Agent & Skills

Stout is the first package registry with native support for AI agents, MCP servers, and skill bundles. The skillctl CLI manages the full lifecycle.

Install skillctl

# macOS / Linux
curl -fsSL https://stout.io/install-skillctl.sh | sh

# Or with Go
go install github.com/jdziat/registry-server/cmd/skillctl@latest

Login

Authenticate with your Stout instance:

skillctl login https://registry.stout.io
# Opens browser for OAuth (GitHub, GitLab, or Google)

Search for Agents

# Search by keyword
skillctl search "code review"

# Filter by kind
skillctl search --kind mcp-server "database"
skillctl search --kind skill "testing"

Install an Agent

# Install a skill
skillctl install myorg/code-reviewer@1.0.0

# Install an MCP server
skillctl install myorg/db-connector@2.1.0 --kind mcp-server

Before installing, skillctl displays the agent's permission tier so you can review what access it requires.

Publish an Agent

Create an agent.yaml manifest in your repository:

# agent.yaml
kind: mcp-server
name: my-agent
version: 1.0.0
description: A helpful MCP server
permission_tier: network
entry_point: main.py
dependencies:
  - python>=3.11
tools:
  - name: fetch_data
    description: Fetches data from an API
    requires: network

Then publish:

skillctl publish myorg https://github.com/myorg/my-agent v1.0.0

Stout clones the repo, validates the manifest, runs guardrail scanning (prompt injection, unicode trojans, code obfuscation), validates the permission tier, signs with Sigstore, and publishes the agent.

Verify an Agent

skillctl verify myorg/my-agent@1.0.0

Verifies the Sigstore signature, checks the transparency log entry in Rekor, and displays the publisher's verified identity.

Permission Tiers

Agent Kinds