feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
+- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)
 
 ### Changed
 - Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)

docs/docs/features/mcp-server.mdx

@@ -452,3 +452,44 @@ Parameters:
 | `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
 | `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
 | `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |
+
+### `create_skill`
+
+You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.
+
+You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.
+
+Parameters:
+| Name | Required | Description |
+|:---------------|:---------|:------------|
+| `name` | yes | Display name for the skill (1-80 characters). |
+| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
+| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
+| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |
+
+### `update_skill`
+
+You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.
+
+You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.
+
+Parameters:
+| Name | Required | Description |
+|:---------------|:---------|:------------|
+| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
+| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
+| `name` | no | New display name (1-80 characters). |
+| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
+| `description` | no | New description of when to use the skill (1-500 characters). |
+| `instructions` | no | New markdown instructions (1-20,000 characters). |
+
+### `list_skills`
+
+You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.
+
+You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.
+
+Parameters:
+| Name | Required | Description |
+|:--------|:---------|:------------|
+| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

packages/web/src/app/api/(server)/ee/mcp/route.ts

@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
     }
 
     const response = await sew(() =>
-        withOptionalAuth(async ({ user }) => {
+        withOptionalAuth(async ({ user, principal }) => {
             if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
                 return notAuthenticated();
             }
@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
                 },
             });
 
-            const mcpServer = await createMcpServer();
+            // Repository-scoped access tokens never get the skill management
+            // tools: their documented authorization boundary is the selected
+            // repositories only. The tools also reject scoped principals
+            // per-request, since a session is keyed by owner, not principal.
+            const mcpServer = await createMcpServer({
+                canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
+            });
             await mcpServer.connect(transport);
 
             return transport.handleRequest(request);

packages/web/src/ee/features/chat/agent.test.ts

@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
         listReposDefinition: createToolDefinition('list_repos'),
         listTreeDefinition: createToolDefinition('list_tree'),
         readFileDefinition: createToolDefinition('read_file'),
+        createSkillDefinition: createToolDefinition('create_skill'),
+        updateSkillDefinition: createToolDefinition('update_skill'),
+        listSkillsDefinition: createToolDefinition('list_skills'),
         toVercelAITool: vi.fn((definition: { name: string }) => ({
             name: definition.name,
         })),
@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
         expect(tools).toHaveProperty('list_branches');
         expect(activeTools).toContain('list_branches');
     });
+
+    test('makes the skill management tools available to authenticated, interactive requesters', async () => {
+        const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
+            userId: 'user-1',
+            orgId: 1,
+        });
+
+        for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
+            expect(tools).toHaveProperty(toolName);
+            expect(activeTools).toContain(toolName);
+        }
+    });
+
+    test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
+        const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);
+
+        for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
+            expect(tools).not.toHaveProperty(toolName);
+            expect(activeTools).not.toContain(toolName);
+        }
+        // The other built-ins are unaffected by the gate.
+        expect(tools).toHaveProperty('list_branches');
+    });
 });
 
 describe('createMessageStream approval continuation', () => {

packages/web/src/ee/features/chat/agent.ts

@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
 import { Source } from "@/features/chat/types";
 import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
 import { createTools } from "./tools";
+import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
 import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
 import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
 import {
@@ -692,7 +693,22 @@ const createAgentStream = async ({
         skillRegistry,
     });
 
-    const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
+    const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
+
+    // The skill management tools require an interactive, authenticated
+    // requester: same gate as load_skill. This also excludes programmatic runs
+    // (askCodebase, /api/chat/blocking) where nobody can answer an approval
+    // request.
+    const skillManagementToolNames: string[] = [
+        createSkillDefinition.name,
+        updateSkillDefinition.name,
+        listSkillsDefinition.name,
+    ];
+    const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
+        ? allBuiltinTools
+        : Object.fromEntries(
+            Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
+        );
     const builtinToolNames = Object.keys(builtinTools);
     const allTools: Record<string, Tool> = {
         ...builtinTools,

packages/web/src/ee/features/chat/askCommandsContext.tsx

@@ -0,0 +1,11 @@
+'use client';
+
+import { createContext, useContext } from 'react';
+import type { AskCommandDefinition } from '@/features/chat/commands/types';
+
+// The chat page's server-rendered slash-command catalog, made available to
+// nested chat components (e.g. the tool approval banner resolves a skill's
+// display name from its slug + scope).
+export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);
+
+export const useAskCommands = () => useContext(AskCommandsContext);

packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
 import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
 import { McpReconnectBanner } from './mcpReconnectBanner';
 import { ToolApprovalProvider } from '../../toolApprovalContext';
+import { AskCommandsContext } from '../../askCommandsContext';
 import useCaptureEvent from '@/hooks/useCaptureEvent';
 import { SignInPromptBanner } from './signInPromptBanner';
 import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
@@ -459,6 +460,7 @@ export const ChatThread = ({
 
     return (
         <ToolApprovalProvider value={addToolApprovalResponse}>
+        <AskCommandsContext.Provider value={askCommands}>
         <McpReconnectContext.Provider value={mcpReconnectContextValue}>
         <McpServerIconContext.Provider value={mcpServerIconMap}>
         <McpToolNameContext.Provider value={mcpToolNameMap}>
@@ -615,6 +617,7 @@ export const ChatThread = ({
         </McpToolNameContext.Provider>
         </McpServerIconContext.Provider>
         </McpReconnectContext.Provider>
+        </AskCommandsContext.Provider>
         </ToolApprovalProvider>
     );
 }

packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
         expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
     });
 
