{"name":"ai-skill-repository-skill","identifier":"jens.caasen.ext@iu.org","description":"How to discover, list, search, retrieve, create, update, and delete skills (and their bundled resource files) in the AI Skill Repository — via its REST API or MCP server — following the Agent Skills specification.","text":"# AI Skill Repository\n\nThis API stores reusable \"skills\" for AI agents, shaped after the\n[Agent Skills specification](https://agentskills.io/specification): each skill is a\n`SKILL.md`-equivalent with a `name`, a short `description`, a `text` body, and a\n`metadata.identifier` recording who created it. You are reading the text of the one\nskill that describes the repository itself.\n\nBase URL: `https://ai-skill-repository-api.azurewebsites.net`\n\n## Authentication\n\nEvery endpoint except `GET /` requires an `Authorization: Bearer <token>` header, where\n`<token>` is your **Unified Endpoint (UE) key**. Get one at\nhttps://ue-self-service.app.iu-it.org/my-api-keys. The token is validated server-side\non every call; there is nothing else you need to do to authenticate beyond sending that\nheader. Only the identifier that created a skill may edit or delete it (or write its\nresource files).\n\nBuilding your own product and want to accept UE keys the same way? See the\n`UeKeyAuthentication` skill in this repository (`GET /skills/UeKeyAuthentication`) for\nthe full validation mechanism and integration pattern.\n\nThere's also a minimal web UI at `/ui` for browsing, searching, creating, editing, and\ndeleting skills by hand — useful for humans, not just agents.\n\n## Naming\n\nSkill names follow the Agent Skills spec's strict rule: 1-64 characters, lowercase\nletters, digits, and hyphens only, no leading/trailing/double hyphen (e.g.\n`pdf-processing`, `ai-skill-repository-skill`). Skills created before this rule was\nenforced keep working under their original name; updating one migrates it in place.\n\n## Endpoints\n\n### `GET /`\nNo authentication required. Returns this skill, so an agent that knows nothing else\nabout the repository can bootstrap itself from a single call.\n\n```\ncurl https://ai-skill-repository-api.azurewebsites.net/\n```\n\n### `GET /skills`\nList every skill (name, identifier, description — not the full text).\n\n```\ncurl -H \"Authorization: Bearer <your-ue-key>\" \\\n  https://ai-skill-repository-api.azurewebsites.net/skills\n```\n\n### `GET /skills/{name}`\nFetch one skill in full, including its text.\n\n```\ncurl -H \"Authorization: Bearer <your-ue-key>\" \\\n  https://ai-skill-repository-api.azurewebsites.net/skills/ai-skill-repository-skill\n```\n\n### `GET /skills/search?q=<query>`\nFull-text search across every skill's name, description, and text. A skill matches\nwhen it contains every word in the query (AND semantics, case-insensitive); wrap a\nphrase in double quotes to require it to appear exactly and contiguously. Results are\nranked by relevance (name matches rank above description, which ranks above body text)\nand returned without their full text.\n\n```\ncurl -H \"Authorization: Bearer <your-ue-key>\" \\\n  \"https://ai-skill-repository-api.azurewebsites.net/skills/search?q=upload%20html\"\ncurl -H \"Authorization: Bearer <your-ue-key>\" \\\n  \"https://ai-skill-repository-api.azurewebsites.net/skills/search?q=%22artifact%20store%22\"\n```\n\n### `POST /skills`\nCreate a new skill. The creator identifier is derived from your bearer token, not\nfrom the request body. Names must follow the rule above and be unique (409 Conflict\nif the name is already taken).\n\n```\ncurl -X POST -H \"Authorization: Bearer <your-ue-key>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\":\"my-skill\",\"description\":\"One-line summary\",\"text\":\"Full skill body...\"}' \\\n  https://ai-skill-repository-api.azurewebsites.net/skills\n```\n\n### `PUT /skills/{name}`\nUpdate a skill's description and text. Succeeds only if your bearer token's identifier\nmatches the skill's creator (403 Forbidden otherwise, 404 if the skill doesn't exist).\nThe name and creator identifier cannot be changed.