Skills & MCP

Before you begin

• A trusted Skill or MCP source
• The service URL, OAuth configuration, or bearer token supplied by its owner
• A plan for which tools and permissions the connection should expose

1. Open Skills & MCP, inspect the source, tools, and permission summary, then install or import the Skill.
2. Enable it and type $ in Composer. Use ↑/↓ and Enter to insert its token; sending remains separate.
3. For custom MCP, choose a transport and enter only the required settings.
4. Test the connection and inspect the tool list before using it in a task.
5. Remove the local configuration when it is no longer trusted; revoke remote OAuth separately at the provider.

The Skills page separates global and workspace Skills and exposes search, import, refresh, and enabled states.

Verify that the archive or folder contains SKILL.md; auto-install should be limited to reviewed, non-high-risk Skills.

stdio

Enter the command and arguments. Verify the binary exists and pass secrets through environment variables only when required.

Remote HTTP

Use HTTPS and prefer OAuth over long-lived bearer tokens. Never paste a token into a shared config or prompt.

Connector cards expose availability, connection state, enablement, and removal while preserving explicit failures.

Choose Remote HTTP or Local command and enter only the URL, OAuth, or request credentials required by the service.

◇

Approval checkpointReview the service domain, process command, tool name, and arguments on first connect and on every risky tool call.