- User: UID 1000
- Filesystem: Read-only
```
---
## 📚 Documentation
- [Quick Start](docs/QUICKSTART.md) - Get started in 5 minutes
- [Contributing Guide](CONTRIBUTING.md) - How to contribute code
---
## 🤝 Contributing
We welcome contributions of all kinds!
```bash
# Fork and clone
git clone https://github.com/YOUR_USERNAME/mcp-skill-hub.git
cd mcp-skill-hub
# Create a branch
git checkout -b feature/your-feature
# Develop and commit
git commit -m "feat: add new feature"
# Submit a PR
```
See [CONTRIBUTING.md](CONTRIBUTING.md) for details.
---
## 📄 License
MIT License - See [LICENSE](LICENSE)
---
## 📬 Contact Us
- 🐛 Bug reports: [GitHub Issues](https://github.com/qycnet/mcp-skill-hub/issues)
- 💬 Discussions: [GitHub Discussions](https://github.com/qycnet/mcp-skill-hub/discussions)
- 📧 Email: tian@qycnet.cn
---
## 🗺️ Roadmap
### v0.2.0 (Current - Security Hardening)
- [x] Security scanning integration (Trivy)
- [x] Docker sandbox isolation execution
- [x] Database transaction support
- [x] Rate limiting middleware
- [x] CORS security hardening
- [x] Remove default weak passwords
- [x] Audit log implementation (Enterprise Edition)
- [x] Data analysis implementation (Enterprise Edition)
### v0.1.0
- [x] Basic API framework
- [x] User authentication (JWT)
- [x] Skill CRUD
- [x] Docker deployment
- [x] CORS support
### v0.3.0 (Planned)
- [ ] WebAssembly runtime support
- [ ] Integration testing improvements
- [ ] 80% test coverage
- [ ] GPG signature verification
### v0.4.0 (Planned)
- [ ] Paid skill support
- [ ] Subscription model
- [ ] Multi-tenancy support
### v1.0.0 (Target)
- [ ] Production-ready
- [ ] Multi-language support
- [ ] Enterprise SSO
- [ ] Kubernetes Helm Chart
---
<div align="center">
**Made with ❤️ by the MCP Skill Hub Team**
[📚 Full Documentation](docs/) | [🚀 Quick Start](docs/QUICKSTART.md) | [📝 Changelog](CHANGELOG.md) | [💬 Community Discussion](https://github.com/qycnet/mcp-skill-hub/discussions)
</div>
