Skip to content

feat(skill): add OAuth-first setup, slim SKILL.md via progressive disclosure #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lxcong merged 4 commits into from
Jun 29, 2026
Merged

feat(skill): add OAuth-first setup, slim SKILL.md via progressive disclosure #62

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dd67dd1
refactor(skill): extract upgrade/telemetry flow into references, slim…
lxcong Jun 25, 2026
9a22efa
Merge branch 'main' into refactor/slim-agentkey-skill
lxcong Jun 29, 2026
934dd5c
feat(skill): OAuth-first setup, API key as fallback
lxcong Jun 29, 2026
b7c66ff
docs(security): align setup posture with OAuth-first flow
lxcong Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,16 +46,16 @@ The skill verifies MCP health by calling the MCP `list_tools` endpoint directly
| `~/.config/agentkey/auto-upgrade` | written by the agent on user's "Always keep me up to date" choice; read by Step 0 to skip the prompt | Persistent auto-upgrade opt-in |
| `~/.config/agentkey/update-snoozed` | written by the agent on user's "Not now" choice; read by `check-update.sh` to suppress reminders | Snooze state (`<version> <level> <epoch>`) |
| `~/.config/agentkey/update-disabled` | written by the agent on user's "Never ask again" choice; read by `check-update.sh` to exit silently | Permanent disable for update checks |
| `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) / `%APPDATA%/Claude/...` (Windows) | written by the separate `npx -y @agentkey/cli --auth-login` command, **not** by the skill | MCP registration |
| `~/.claude.json` | written by `--auth-login` (`claude mcp add`), **not** by the skill | Claude Code MCP registration + `AGENTKEY_API_KEY` storage |
| `~/.cursor/mcp.json` | written by `--auth-login`, **not** by the skill | MCP registration |
| `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) / `%APPDATA%/Claude/...` (Windows) | written by your MCP client / agent when you register the AgentKey server, **not** by the skill | MCP registration |
| `~/.claude.json` | written by your MCP client / agent when you register the AgentKey server (e.g. `claude mcp add`), **not** by the skill | Claude Code MCP registration (+ `AGENTKEY_API_KEY` storage on the API-key fallback path) |
| `~/.cursor/mcp.json` | written by your MCP client / agent when you register the AgentKey server, **not** by the skill | MCP registration |

### Network egress from the skill

| Destination | When | Why |
|---|---|---|
| `api.github.com` | At most every 24 hours | Look up the latest release tag |
| npm registry | When the user first runs `npx -y @agentkey/cli --auth-login` | Resolve and run the AgentKey CLI |
| npm registry | When the user accepts a skill update | Resolve and run `npx skills update agentkey` |

### Credential handling

Expand Down
Loading
Loading