Inspiration

Most AI agents fail not because they are weak, but because they have no good instructions. The best SKILL.md files are scattered across GitHub, and loading them blindly is risky. One prompt injection can hijack an agent. We wanted one link that gives any agent safe, searchable skills with zero setup.

What it does

SkillsWebMcp is a WebMCP + MCP server with 4,986 agent skills from 22 GitHub repos, all security-audited for prompt injection.

Any agent opens this and can use it like its own MCP server: https://swmcp.vercel.app/api/webmcp/intro

Live demo: https://swmcp.vercel.app/ Open source: https://github.com/AbinashBalaraman/skills-webmcp

How I built it

Node + Express + TypeScript backend, React + Vite + Tailwind frontend.

  • Scrape GitHub for SKILL.md, check license, audit content, store by SHA
  • Expose 2 tools: search_skills and get_skill_manual
  • Serve 3 ways: browser WebMCP via document.modelContext, classic MCP JSON-RPC, plain REST + GET for small LLMs
  • Ship a 9.5MB gzipped snapshot so Vercel cold-starts in seconds

Challenges I ran into

Literal search failed. waterfall animation returned 0 hits. We fixed it by teaching agents to decompose tasks like professionals first — animation, 3d, canvas, shader, gsap — then search each domain.

Accomplishments that we're proud of

  • 4,986 skills, 100% audited, live and fast
  • Any LLM works with 2 calls, no browser or config needed
  • Real proof: an agent built a working WebGL waterfall page from our skills alone

What I learned

Small models are not dumb, they just need clearer steps. A short quickStart + primaryTools + GET fallback helped more than any protocol change.

Token math proved progressive disclosure wins:

$$tokens_{saved} = 4986 \times schema_{size} - (search + manual)$$

What's next for skillswebmcp

Daily auto-refresh for more repos, better domain ranking, and one-click deploy so anyone can host their own copy in a minute.

Built With

Share this project:

Updates

Submission history