The Security-First Skill Manager for AI Agents
Every install runs a security scan · Skills & MCP Servers across 87 Agents (27 Verified)
Zero-dependency CLI · No signup · Offline-first
Quick Start · Features · Commands · API · Security · Contribute
⚡ Zero dependencies · 📦 404.6 kB · 🤖 27 verified agents · 🔌 Skills + MCP · 🔒 Security scoring · 📝 Skill testing · 🔧 Init templates · 🌐 Offline-first
# Try without installing
npx rolecraft --help
# Install globally (npm, pnpm, yarn, bun)
npm install -g rolecraft
# Install a skill (local, GitHub, GitLab, SSH, npm)
rolecraft install ./my-skill --cursor
# Install a skill WITH its MCP servers
rolecraft install ./postgres-rules --cursor
# Detect all agents and install a skill to every one
rolecraft setup user/repoRequirements: Node.js >= 22
Why zero dependencies? Every dependency is a supply-chain risk. rolecraft uses only Node.js built-ins (
fs,path,crypto,https) — nonode_modulessurprises.
Full install guide → · Getting Started →
- Zero dependencies — 404.6 kB, only Node.js built-ins
- Any source — local folder, GitHub/GitLab/SSH URL, npm package
- 87 agents — opencode, claude-code, cursor, copilot, aider, oh-my-pi, and more
- No registry required — works fully without a marketplace
- Security scoring — static analysis on every install: prompt injection, command injection, obfuscated code, credential harvesting. Scores 0–100
- CI-ready — lockfile-based re-install (
rolecraft ci),--yesflag,--dry-run - MCP + Skills — install skills and their MCP servers in a single command
- Shell completions — bash, zsh, fish auto-completion
- Profile system — save, apply, and share multi-agent configurations
Full feature list → · Comparison vs skills (Vercel) →
Every install is automatically scanned with static analysis that detects prompt injection, command injection, obfuscated code, and credential harvesting. Scores 0–100:
- 90+ → SAFE, install proceeds
- 70–89 → REVIEW, prompts for confirmation
- <70 → DANGER, blocked unless
--yes
rolecraft install ./my-skill # auto-scanned
rolecraft install ./my-skill --yes # force install even if DANGER| Command | Description |
|---|---|
rolecraft install <source> |
Install a skill (local, GitHub, npm, SSH) |
rolecraft list |
Show all installed skills |
rolecraft setup [<source>] |
Detect agents, optionally install to all |
rolecraft search <query> |
Search GitHub for skills (TUI with --interactive) |
rolecraft remove <slug> |
Uninstall a skill |
rolecraft mcp install <source> |
Install an MCP server |
rolecraft doctor |
Run system health check |
rolecraft test <skill-path> |
Test a skill quality with built-in assertions |
→ Full CLI Reference · All commands →
rolecraft exposes a programmatic API for your own scripts and tools:
import { install, list, search, doctor } from 'rolecraft'
const result = await install('./my-skill', { global: true })
const skills = await list()
const results = await search('code-review')
const health = await doctor()All API functions return plain objects (no side-effects).
git clone https://github.com/rolecraft-sh/rolecraft.git && cd rolecraft
npm install # sets up the pre-commit hook automatically
npm link # rolecraft CLI runs from local checkout
npm run lint # syntax + Biome checks
npm test # 1179+ tests, 0 fails expectedA pre-commit hook runs lint automatically on every commit. Zero-runtime-dependency policy is preserved — Biome and VitePress are devDependencies only.
- Docs site — full command reference and guides
- GitHub Issues — bug reports, feature requests
- SUPPORT.md — how to get help
- SECURITY.md — responsible disclosure
Contributions are welcome! See CONTRIBUTING.md for guidelines.
⭐ If rolecraft makes your AI agent workflow easier, consider starring the repo.
It helps others discover the project and shows that the community finds it useful.
MIT