About SkillRelay
One shared skill library, served to every AI tool a team uses. This page is the technical deep-dive: what runs where, what we can touch, and what we deliberately can't.
Architecture, briefly
- The database is the source of truth. Skills are versioned rows; versions are immutable and attributed. Edits insert, never update: a revert inserts a copy of the old version on top. There is no state that can't be walked back.
- Editing happens over MCP (the open Model Context Protocol). A remote server exposes read/create/edit/revert tools to any MCP-capable client. Every write is validated and authorized server-side by the author's role, never by the AI client's honor system.
- Skills render into a private GitHub repository that serves every plugin ecosystem at once: a Claude plugin marketplace (Anthropic's sync distributes changes org-wide), an OpenAI plugin marketplace for ChatGPT and Codex, and Agent Skills directories for Cursor and other tools that read repos. That repo is plumbing: hosted by us by default (one isolated repo per workspace), or in your own GitHub org if you prefer custody.
- Anything MCP-capable can also read the library live over the same server, with the same per-person sign-in. Text-only tools get a Markdown export.
- Infrastructure: one instance on Fly.io (US region), encrypted volume, daily snapshots.
Least privilege, verifiably
- Per-person OAuth 2.1 (PKCE, dynamic client registration). No shared credentials, no API keys handed to teammates. Connector tokens expire after 90 days.
- Tokens, sessions, and sign-in links are stored only as SHA-256 hashes: a copy of the database yields no usable credentials.
- Our GitHub publisher app holds exactly two repository permissions (Contents and Pull requests) on the repos you grant. It cannot administer, create, or delete anything. You can verify this on the app's GitHub page. Hosted-mode repo management uses a separate app that only works inside our own org.
What we store, and where it goes
- Skill content and its full version history, your email address, workspace membership, and publish history. That's the whole list.
- Skill content is never used for anything except serving your workspace. No training, no sharing across workspaces, no resale. No analytics, no trackers, no third-party scripts on any page.
The honest threat model
- Skills are instructions your AI tools follow: a malicious member could write a skill that misleads teammates' sessions. Every version is attributed and reversible, so that's detectable and fixable, but membership should mean employment: remove people when they leave.
- New members join read-only. Edit rights are granted, not assumed; role checks run on the server on every write.
- Sign-in links work once. Emailed invites expire in 7 days; self-serve sign-in links in 15 minutes.
Leaving, cleanly
- Removing a member revokes their connector access instantly.
- Owners can delete the whole workspace from Settings: skills, history, members, tokens, and the hosted repo go with it; backups age out on their own.
- Export everything anytime (plugin ZIP or Markdown). There is no lock-in to leave behind.
Who runs this
SkillRelay is a small, independently operated product, kept deliberately boring where it counts. Questions or concerns: contact your workspace owner, or the operator via the workspace that invited you.