Install
$ agentstack add skill-rainsunme-toolcapsule-toolcapsule-release Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Destructive filesystem operation.
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
ToolCapsule Development and Release Workflow
Use this skill for ToolCapsule maintenance, releases, and launch operations.
Project Facts
- Repository:
https://github.com/RainSunMe/toolcapsule - Local path:
/home/yingbo/code/toolcapsule - Package name:
toolcapsule - CLI binaries:
toolcapsuletcap- Website domain:
https://toolcapsule.studio - Vercel fallback URL:
https://toolcapsule.vercel.app - Vercel project:
toolcapsule - npm package:
https://www.npmjs.com/package/toolcapsule - Current initial published version:
0.1.0-alpha.0 - GitHub Environment for Trusted Publishing:
npm
Core Positioning
ToolCapsule is not merely "MCP as Skill". Use this positioning:
> Heavy MCP tools don't belong in your prompt. Put them in a ToolCapsule.
Full description:
> ToolCapsule inventories existing MCPs, turns selected heavy servers into lazy Agent Skills, and keeps calls file-first with auditable runs and patch-and-retry recovery.
Keep MCP and Skill prominent in README, website, npm description, topics, and launch copy.
Golden Rules
- Keep this project independent from
mify-prism. - Do not commit secrets,
.env, Vercel local auth files, npm tokens, or private MCP endpoints. - Do not publish the same npm version twice.
- Do not tag a version before
package.jsonhas been bumped and committed. - Always run CI locally before publishing or pushing release changes.
- Keep
tcapas a short alias, but avoidtcbecause it conflicts with Linux traffic control and npmtc. - Use npm Trusted Publishing, not
NPM_TOKEN, unless explicitly changing the release model.
Standard Validation
Run before any push/release:
cd /home/yingbo/code/toolcapsule
corepack pnpm run ci
node dist/cli.js --help
Expected:
- TypeScript check passes.
- ESLint passes.
- Vitest passes.
- tsup build succeeds.
- CLI help prints
toolcapsule/0.1.0-alpha.*.
For npm package validation:
npm pack --dry-run
For installed binary validation after publish:
rm -rf /tmp/toolcapsule-final-check
mkdir /tmp/toolcapsule-final-check
cd /tmp/toolcapsule-final-check
npm init -y >/dev/null
npm install toolcapsule@ >/dev/null
./node_modules/.bin/toolcapsule --help
./node_modules/.bin/tcap --help
GitHub Workflow
Check status
cd /home/yingbo/code/toolcapsule
git status --short
GH_PAGER=cat gh run list --branch main --limit 8
GH_PAGER=cat gh pr list --state open --json number,title,author,url --limit 20
Normal commit/push
git add
git commit -m ""
git push
GitHub repo metadata
Important topics:
mcpmodel-context-protocolagent-skillsai-agentsllm-toolscontext-engineeringtypescriptcli
If metadata needs repair:
GH_PAGER=cat gh repo edit RainSunMe/toolcapsule \
--homepage https://toolcapsule.studio \
--add-topic mcp \
--add-topic model-context-protocol \
--add-topic agent-skills \
--add-topic ai-agents \
--add-topic llm-tools \
--add-topic context-engineering \
--add-topic typescript \
--add-topic cli
Vercel Workflow
Normal production deploys must go through GitHub push and Vercel Git Integration. Do not run vercel --prod for routine website updates.
Manual Vercel deploy is only an emergency fallback.
Inspect deployment/domain
corepack pnpm exec vercel inspect toolcapsule.vercel.app
corepack pnpm exec vercel domains inspect toolcapsule.studio
curl -I --max-time 20 http://toolcapsule.studio || true
curl -I --max-time 20 https://toolcapsule.studio || true
Domain facts
toolcapsule.studio is managed by a third-party registrar. Vercel expects:
A @ 76.76.21.21
or equivalent:
A toolcapsule.studio 76.76.21.21
If HTTPS fails shortly after domain purchase but HTTP works, wait for DNS/registry propagation and Vercel SSL issuance.
GitHub Pages
ToolCapsule uses Vercel, not GitHub Pages. Do not re-add .github/workflows/pages.yml unless intentionally changing hosting.
npm Trusted Publishing Release
Trusted Publishing setup:
- npm package:
toolcapsule - Repository:
RainSunMe/toolcapsule - Workflow:
release.yml - Environment:
npm
GitHub Environment npm exists. If it needs repair:
printf '{"deployment_branch_policy":null}' | \
GH_PAGER=cat gh api -X PUT repos/RainSunMe/toolcapsule/environments/npm --input -
Release steps
- Choose a new version. Never reuse a published version.
- Update
package.json. - Update
CHANGELOG.md. - Run CI.
- Commit and push.
- Push a matching tag.
Example:
cd /home/yingbo/code/toolcapsule
npm version 0.1.0-alpha.1 --no-git-tag-version
# edit CHANGELOG.md
corepack pnpm run ci
git add package.json CHANGELOG.md
git commit -m "Release v0.1.0-alpha.1"
git push
git tag v0.1.0-alpha.1
git push origin v0.1.0-alpha.1
The Release workflow should:
- install dependencies;
- verify tag and package version match;
- verify the npm version is unpublished;
- run
pnpm run ci; - publish npm with
npm publish --provenance --access public; - verify npm publish;
- create a GitHub Release.
Verify release
npm view toolcapsule@ name version dist-tags bin
GH_PAGER=cat gh release view v --json url,tagName,name,isDraft,isPrerelease
Then test install:
rm -rf /tmp/toolcapsule-release-check
mkdir /tmp/toolcapsule-release-check
cd /tmp/toolcapsule-release-check
npm init -y >/dev/null
npm install toolcapsule@ >/dev/null
./node_modules/.bin/toolcapsule --help
./node_modules/.bin/tcap --help
Dependabot PR Cleanup
Dependabot is configured to group updates:
- npm dependencies group;
- GitHub Actions group.
Before launch, it is acceptable to close noisy Dependabot PRs:
GH_PAGER=cat gh pr list --state open --json number,title,author,url --limit 20
GH_PAGER=cat gh pr close --comment "Closing dependency updates for pre-launch cleanup."
Do not ignore real security advisories.
Website Editing Guidelines
Current style target: Anthropic-like editorial warmth.
Use:
- warm paper background;
- restrained typography;
- low-saturation clay/sage accents;
- concise hero message;
- professional proof blocks;
- MCP and Skill keywords near the top.
Avoid:
- overly cyber/neon style;
- too many gradients;
- vague AI buzzwords;
- losing the MCP/Skill linkage.
After editing website:
corepack pnpm run ci
git add website/index.html website/style.css
git commit -m ""
git push
corepack pnpm exec vercel --prod --yes
Completion Checklist
A task is done when:
- local
corepack pnpm run cipasses; - relevant files are committed;
- changes are pushed to
mainor a PR; - Vercel deploy succeeds for website changes;
- npm/GitHub release is verified for release tasks;
- open Dependabot PRs are not noisy for launch tasks;
- no secrets are printed or committed.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: RainSunMe
- Source: RainSunMe/toolcapsule
- License: MIT
- Homepage: https://toolcapsule.studio
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.