Skills and MCP publishing

Pack contract

A Kendr skill pack is a folder with a plugin manifest, optional skills, and optional MCP server config. Every change that users should update to must bump version. The file contract is published as the Kendr Skill Pack SDK.

my-pack/
  .cursor-plugin/plugin.json
  mcp.json
  server.py
  skills/
    my-skill/
      SKILL.md

{
  "name": "Docker MCP",
  "description": "Read-only Docker inspection tools and guidance for agentic mode.",
  "author": { "name": "Kendr" },
  "version": "0.1.0",
  "homepage": "https://kendr.org/docs/skills-and-mcp.html",
  "skills": "./skills",
  "mcpServers": "./mcp.json"
}

The manifest supports .cursor-plugin/plugin.json, .claude-plugin/plugin.json, or root plugin.json. Relative paths are resolved inside the installed pack directory.

Skill files

A skill is a folder containing SKILL.md. Kendr extracts the frontmatter name and description for the UI, and passes enabled skill guidance into agentic mode when it is relevant to the user's task.

---
name: Docker Operations
description: Inspect Docker containers, images, and local Docker disk usage before proposing container operations.
---

# Docker Operations

Use Docker MCP tools when the user asks about containers, images, compose stacks, or Docker storage.
Prefer read-only inspection before proposing any change.

MCP config

Bundle Cursor-style MCP JSON in mcp.json. Kendr rewrites relative cwd, envFile, and script paths into the installed pack directory.

{
  "mcpServers": {
    "docker": {
      "command": "${KENDR_PYTHON}",
      "args": ["docker_mcp_server.py"],
      "timeout": 30
    }
  }
}

Use ${KENDR_PYTHON} when the bundled server should run with the same Python interpreter as the Kendr backend. Hosted packs should default to read-only tools unless the pack description clearly explains side effects and approvals.

Python MCP server

MCP servers can be plain Python files using the MCP FastMCP API. Return structured dictionaries when possible so the agent can inspect results without scraping terminal text.

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("Example MCP")

@mcp.tool(
    name="list_items",
    description=(
        "List local items for read-only inspection. Inputs: limit controls the maximum number of items returned. "
        "Use only for listing existing items, not creating, updating, or deleting resources. Returns a structured "
        "dictionary with ok status, item records, and explicit error details."
    ),
)
def list_items(limit: int = 20) -> dict:
    return {"ok": True, "items": []}

if __name__ == "__main__":
    mcp.run(transport="stdio")

Publish on KendrWeb

KendrWeb supports curated packs maintained by admins and user-created packs from Developer Mode. Curated packs live under skill-packs/<slug>. Developer packs are created after login, stored as private archives, and only become public after admin approval. The hosted API returns the version, archive URL, tool counts, and SHA-256 archive checksum. Catalog entries can be checked against catalog-entry.schema.json.

GET /api/skills/catalog
GET /api/skills/packs/<slug>/archive

{
  "id": "docker",
  "slug": "docker",
  "label": "Docker MCP",
  "version": "0.1.0",
  "install_source": "https://kendr.org/api/skills/packs/docker/archive",
  "archive_sha256": "...",
  "mcp_server_names": ["docker"],
  "tool_count": 4
}

Kendr Desktop compares the hosted version with the installed version and exposes update actions from the Skills overlay. Reinstalling or updating preserves the user's pack and skill enablement state.

The public marketplace page at /skills.html reads the same catalog. When a signed-in Desktop user installs, updates, enables, or disables a hosted pack, Desktop syncs that installation record to the user's Kendr account through /api/app/skills/installations.

Developer Mode

Sign in to KendrWeb, open user-dashboard.html#developer, and create a private skill pack. The guided editor writes the manifest, skill markdown, MCP config, and optional Python server into the same archive format as curated packs. You can also save a draft and upload a complete zip.

GET  /api/app/developer/skill-packs
POST /api/app/developer/skill-packs
PUT  /api/app/developer/skill-packs/<id>/archive
GET  /api/app/developer/skill-packs/<id>/archive
POST /api/app/developer/skill-packs/<id>/validate
POST /api/app/developer/skill-packs/<id>/submit

Private archives require the owner's Kendr session or OAuth app token. Kendr Desktop uses that authenticated archive URL only for download; the token is not stored in installed pack metadata.

Private testing

1. Run KendrWeb locally with Docker Compose and sign in through portal.html.
2. Create or upload the pack in Developer Mode and confirm validation passes.
3. Run Kendr Desktop with KENDR_WEB_BASE_URL pointing to the same KendrWeb origin.
4. Sign in to the same Kendr account in Desktop.
5. Open Skills and install from Private developer skills.
6. Run a local agentic task that should trigger the skill, then disable the pack and confirm it is withheld from agentic mode.

Marketplace review

Publishing always requires admin approval. After validation passes, submit the pack from Developer Mode. Admins review submissions at admin-dashboard.html#developer-skills. Approved packs are merged into /api/skills/catalog and appear on /skills.html. Rejected packs return to an editable state with review notes.

GET  /api/admin/developer/skill-packs?status=pending_review
POST /api/admin/developer/skill-packs/<id>/review

Public listings show the submitted author/profile name, version, description, tags, tool counts, and archive checksum. KendrWeb validates uploaded archives without executing MCP server code. The operational checklist is also available as the Developer Skill Pack Runbook.

Desktop install and update

Users install hosted packs from the Skills overlay, or paste a GitHub repo, local folder, or zip archive URL. Installed packs can be updated later from their stored source.

# Hosted catalog
curl https://kendr.org/api/skills/catalog

# Hosted archive
curl -L https://kendr.org/api/skills/packs/docker/archive -o docker.zip

In agentic mode, Kendr only advertises enabled MCP servers, enabled MCP tools, enabled packs, and enabled individual skills. Disabled entries remain installed but are withheld from the model context.

Release checklist

• Bump plugin.json.version for every pack behavior change.
• Keep tool names stable when possible; changing tool names breaks saved user expectations.
• Prefer structured tool output and clear read-only vs side-effect descriptions.
• Test archive install from an HTTP URL, not only from a local folder.
• Verify disabled packs and disabled skills stay hidden from agentic mode.