+    test('renders a create_skill success summary with the name and command', () => {
+        const createSkillPart = {
+            type: 'tool-create_skill',
+            toolCallId: 'tool-call-create-skill',
+            state: 'output-available',
+            input: {
+                name: 'Review PR',
+                slug: 'review-pr',
+                description: 'Review a pull request.',
+                instructions: 'Look for correctness issues first.',
+            },
+            output: {
+                output: '{}',
+                metadata: {
+                    id: 'skill-1',
+                    slug: 'review-pr',
+                    name: 'Review PR',
+                    url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
+                },
+            },
+        } satisfies SBChatMessagePart;
+
+        const { container } = render(
+            <TooltipProvider>
+                <DetailsCard
+                    chatId="chat-id"
+                    isExpanded={true}
+                    onExpandedChanged={vi.fn()}
+                    isThinking={false}
+                    isTurnInProgress={false}
+                    isNetworkActive={false}
+                    isAwaitingToolApproval={false}
+                    thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
+                />
+            </TooltipProvider>
+        );
+
+        expect(container.textContent).toContain('Created skill');
+        expect(container.textContent).toContain('Review PR');
+        expect(container.textContent).toContain('/review-pr');
+        expect(screen.queryByText('Creating skill...')).toBeNull();
+    });
+
+    test('renders an update_skill success summary with the name and command', () => {
+        const updateSkillPart = {
+            type: 'tool-update_skill',
+            toolCallId: 'tool-call-update-skill',
+            state: 'output-available',
+            input: {
+                slug: 'review-pr',
+                scope: 'shared',
+                name: 'Review PR v2',
+            },
+            output: {
+                output: '{}',
+                metadata: {
+                    id: 'skill-1',
+                    slug: 'review-pr',
+                    name: 'Review PR v2',
+                    scope: 'shared',
+                    url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
+                },
+            },
+        } satisfies SBChatMessagePart;
+
+        const { container } = render(
+            <TooltipProvider>
+                <DetailsCard
+                    chatId="chat-id"
+                    isExpanded={true}
+                    onExpandedChanged={vi.fn()}
+                    isThinking={false}
+                    isTurnInProgress={false}
+                    isNetworkActive={false}
+                    isAwaitingToolApproval={false}
+                    thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
+                />
+            </TooltipProvider>
+        );
+
+        expect(container.textContent).toContain('Updated shared skill');
+        expect(container.textContent).toContain('Review PR v2');
+        expect(container.textContent).toContain('/review-pr');
+        expect(screen.queryByText('Updating skill...')).toBeNull();
+    });
+
+    test('renders a list_skills count summary', () => {
+        const listSkillsPart = {
+            type: 'tool-list_skills',
+            toolCallId: 'tool-call-list-skills',
+            state: 'output-available',
+            input: {},
+            output: {
+                output: '{"skills":[]}',
+                metadata: { count: 3 },
+            },
+        } satisfies SBChatMessagePart;
+
+        render(
+            <TooltipProvider>
+                <DetailsCard
+                    chatId="chat-id"
+                    isExpanded={true}
+                    onExpandedChanged={vi.fn()}
+                    isThinking={false}
+                    isTurnInProgress={false}
+                    isNetworkActive={false}
+                    isAwaitingToolApproval={false}
+                    thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
+                />
+            </TooltipProvider>
+        );
+
+        expect(screen.queryByText('Listed skills')).toBeTruthy();
+        expect(screen.queryByText('3 skills')).toBeTruthy();
+    });
+
+    test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
+        const approvalRequestedPart = {
+            type: 'tool-create_skill',
+            toolCallId: 'tool-call-approval',
+            state: 'approval-requested',
+            input: {
+                name: 'Review PR',
+                slug: 'review-pr',
+                description: 'Review a pull request.',
+                instructions: 'Look for correctness issues first.',
+            },
+            approval: { id: 'approval-1' },
+        } satisfies SBChatMessagePart;
+
+        render(
+            <TooltipProvider>
+                <DetailsCard
+                    chatId="chat-id"
+                    isExpanded={true}
+                    onExpandedChanged={vi.fn()}
+                    isThinking={false}
+                    isTurnInProgress={true}
+                    isNetworkActive={false}
+                    isAwaitingToolApproval={true}
+                    thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
+                />
+            </TooltipProvider>
+        );
+
+        expect(screen.queryByText('Waiting for approval')).toBeTruthy();
+        expect(screen.queryByText('Creating skill...')).toBeNull();
+    });
+
+    test('shows a denied label for an output-denied tool call', () => {
+        const deniedPart = {
+            type: 'tool-create_skill',
+            toolCallId: 'tool-call-denied',
+            title: 'Create skill',
+            state: 'output-denied',
+            input: {
+                name: 'Review PR',
+                slug: 'review-pr',
+                description: 'Review a pull request.',
+                instructions: 'Look for correctness issues first.',
+            },
+            approval: { id: 'approval-1', approved: false, reason: 'User denied' },
+        } satisfies SBChatMessagePart;
+
+        render(
+            <TooltipProvider>
+                <DetailsCard
+                    chatId="chat-id"
+                    isExpanded={true}
+                    onExpandedChanged={vi.fn()}
+                    isThinking={false}
+                    isTurnInProgress={false}
+                    isNetworkActive={false}
+                    isAwaitingToolApproval={false}
+                    thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
+                />
+            </TooltipProvider>
+        );
+
+        expect(screen.queryByText('Create skill denied')).toBeTruthy();
+        expect(screen.queryByText('Creating skill...')).toBeNull();
+    });
+
     test('renders an unavailable skill load instead of a silent no-op', () => {
         const unavailableSkillPart = {
             type: 'tool-load_skill',