Rolecraft

RoleCraft

Install AI agent skills as roles & behaviors — from any source. Zero-dependency CLI. Skills + MCP servers. No marketplace. No signup.

Works with 82+ AI agents: opencode · claude-code · cursor · windsurf · devin · codex · copilot · aider · cline · gemini-cli · cody · continue · warp · codeium · fabric · goose · tabnine · supermaven · pr-pilot · loom · roo · trae · hermes · kiro · augment · kilo · openhands · junie · factory · command-code · cortex · mistral-vibe · qwen-code · openclaw · codebuddy · mux · pi · autohand-code · rovo · firebender · bob · aider-desk · and more

Quick Start · Who Is This For? · Features · Commands · FAQ · Security · Contribute

---

⚡ Zero dependencies · 📦 4 KB · 🤖 82+ agents · 🔌 Skills + MCP · 🔒 No telemetry · 🌐 Offline-first · 🔧 Any source

Full benchmark results →

Full feature comparison →

Migrate from Vercel skills →

---

Who is this for?

| If you... | rolecraft helps you... | |-----------|----------------------| | Use AI coding agents (Claude, Cursor, Copilot, etc.) | Install reusable skills so your agent stops re-learning your project every session | | Maintain team conventions | Share a single skill repo across your whole team — no copy/paste | | Run CI/CD pipelines | Lockfile-based rolecraft ci re-installs skills deterministically | | Build agent skills | Scaffold, test, and distribute skills to 82+ agents from one source | | Care about security | Built-in 0–100 security scoring blocks prompt injection, command injection, and credential harvesting on install |

---

Onboarding: zero to productive in one command

New project? New team member? One command installs your skills + MCP servers + conventions to every AI agent on the machine:

# install globally
npm install -g rolecraft

# one command: detect all agents + install skill + MCP servers
rolecraft setup sametcelikbicak/task-decomposer

That's it. The skill is now active in every agent you use — opencode, cursor, claude-code, copilot, aider, all of them. [→ Full onboarding guide](docs/guides/onboarding.md)

Quick start

# try without installing
npx rolecraft --help

# or install globally (works with npm, pnpm, yarn, bun)
npm install -g rolecraft

# create a skill
rolecraft init my-skill

# install it
rolecraft install ./my-skill                      # local folder
rolecraft install user/repo                       # GitHub repo
rolecraft install https://gitlab.com/org/project  # GitLab repo
rolecraft install git@github.com:user/repo.git    # SSH URL
rolecraft install npm:some-package                # npm package
rolecraft install npm:@scope/package@1.0.0        # npm with version
rolecraft install ./my-skill --cursor             # specific agent only

# install a skill with its MCP servers (declared in SKILL.md)
rolecraft install ./my-postgres-rules --cursor

# or manage MCP servers standalone
rolecraft mcp install npm:@modelcontextprotocol/github --cursor

# or install the rolecraft skill (teaches AI agents to use rolecraft)
npx skills add sametcelikbicak/rolecraft

# manage
rolecraft list
rolecraft search code-review
rolecraft check
rolecraft remove my-skill

Requirements: Node.js >= 20 · No other dependencies · 82+ agents supported · [Full install guide →](docs/install.md)

> Why zero dependencies? Every dependency is a risk — supply-chain attacks, breaking changes, bloated node_modules. rolecraft uses only Node.js built-in modules (fs, path, crypto, https). The entire CLI is ~4 KB. No npm install surprises.

---

Features

• Zero dependencies — ~4 KB, no bloat
• Any source — local folder, GitHub/GitLab/Bitbucket repo, SSH git URL, npm package
• MCP + Skills in one command — install skills and their MCP servers together. No other CLI tool combines both.
• 82+ agents — opencode, claude-code, cursor, copilot, aider, devin, gemini-cli, and more
• skills.sh compatible — installable via npx skills add sametcelikbicak/rolecraft
• No registry required — no signup, no marketplace, no vendor lock-in
• Security scoring — static analysis on install: detects prompt injection, command injection, obfuscated code, credential harvesting, and sensitive file access. Scores 0–100. Blocks dangerous skills unless --yes
• Non-interactive mode — --yes / -y flag for automation/CI pipelines
• Update checking — rolecraft check to see which skills have updates
• Shell completions — bash, zsh, fish auto-completion
• TUI search — interactive arrow-key skill browser with preview
• Content hash verification — detect tampered or outdated skills
• CI-ready — lockfile-based re-install for pipelines
• Dry-run mode — preview before installing
• System health check — rolecraft doctor diagnoses Node.js, agent directories, lockfiles, and skill integrity
• AGENTS.md XML generation — rolecraft agents-xml generates Claude Code-compatible `` XML for agent discovery

---

Skills + MCP in one command

rolecraft is the only CLI that installs both agent skills and MCP servers together.

When a SKILL.md declares MCP servers in its frontmatter:

---
name: postgres-rules
mcp_servers:
  - name: postgres
    source: npm:@modelcontextprotocol/postgres
---

rolecraft install ./postgres-rules --cursor installs the skill and the MCP server — one command, no separate tools.

