AiSkillz

AiSkillz is in preview: browse the catalogue now - skill downloads and subscriptions open soon.

How AiSkillz works

AiSkillz is a marketplace of AI skills - reusable SKILL.md-based instructions and supporting files, or hosted access instructions. This page walks through how a listing goes from submission to published, how a copyright takedown suspends a listing, and how to connect and validate an MCP client against your own subscription.

For buyers

Every published skill is included with one monthly all-access subscription. Once subscribed, you can download a skill directly from its listing page, or connect an MCP client (see below) so an AI tool can pull skills in live, with nothing to download or keep in sync.

Subscribe

One monthly plan on the pricing page unlocks every published skill.

Download from the site

Open a skill's listing page and click Download - a signed, short-lived URL, no service-role key involved.

Use it live via MCP

Connect Claude Code/Desktop or any MCP client - see the MCP section below.

Skill submission review

A listing always goes through the same pipeline, regardless of who's submitting it: an automated review first, then a human's explicit approval before it's ever visible to buyers. Nothing publishes itself.

Submit

The submitter uploads SKILL.md + supporting files (or hosted access instructions), confirms they have the rights to distribute it, and declares a license. Status: pending_review. Files land in a private staging bucket, not the public one.

Automated review

A Supabase Edge Function, triggered by a database webhook on insert, reviews the content: prompt-injection / malicious-intent, hardcoded secrets, vulnerable dependencies, risk-minimizing language, and a check for a stated license. This runs entirely inside Supabase - the app itself never holds the service-role key this step needs.

malicious: true/false

Quarantined

The file goes to a private quarantine bucket instead of the public one, and the submitter's account is soft-locked from new submissions until an admin reviews it in /admin/reports.

Stored normally

The file goes straight to the skills-files bucket.

verdict: pass vs. flag

awaiting_approval

Automated review passed. Still not published - still needs a human's click.

flagged

Automated review found something worth a closer look before a human decides.

admin reviews in "/admin/skills"

Approve & publish

Status becomes published and it's visible to buyers. This also unlocks the submitter's next submission slot (only one is allowed in flight at a time).

Reject

Status becomes rejected, with a reason. Never visible to buyers.

DMCA takedowns

Anyone - no AiSkillz account needed - can file a copyright takedown notice from a "Report copyright infringement" link on any skill card or listing page. Filing a complete notice suspends the listing immediately, before any human reviews it.

File a notice

Reason, whether you're the copyright owner or an authorized agent, contact name/email/phone/address, a note (up to 2000 characters), and two required legal attestations (good-faith belief, accuracy under penalty of perjury).

Suspended immediately

The claim is recorded and the listing is suspended in the same database call - before any admin looks at it. This suspension is enforced at the single access-check every serving path shares, so it applies everywhere at once: delisted from the public catalog and its own listing page, storage downloads blocked, and MCP (tool list, tool calls, catalog browse, file resources) all blocked too - even for a buyer who already purchased it.

admin reviews in "/admin/dmca"

Reinstate

False or resolved claim - the suspension is lifted, unless another still-open claim against the same listing exists.

Uphold

Confirmed infringement - the listing stays suspended indefinitely.

MCP server

AiSkillz exposes an MCP (Model Context Protocol) server so an AI tool can pull the skills you have access to directly, live - no download, no manual re-sync when a subscription or purchase changes.

Connect a client

  1. Subscribe (or buy a skill) so your skills appear as tools. Connecting without access still lets you browse the catalog and get the setup skills.
  2. Create an API key on Connect an AI tool - it's shown once, with a ready-to-paste command that already contains it. AiSkillz stores only a hash of the key.
  3. Pick your AI tool and system below and follow the steps.
Your AI tool
Your system
Run once in your terminal
claude mcp add --transport http --scope user --header "Authorization: Bearer <your key>" --header "X-Machine-Id: <a name for this computer>" aiskillz https://aiskillz.vercel.app/api/mcp

Replace <your key> with your key - the dialog shown when you create a key has it already filled in.

