Add a filesystem backed provider for the Skills extension #3683

Activity

1. claude

   added

   enhancementRequest for a new feature that's not currently supportedRequest for a new feature that's not currently supported

   on Oct 11, 2026
2. udbhav-shrinet commented on Oct 12, 2026

   

   udbhav-shrinet

   on Oct 12, 2026

   More actions

   A few architectural considerations for designing a built-in FilesystemSkillProvider on top of the SEP-2640 Skills extension (#3485):

   1. Dependency Isolation (Zero New Core Dependencies):
      A key constraint in Add Skills extension #3485 was avoiding a required YAML dependency in core SDK types. A filesystem provider needs to parse SKILL.md frontmatter to build the manifest. To keep the core lightweight, the provider should either:

      • Accept an optional frontmatter_parser: Callable[[str], dict[str, Any]] dependency injection, or
      • Ship under an optional extra (mcp[skills-fs]) leveraging pyyaml.

   2. Strict Boundary Sandboxing & Canonical Resolution:
      Serving files directly from disk over resources/read requires airtight directory boundary enforcement:

      • Canonical path resolution via pathlib.Path.resolve() to prevent symlink escapes outside the designated skills root.
      • Rejecting relative or percent-encoded dot-segments prior to path joining (mirroring the traversal checks in Skills: URI traversal validation skips percent-encoded dot-segments #3685).

   3. Manifest Caching & Lazy Invalidation:
      Computing sha256 digests across skill resources (scripts, templates, references) on every skills/list or skills/get introduces avoidable I/O latency. A high-throughput provider should maintain an in-memory manifest cache keyed by directory (mtime, size) snapshots, re-hashing only when file metadata changes.

   4. FastMCP / Extension Mounting:
      To fit cleanly into existing server workflows, the provider can expose a helper method that registers both the resource handlers and the Skills extension:

      provider = FilesystemSkillProvider(skills_dir="/path/to/skills")
      server = MCPServer("skills-service", extensions=[provider.to_extension()])

   Happy to help draft an implementation or spec out the provider interface if maintainers are aligned on introducing this helper.