You can also manage MCP servers standalone:

rolecraft mcp install npm:@modelcontextprotocol/github --cursor
rolecraft mcp list
rolecraft mcp remove postgres

[→ Full MCP documentation](docs/mcp.md)

---

Commands overview

| Command | Description | Details | | --------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------ | | rolecraft init [] | Scaffold a new SKILL.md | [docs](docs/commands/init.md) | | rolecraft install | Install a skill with security scan (local path, GitHub/GitLab/SSH URL, npm) | [docs](docs/commands/install.md) | | rolecraft bundle | Install multiple skills from inline sources or file | [docs](docs/commands/bundle.md) | | rolecraft bundle create | Create a new bundle file | [docs](docs/commands/bundle.md) | | rolecraft search | Search for skills on GitHub (TUI with --interactive) | [docs](docs/commands/search.md) | | rolecraft check | Check installed skills for available updates | [docs](docs/commands/check.md) | | rolecraft use | Preview a skill's files without installing | [docs](docs/commands/use.md) | | rolecraft completions bash\|zsh\|fish | Generate shell completion scripts | [docs](docs/commands/completions.md) | | rolecraft setup [] | Detect agents, optionally install a skill to all | [docs](docs/commands/setup.md) | | rolecraft list | Show all installed skills | [docs](docs/commands/list.md) | | rolecraft doctor | Run system health check | [docs](docs/commands/doctor.md) | | rolecraft agents-xml [--write] | Generate skills XML for AGENTS.md | [docs](docs/commands/agents-xml.md) | | rolecraft mcp install/remove/list | Install, remove, and list MCP servers for AI agents | [docs](docs/commands/mcp.md) | | rolecraft profile save/apply/list | Save, apply, and share multi-agent configuration profiles | [docs](docs/commands/profile.md) | | rolecraft verify | Check installed skill integrity via content hash | [docs](docs/commands/verify.md) | | rolecraft watch [] | Watch skills for changes and auto-sync | [docs](docs/commands/watch.md) | | rolecraft ci | Re-install all skills from lockfile (CI mode) | [docs](docs/commands/ci.md) | | rolecraft upgrade | Upgrade rolecraft to the latest version | [docs](docs/commands/upgrade.md) | | rolecraft remove | Uninstall a skill | [docs](docs/commands/remove.md) | | rolecraft update | Re-install a skill to latest | [docs](docs/commands/update.md) | | rolecraft --version | Show version | |

---

Why rolecraft?

[→ Full feature comparison](docs/comparison.md)

| Feature | rolecraft | skills (Vercel) | @agentskill.sh/cli | | ------------------------------------ | ---------------- | --------------- | ------------------- | | Zero dependencies | ✅ 0 | ✅ (1 dep) | ❌ (2) | | Local path install | ✅ 1st class | ✅ | ❌ marketplace only | | GitHub repo install | ✅ | ✅ | ❌ | | GitLab / SSH git URL | ✅ | ✅ | ❌ | | npm package source | ✅ | ✅ | ❌ | | MCP server management | ✅ | ❌ | ❌ | | Agent targets | 82 | 72 | 15+ | | Skills.sh listed | ✅ | ✅ | ⚠️ (registry only) | | Bundle install + create | ✅ | ❌ | ✅ (skillset only) | | Interactive TUI search + install | ✅ | ✅ | ❌ | | Security scoring (0–100) | ✅ | ✅ (Snyk) | ✅ (server + local) | | Non-interactive flag (--yes/-y) | ✅ | ✅ | ❌ | | Skill update check (check) | ✅ | ❌ | ❌ | | Shell completions (bash/zsh/fish) | ✅ | ❌ | ❌ | | Dry-run preview (--dry-run) | ✅ | ❌ | ❌ | | Interactive scope prompt | ✅ | ✅ | ❌ | | Content hash verification (verify) | ✅ | ✅ | ❌ | | CI-mode re-install (ci) | ✅ | ✅ | ❌ | | System health check (doctor) | ✅ | ❌ | ❌ | | Watch mode (auto-sync) | ✅ | ❌ | ❌ | | AGENTS.md XML generation | ✅ | ❌ | ❌ | | Self-upgrade command | ✅ | ❌ | ❌ | | File size | ~4 KB | ~465 KB | ~84 KB |

[See full table →](docs/comparison.md)

---

Security

Every install is automatically scanned with static analysis that detects:

| Severity | What it catches | |----------|----------------| | 🔴 Critical | Prompt injection, obfuscated code (base64 blobs, eval()), command injection (download-and-execute) | | 🟡 High | Credential harvesting patterns, sensitive file access (~/.ssh, .env) | | 🟢 Medium/Low | Missing metadata, unusual source patterns |

Scores range 0–100:

• 90+ → SAFE, install proceeds
• 70–89 → REVIEW, prompts for confirmation
• ** | Samet ÇELİKBIÇAK | Owner & Maintainer |

| | 冯基魁 | Contributor |

License

MIT

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: sametcelikbicak
• Source: sametcelikbicak/rolecraft
• License: MIT
• Homepage: https://www.npmjs.com/package/rolecraft

Install and usage instructions live in the source repository linked above.