RoleCraft

The Security-First Skill Manager for AI Agents
Every install runs a security scan · Skills & MCP Servers across 87 Agents (27 Verified)
Zero-dependency CLI · No signup · Offline-first

Quick Start · Features · Commands · API · Security · Contribute

⚡ Zero dependencies · 📦 396.0 kB · 🤖 27 verified agents · 🔌 Skills + MCP · 🔒 Security scoring · 📝 Skill testing · 🔧 Init templates · 🌐 Offline-first

---

Quick Start

# Try without installing
npx rolecraft --help

# Install globally (npm, pnpm, yarn, bun)
npm install -g rolecraft

# Install a skill (local, GitHub, GitLab, SSH, npm)
rolecraft install ./my-skill --cursor

# Install a skill WITH its MCP servers
rolecraft install ./postgres-rules --cursor

# Detect all agents and install a skill to every one
rolecraft setup user/repo

Requirements: Node.js >= 20

Why zero dependencies? Every dependency is a supply-chain risk. rolecraft uses only Node.js built-ins (fs, path, crypto, https) — no node_modules surprises.

Full install guide → · Getting Started →

---

Features

• Zero dependencies — 396.0 kB, only Node.js built-ins
• Any source — local folder, GitHub/GitLab/SSH URL, npm package
• 87 agents — opencode, claude-code, cursor, copilot, aider, oh-my-pi, and more
• No registry required — works fully without a marketplace; community-driven registry optional
• Security scoring — static analysis on every install: prompt injection, command injection, obfuscated code, credential harvesting. Scores 0–100
• CI-ready — lockfile-based re-install (rolecraft ci), --yes flag, --dry-run
• MCP + Skills — install skills and their MCP servers in a single command
• Shell completions — bash, zsh, fish auto-completion
• Profile system — save, apply, and share multi-agent configurations

Full feature list → · Comparison vs skills (Vercel) →

---

Security

Every install is automatically scanned with static analysis that detects prompt injection, command injection, obfuscated code, and credential harvesting. Scores 0–100:

• 90+ → SAFE, install proceeds
• 70–89 → REVIEW, prompts for confirmation
• <70 → DANGER, blocked unless --yes

rolecraft install ./my-skill              # auto-scanned
rolecraft install ./my-skill --yes        # force install even if DANGER

→ Full security documentation

---

Commands

Command	Description
rolecraft install <source>	Install a skill (local, GitHub, npm, SSH)
rolecraft list	Show all installed skills
rolecraft setup [<source>]	Detect agents, optionally install to all
rolecraft search <query>	Search GitHub for skills (TUI with --interactive)
rolecraft remove <slug>	Uninstall a skill
rolecraft mcp install <source>	Install an MCP server
rolecraft doctor	Run system health check
rolecraft test <skill-path>	Test a skill quality with built-in assertions

→ Full CLI Reference · All commands →

---

Node.js API

rolecraft exposes a programmatic API for your own scripts and tools:

import { install, list, search, doctor } from 'rolecraft'

const result = await install('./my-skill', { global: true })
const skills = await list()
const results = await search('code-review')
const health = await doctor()

All API functions return plain objects (no side-effects).

→ Full API Reference

---

Development

git clone https://github.com/rolecraft-sh/rolecraft.git && cd rolecraft
npm install                # sets up the pre-commit hook automatically
npm link                   # rolecraft CLI runs from local checkout
npm run lint               # syntax + Biome checks
npm test                   # 1012+ tests, 0 fails expected

A pre-commit hook runs lint automatically on every commit. Zero-runtime-dependency policy is preserved — Biome and VitePress are devDependencies only.

→ Contributing guide

---

Support

• Docs site — full command reference and guides
• GitHub Issues — bug reports, feature requests
• SUPPORT.md — how to get help
• SECURITY.md — responsible disclosure

---

Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines.

---

⭐ If rolecraft makes your AI agent workflow easier, consider starring the repo.
It helps others discover the project and shows that the community finds it useful.

---

License

MIT