diff --git a/README.md b/README.md index 0da5bdd..ac91912 100644 --- a/README.md +++ b/README.md @@ -32,13 +32,19 @@ SkillSpector helps you answer: **"Is this skill safe to install?"** Create and activate a virtual environment first (all `make` targets assume the venv is active). Use **uv** or **pip**; the Makefile uses `uv` if available, otherwise `pip`. -**Quick install with uv (no clone required):** +**Quick install with uv (CLI-only):** ```bash uv tool install git+https://github.com/NVIDIA/skillspector.git # Update later: uv tool update skillspector ``` +If you plan to run `skillspector mcp`, install the MCP extra at install time: + +```bash +uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git' +``` + **From source:** ```bash @@ -228,17 +234,22 @@ runtime can call scanning as a tool and **gate skill/MCP installs on the result** — turning SkillSpector into a runtime guardrail instead of an out-of-band audit step. +`skillspector mcp` requires `skillspector[mcp]`. + ```bash -# Install the optional MCP dependency -pip install "skillspector[mcp]" +# Install, or reinstall if you already used the CLI-only path +uv tool install --force 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git' -# stdio transport — for local CLI agents +# FastMCP stdio transport for local CLI agents skillspector mcp -# streamable HTTP/SSE transport — for remote / A2A callers +# streamable HTTP/SSE transport for remote / A2A callers skillspector mcp --transport http --host 127.0.0.1 --port 8000 ``` +The stdio transport is the current FastMCP path for local CLI agents, and the +initialize hang reported in issue #199 still applies there. + The server exposes a single tool: - **`scan_skill(target, use_llm=true, output_format="json")`** — scans a Git diff --git a/src/skillspector/cli.py b/src/skillspector/cli.py index 181a167..caa6d5d 100644 --- a/src/skillspector/cli.py +++ b/src/skillspector/cli.py @@ -440,7 +440,7 @@ def mcp( typer.Option( "--transport", "-t", - help="Transport: stdio for local CLI agents, http for remote/A2A callers.", + help="Transport: FastMCP stdio for local CLI agents, http for remote/A2A callers.", case_sensitive=False, ), ] = TransportChoice.stdio, @@ -460,12 +460,13 @@ def mcp( Codex CLI, Gemini CLI) or remote runtime can scan a skill and gate installs on the verdict. + Requires the optional mcp extra. Reinstall the GitHub tool package with + that extra enabled, as shown in the README Quick Start section. + Examples: - skillspector mcp # stdio (local agents) + skillspector mcp # FastMCP stdio for local CLI agents skillspector mcp --transport http --port 8000 - - Requires the optional ``mcp`` dependency: pip install "skillspector[mcp]". """ try: from skillspector.mcp_server import run as run_mcp