Drop the setup skill; move auth recovery into the error path

.claude-plugin/marketplace.json

@@ -1,5 +1,6 @@
 {
   "name": "walkerhughes-mcps",
+  "description": "MCP servers that give agents direct access to external services: the Harbor evaluation hub, with more to come.",
   "owner": {
     "name": "Walker Hughes",
     "url": "https://github.com/walkerhughes"

harbor-mcp/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harbor-mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "MCP server for the Harbor hub: inspect evaluation jobs, trials, and uploads; publish tasks and datasets when writes are enabled.",
   "author": {
     "name": "Walker Hughes"

harbor-mcp/README.md

@@ -20,7 +20,7 @@ Two separate commands. The first opens a prompt that expects only the `owner/rep
 
 Requires [`uv`](https://docs.astral.sh/uv/) on your PATH; the plugin builds its own environment from the checked-in `uv.lock` on first launch, which takes a few seconds before the tools appear.
 
-Then run `/harbor-mcp:setup`. It checks your credentials, walks you through login if needed, and summarizes what is currently in your account.
+If you have already run `harbor auth login`, that is the whole setup: the server reads `~/.harbor/credentials.json` on its own. Ask the agent to call `whoami` to confirm.
 
 ## Credentials
 
@@ -32,7 +32,9 @@ harbor auth login
 
 That mints a key scoped to the logged-in user and stores it in `~/.harbor/credentials.json`, which harbor reads on its own. The plugin needs no further configuration, and no key ever goes into a config file or a `.env`.
 
-You do not need a global harbor install: harbor ships inside the plugin's environment, so `uv run --project <plugin-dir> harbor auth login` works too, which is what `/harbor-mcp:setup` falls back to.
+You do not need a global harbor install: harbor ships inside the plugin's environment, so `uv run --project <plugin-dir> harbor auth login` works too.
+
+There is no setup skill. If a tool hits an authentication error, it returns the recovery steps (`harbor auth status`, then `login` or `logout`) in its `suggestions`, so the agent gets them exactly when they are needed and they cost nothing otherwise. The plugin's standing guidance lives in the MCP server's `instructions`, which Claude Code loads into every session. A `CLAUDE.md` at the plugin root would *not* work: the [plugins reference](https://code.claude.com/docs/en/plugins-reference) states it is not loaded as project context.
 
 `harbor auth status` shows what is stored, but it only reads that local file, so it still reports success for a key that has since been revoked. `whoami` is what confirms the credential is live; it returns the key *id* and source, never the key. Restart the server after changing credentials.
 

harbor-mcp/src/harbor_mcp/infra/errors.py

@@ -12,10 +12,18 @@
 
 logger = logging.getLogger(__name__)
 
+# The whole auth recovery procedure lives here rather than in a skill: it costs
+# nothing until auth actually fails, which is the only moment it is useful.
 AUTH_SUGGESTIONS = [
-    "Set HARBOR_API_KEY in this repo's .env file (see .env.example).",
-    "Mint a key by running `harbor auth login` in a terminal.",
-    "Call the whoami tool to verify credentials once set.",
+    "Run `harbor auth status` in a terminal to see whether a credential is "
+    "stored. It exits 0 either way, so read its output, not its exit code.",
+    "If it reports `Not authenticated`, ask the user to run `harbor auth login` "
+    "themselves; it is an interactive OAuth flow and stores a key scoped to "
+    "them in ~/.harbor/credentials.json.",
+    "If it reports a logged-in user, the stored key is revoked or expired: ask "
+    "the user to run `harbor auth logout` and then `harbor auth login` again.",
+    "The server must be restarted to pick up new credentials. Then call whoami "
+    "to confirm.",
 ]
 
 

harbor-mcp/src/harbor_mcp/tools/writes.py

@@ -61,7 +61,10 @@ def _writes_disabled() -> str | None:
         return None
     return error_response(
         "Write tools are disabled.",
-        suggestions=["Set HARBOR_MCP_ENABLE_WRITES=true in .env to enable hub writes."],
+        suggestions=[
+            "Ask the user to export HARBOR_MCP_ENABLE_WRITES=true and restart "
+            "the server. Read-only is the intended default."
+        ],
     )
 
 

harbor-mcp/tests/unit/test_errors.py

@@ -31,7 +31,14 @@ async def tool() -> str:
 
     payload = json.loads(await tool())
     assert "Not authenticated" in payload["error"]
-    assert any("HARBOR_API_KEY" in s for s in payload["suggestions"])
+    # The suggestions are the whole auth recovery procedure, since there is no
+    # setup skill: diagnose with `harbor auth status`, then login.
+    suggestions = " ".join(payload["suggestions"])
+    assert "harbor auth status" in suggestions
+    assert "harbor auth login" in suggestions
+    # Must not send anyone back to .env; the server stopped reading it, and a
+    # stale key there is what shadowed a good credentials.json once already.
+    assert ".env" not in suggestions
 
 
 async def test_guarded_tool_maps_postgrest_error():