MCP Skill Repository — serving layer

The single MCP front door to a shared skill + lingua collaboration repository. Gitea is the storage and PR engine, but it sits behind this layer (the facade principle): general users never touch Gitea — everything goes through MCP.

Auth mode on this instance: OIDC (Keycloak)

Connect your own Claude

Add this server as an HTTP MCP endpoint:

claude mcp add --transport http skills https://skills.corp.carbonactive.ch/mcp

Under OIDC you also pass a bearer token (--header "Authorization: Bearer <token>"). The MCP endpoint is /mcp — it speaks Streamable HTTP and is not browsable in a browser.

MCP tools

Browse	`list_skills`, `read_skill`, `search_skills`
Use	`use_skill` (prompt), `invoke_skill` (run server-side / brokered), `resolve_skill` (dependency resolution), `service_status`
Contribute	`propose_edit` (server opens a Gitea PR for you), `publish_private` (owner-only skill, no review), `rate_skill`, `check_skill_draft`, `report_usage`
Operate (maintainer capability)	`update_skill`, `delete_skill`, `deprecate_skill`, `merge_proposal`

Every listing and read is filtered by the caller's entitlement; the operate tools require the skill.maintain capability.

Who it's for

Mara — hardcore developer / skill author & maintainer; runs locally with her own Claude, uses the direct git-PR path, reviews everyone else's PRs.
Jonas — tech-savvy power user (marketing); discovers curated skills, runs them server-side, suggests fixes in plain language.
Richard — C-level executive; states needs in plain language, consumes deliverables server-side (brokered), never touches anything technical.
Sabine — operations (logistics / back office / procurement); works entirely in Claude web, finds and uses skills, flags problems.
Tomás — external technical partner; brings his own Claude, gets authenticated, entitlement-scoped access to exactly his tools.
Erik — platform maintainer / operator; keeps the deployment up, secure and reproducible, and the facade intact (does not author or consume skills for the job).

Auth modes

DEV-OPEN	Local only, no authentication; every caller is `internal-full`. Must be explicitly opted in (`ALLOW_DEV_OPEN`) — never in a shared deployment.
OIDC	Bearer identity via Keycloak. Roles map to capabilities: `internal` (full catalogue) · `external` (only externally-shareable skills) · `maintainer` (the operate tools).

MCP Skill Repository — serving layer

Connect your own Claude

MCP tools

Who it's for

Auth modes

Links