  1. Step 1: Run the command above

    Once
    From any folder - it's saved in your own Claude Code settings for every project. Use your own terminal, and never paste your key into a chat or a project file.

  2. Step 2: Start Claude Code in your project

    Each session
    Open a new terminal, go to your project folder, and start Claude Code:cd C:\path\to\your-projectthenclaudeNot installed yet? Follow Claude Code's install guide.

  3. Step 3: Check it's connected

    Once
    Run /mcp - aiskillz should be listed as connected. An authentication error means the key is wrong or revoked: create a new one and repeat step 1.

  4. Step 4: Install the setup skills

    First time
    Ask your agent:“install the AiSkillz setup skills”It adds two small skills - how to use AiSkillz, and how to protect your own skills - and asks before writing anything.

  5. Step 5: Find the skills your project needs

    Per project
    Ask your agent:“which AiSkillz skills fit this project?”It finds the packages and services your project uses and shows you exactly which names it would send - nothing is sent until you say yes (never code, file paths, versions, or private packages). Then it lists the matches: ready to use now, available with a subscription, and any that overlap skills you already have.

  6. Step 6: Choose which to set up

    Per project
    Your agent loads them and compares any overlaps with your existing skills. It never edits yours: it shows what you gain and what only yours has, and with your OK saves your own tweaks as an overrides skill so they keep working alongside AiSkillz. It can also note the skills in your project so later sessions load them automatically.

Nothing runs by itself when Claude Code starts - your first message kicks things off, and in a project it hasn't checked yet your agent will offer the AiSkillz check. Claude Code docs: install · MCP servers.

Another MCP client? Add a remote (HTTP) MCP server with URL https://aiskillz.vercel.app/api/mcp and the headers Authorization: Bearer <your key> and X-Machine-Id: <a name for this computer>. The machine id is a label you choose - it isn't verified, it just tells your own connections apart in the activity log.

Request lifecycle

Client connects

Every MCP call is its own request, carrying your API key as a bearer token - nothing is cached server-side between calls, so a revoked key or lapsed subscription takes effect on the very next call.

Server resolves the key and lists tools

One tool per accessible skill (use_skill_<slug>), plus a browse_aiskillz_catalog tool listing every published skill site-wide (not just ones you have access to), and the setup tools every account gets: get_aiskillz_setup_skills, match_project_to_aiskillz, and reconcile_with_local_skills. "Accessible" means: published, has a file, and you own it / it's free / you purchased it / you have an active subscription - and it isn't DMCA-suspended.

model calls use_skill_<slug>

Access re-checked, then re-checked again

Never trusted from the list above alone - access is re-verified at call time too, so a refund, cancellation, or takedown that lands in between is still caught.

granted

Content returned

SKILL.md content inline, plus a list of any supporting files reachable via skill-file://<slug>/<fileName>.

Access denied

"You no longer have access to this skill." - shown instead of an error, so a client can surface it directly.

Usage logged

Every tool/resource call - granted or denied - is recorded with which machine, when, and from where. Visible to you in /dashboard/mcp.

Validating skills are loading properly

After connecting, a few quick checks confirm the connection and your entitlements are both working as expected:

  1. Call browse_aiskillz_catalog. This doesn't depend on your purchases - if it returns a list of skills, the connection itself (API key, headers, URL) is working.
  2. Call one of your own use_skill_<slug> tools. It only appears if you actually have access. A successful call returns SKILL.md's content inline - if you see real content (not an access-denied message), that skill is loading correctly end to end.
  3. Check Recent activity on the MCP dashboard. Every call shows up there with a granted/denied status, which machine made it, and when. A denied entry is the fastest way to see exactly when access stopped and from where - a revoked key, a lapsed subscription, a refund, or a DMCA suspension all show up the same way: granted: false.