\n\n```\ncurl -X PUT -H \"Authorization: Bearer <your-ue-key>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"description\":\"Updated summary\",\"text\":\"Updated body...\"}' \\\n  https://ai-skill-repository-api.azurewebsites.net/skills/my-skill\n```\n\n### `DELETE /skills/{name}`\nDelete a skill. Succeeds only if your bearer token's identifier matches the skill's\ncreator (403 Forbidden otherwise, 404 if the skill doesn't exist).\n\n```\ncurl -X DELETE -H \"Authorization: Bearer <your-ue-key>\" \\\n  https://ai-skill-repository-api.azurewebsites.net/skills/my-skill\n```\n\n### Bundled resources\n\nSkills can carry supporting files — scripts, reference docs, assets — alongside the\n`SKILL.md` body, per the spec's `scripts/`, `references/`, and `assets/` convention.\nThese are not loaded automatically; fetch them only when the skill's own text\nreferences them.\n\n- `GET /skills/{name}/resources` — list relative paths (e.g. `scripts/extract.py`).\n- `GET /skills/{name}/resources/{path}` — fetch one resource's raw content.\n- `PUT /skills/{name}/resources/{path}` — create or overwrite a resource (creator only).\n- `DELETE /skills/{name}/resources/{path}` — remove a resource (creator only).\n- `GET /skills/{name}/bundle` — download the whole skill as a zip\n  (`SKILL.md` plus every resource at its relative path).\n\n```\ncurl -X PUT -H \"Authorization: Bearer <your-ue-key>\" \\\n  --data-binary @extract.py \\\n  https://ai-skill-repository-api.azurewebsites.net/skills/my-skill/resources/scripts/extract.py\n```\n\nTo install a skill locally — e.g. so an agent can run its bundled scripts with\nrelative paths intact — download the bundle and unzip it into your skills folder:\n\n```\ncurl -H \"Authorization: Bearer <your-ue-key>\" -o my-skill.zip \\\n  https://ai-skill-repository-api.azurewebsites.net/skills/my-skill/bundle\nunzip my-skill.zip -d ~/.claude/skills/my-skill\n```\n\n## Typical flow\n\n1. `GET /` to learn about the repository (no auth needed).\n2. `GET /skills/search?q=<topic>` to find a relevant skill for a task.\n3. `GET /skills/{name}` to read the full skill text before using it, and\n   `GET /skills/{name}/resources` to see what else it bundles.\n4. `POST /skills` to publish a new skill once you've learned something reusable.\n\n## MCP server\n\nInstead of calling the REST API directly, an MCP-capable agent (Claude Code, Claude\nDesktop, etc.) can connect to a dedicated MCP server that simply proxies these same\ncalls:\n\n```\nhttps://ai-skill-repository-mcp.azurewebsites.net/\n```\n\nIt exposes ten tools — `list_skills`, `get_skill`, `search_skills`, `create_skill`,\n`update_skill`, `delete_skill`, `list_skill_resources`, `get_skill_resource`,\n`put_skill_resource`, `delete_skill_resource` — that map 1:1 to the REST endpoints\nabove. Resource tools handle binary files via base64: pass `encoding=\"base64\"` to\n`put_skill_resource`, and `get_skill_resource` returns binary content base64-encoded\nbehind a `[binary resource: ...]` marker line. There is no MCP tool for the zip\nbundle — download `GET /skills/{name}/bundle` from the REST API instead.\n\nThe MCP server does no auth of its own: it forwards whatever `Authorization`\nheader your MCP client sends straight through to the real API, so it requires the\nexact same UE key bearer token, and every tool call is subject to the exact same rules\n(only the creator's identifier may update/delete a skill or its resources, names must\nbe unique, etc). An unauthenticated call returns the same 401 you'd get calling the\nREST API directly.\n\nTo add it in Claude Code:\n\n```\nclaude mcp add --transport http ai-skill-repository \\\n  https://ai-skill-repository-mcp.azurewebsites.net/ \\\n  --header \"Authorization: Bearer <your-ue-key>\"\n```\n\nOr by hand in `.mcp.json` / `~/.claude.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"ai-skill-repository\": {\n      \"type\": \"http\",\n      \"url\": \"https://ai-skill-repository-mcp.azurewebsites.net/\",\n      \"headers\": { \"Authorization\": \"Bearer <your-ue-key>\" }\n    }\n  }\n}\n```\n\nOther MCP clients that support the Streamable HTTP transport with custom headers can\nconnect the same way — point them at the URL above with that same `Authorization`\nheader."}