A framework-agnostic OCI-based registry for AI agent skills. Stores actual skill content as OCI artifacts, manages lifecycle, and enables discovery. Companion to agentoperations/agent-registry (metadata/governance layer).
make build # Build skillctl to bin/
make test # Run all tests
make lint # Run golangci-lint
make fmt # Format code| Path | Description |
|---|---|
cmd/skillctl/ |
CLI entry point |
internal/cli/ |
Cobra commands |
internal/handler/ |
HTTP handlers |
internal/service/ |
Business logic (lifecycle state machine) |
internal/store/ |
Storage interface + SQLite |
internal/server/ |
Router, middleware |
pkg/skillcard/ |
SkillCard parse, validate, serialize |
pkg/oci/ |
Build/push/pull/inspect (oras-go) |
pkg/installed/ |
Installed skill scanning and upgrade checking |
pkg/verify/ |
Sigstore signature verification |
pkg/lifecycle/ |
State machine, semver rules |
pkg/source/ |
Remote Git source resolution |
pkg/diff/ |
Version comparison |
schemas/ |
JSON Schema for SkillCard |
api/ |
OpenAPI 3.1 spec |
deploy/ |
Dockerfile, Kustomize overlays |
site/ |
GitHub Pages content (HTML, CNAME, slides) |
docs/ |
Documentation (design, research, slide sources) |
docs/dev/ |
Internal plans and specs |
Library-first: core logic in pkg/, CLI and server are thin
consumers. Two operating modes: standalone CLI (build/push/pull
against OCI registries, no server needed) and server mode
(lifecycle management, search, UI support via REST API).
- Go 1.25+
- oras-go for OCI operations
- Cobra/Viper for CLI
- chi for HTTP router
- SQLite for metadata (Postgres swap path)
- cosign for signature verification