BIP Skills MCP

io.github.2fizzlePublished by GitHub account 2fizzlev1.0.1Updated Nov 8, 2026

Serves Agent Skills folders (SKILL.md + bundled files) to any MCP client. Bundles bip-xsl-hardening.

VerifiedSTDIODesktop onlyKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

Local MCP server that serves Agent Skills folders (SKILL.md plus bundled files) to any MCP client, with one bundled XSLT hardening skill.

What you can do
  • List available skills with name, description and source, optionally filtered by a query
  • Read a skill's full SKILL.md and list its bundled files with sizes
  • Read individual text files inside a skill, with path-traversal protection and a 2 MB limit
  • Expose each skill as a resource at skill:// /SKILL.md
  • Serve your own local skill folders alongside or instead of the bundled skill
When to use it
Use it when you keep reusable Agent Skills as folders on your machine and want an assistant to discover and read them on demand, or when you want the bundled XSLT 1.0 patterns for Oracle BI Publisher HTML dashboards available in Claude Desktop, Claude Code, Cursor or VS Code.
Requirements
Node.js 20.3 or later; runs locally via npx over stdio. Optional SKILLS_DIR points at extra skill folders (separated by ; on Windows, : elsewhere, searched up to 3 levels deep); SKILLS_NO_BUNDLED=1 serves only those folders. Optional HTTP mode uses TRANSPORT=http with PORT, HOST, ALLOWED_HOSTS and MCP_AUTH_TOKEN.
Before you install
All tools are read-only, but skills_read_file exposes text files from the configured skill folders to the connected assistant, so point SKILLS_DIR only at folders you are comfortable sharing. If you enable HTTP mode and bind beyond localhost, set MCP_AUTH_TOKEN and ALLOWED_HOSTS; leaving the token unset is only safe for public skills. A hosted instance serves only bundled skills.

Installation

In SourceWeft

  1. Open BIP Skills MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

bip-skills-mcp

MCP server that serves Agent Skills — folders containing a SKILL.md plus optional references/, scripts/, assets/ — to any MCP client (Claude Desktop, Claude Code, Cursor, VS Code…).

It ships with one skill, bip-xsl-hardening (XSLT 1.0 patterns for Oracle BI Publisher HTML dashboards: locale-independent grouping, multi-shape XML, adaptive fallback, date arithmetic without EXSLT). Point SKILLS_DIR at your own folders to serve your private skills from your machine — they are never uploaded anywhere.

Tools

ToolPurpose
skills_listList skills (name, description, source). Optional query filter.
skills_getFull SKILL.md of a skill.
skills_list_filesBundled files of a skill with sizes.
skills_read_fileRead one text file of a skill (path-traversal protected, 2 MB max).

Each skill is also exposed as a resource: skill://<name>/SKILL.md. All tools are read-only.

Install

json
{  "mcpServers": {    "skills": {      "command": "npx",      "args": ["-y", "@2fizzle/bip-skills-mcp"],      "env": { "SKILLS_DIR": "C:\\path\\to\\my\\skills" }    }  }}
VariableEffect
SKILLS_DIRExtra skill folders, ;-separated on Windows, : elsewhere. Searched up to 3 levels deep. A local skill overrides a bundled one with the same name.
SKILLS_NO_BUNDLED=1Serve only SKILLS_DIR.

Requires Node.js 20.3+.

Remote use (Streamable HTTP)

Set TRANSPORT=http to serve MCP over HTTP at /mcp (health check at /health).

VariableDefaultEffect
TRANSPORTstdiohttp turns on the HTTP server.
PORT3000Listening port.
HOST127.0.0.1, or 0.0.0.0 when PORT is set by the hostBind address.
ALLOWED_HOSTS—Comma-separated public host names accepted in the Host header when binding 0.0.0.0 (DNS-rebinding protection).
MCP_AUTH_TOKEN—If set, every /mcp request must send Authorization: Bearer <token>. Leave unset only if the served skills are public.

Run locally:

bash
TRANSPORT=http npx -y @2fizzle/bip-skills-mcp# → http://127.0.0.1:3000/mcp

Deploy

  • Render: New → Blueprint → this repository (uses render.yaml). Set MCP_AUTH_TOKEN in the dashboard if you want a token, and change ALLOWED_HOSTS to your service host name.
  • Any Docker host (Fly.io, Railway, Cloud Run…): docker build -t bip-skills-mcp . then run with -p 3000:3000 -e ALLOWED_HOSTS=your.host.

A hosted instance only serves the bundled skills: SKILLS_DIR points to a local folder and has no effect there.

Connect

  • Claude (web, desktop, mobile): Settings → Connectors → Add custom connector → https://<your-host>/mcp. Custom connectors support no-auth or OAuth servers, not static bearer tokens — leave MCP_AUTH_TOKEN unset for this route.
  • Claude Code: claude mcp add --transport http bip-skills https://<your-host>/mcp --header "Authorization: Bearer <token>"

Develop

bash
npm installnpm run buildnpm run smoke        # stdio: starts the server and checks every toolnpm run smoke:http   # HTTP: checks /health, bearer auth and every tool

License

MIT

Source: README.md at commit 6866b3b

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestNov 8, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts