From a9de283ffe99de0d08232e63f3e6110aafe23b1c Mon Sep 17 00:00:00 2001 From: CWF Date: Thu, 23 Apr 2026 15:19:15 +0800 Subject: [PATCH 1/2] fix: remove .mcp.json to stop shadowing user-scope skillsmp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The committed project-scope .mcp.json registered a keyless skillsmp MCP server that overrode the user-scope registration carrying SKILLSMP_API_KEY. Because project-scope takes precedence, the actually-running server had no API key and SkillsMP calls silently failed. Drop the file entirely — a public repo cannot carry the secret, and README §SkillsMP + /fetch-skill-config already guide users to register via `claude mcp add --scope user`, which is the working path. Co-Authored-By: Claude Opus 4.7 --- .mcp.json | 6 ------ CHANGELOG.md | 6 ++++++ 2 files changed, 6 insertions(+), 6 deletions(-) delete mode 100644 .mcp.json diff --git a/.mcp.json b/.mcp.json deleted file mode 100644 index be6d8fa..0000000 --- a/.mcp.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "skillsmp": { - "command": "npx", - "args": ["-y", "skillsmp-mcp-server"] - } -} diff --git a/CHANGELOG.md b/CHANGELOG.md index 7fa1ebd..47f01dc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## [Unreleased] + +### Removed + +- **`.mcp.json`** — Removed to avoid shadowing the user-scope `skillsmp` MCP registration. The committed project-scope file could not carry `SKILLSMP_API_KEY` (public repo), and because project-scope `.mcp.json` takes precedence over user scope, it caused a second, keyless `skillsmp` server to supersede the properly-configured one registered via `claude mcp add --scope user`. Users should follow the README's SkillsMP setup (or run `/fetch-skill-config`) to register the MCP server with their API key. + ## [1.4.1] - 2026-04-23 ### Fixed From ecbdfed1753b66fdd5cc4f9bec6717facd2eb16a Mon Sep 17 00:00:00 2001 From: CWF Date: Thu, 23 Apr 2026 15:26:40 +0800 Subject: [PATCH 2/2] chore: bump to 1.4.2 and finalize CHANGELOG Move the MCP shadow fix from [Unreleased] to [1.4.2] and bump plugin.json so plugin consumers picking up skill-fetch@latest get the fix on next update. Co-Authored-By: Claude Opus 4.7 --- .claude-plugin/plugin.json | 2 +- CHANGELOG.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 2f90a84..dc99680 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "skill-fetch", - "version": "1.4.1", + "version": "1.4.2", "description": "Search, discover, and install AI agent skills from 9 registries with quality scoring, security labels, and cross-platform support", "author": { "name": "girofu", diff --git a/CHANGELOG.md b/CHANGELOG.md index 47f01dc..9897c54 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,10 @@ # Changelog -## [Unreleased] +## [1.4.2] - 2026-04-23 -### Removed +### Fixed -- **`.mcp.json`** — Removed to avoid shadowing the user-scope `skillsmp` MCP registration. The committed project-scope file could not carry `SKILLSMP_API_KEY` (public repo), and because project-scope `.mcp.json` takes precedence over user scope, it caused a second, keyless `skillsmp` server to supersede the properly-configured one registered via `claude mcp add --scope user`. Users should follow the README's SkillsMP setup (or run `/fetch-skill-config`) to register the MCP server with their API key. +- **SkillsMP MCP shadow bug (plugin installs)**: v1.4.1 shipped a `.mcp.json` at repo root that registered a project-scope `skillsmp` MCP server with no `SKILLSMP_API_KEY`. Because the entire repo is the plugin payload (`marketplace.json` → `source: "./"`), every plugin-installed user had this keyless server override their user-scope `skillsmp` registration (where the API key lives), causing SkillsMP semantic + keyword search (Sources 1-2) to silently fail. Fix: remove `.mcp.json`. Users should register the server once at user scope via `claude mcp add --scope user skillsmp -- npx -y skillsmp-mcp-server --env SKILLSMP_API_KEY=...` (or run `/fetch-skill-config`). `npx skills add` / `install.sh` / `install.py` install paths were unaffected — they only copy `skills/skill-fetch/*`, not repo-root files. ## [1.4.1] - 2026-04-23