{"id":52420,"plugin_id":"plugin_asdk_app_6acd6818fa888191bc938f9babbaf5ff","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:49:47.919Z","digest":"c2cb1cb84916290e9b9e0a6e0afde2bd6e5381f769d3af671bb905ba9466b359","against":null,"payload":{"description":"Use when the user wants the SHIP agents to use an MCP server, or asks which MCP servers the agents can use. It lets the SHIP agents use the MCP servers that this repository declares. Bind a server to agent roles with a credential, approve its tools, start an OAuth sign-in, choose the MCP file or remove a binding. For example, the user says \"let the SHIP agents use our GitHub MCP server\" or \"give the planner Linear access\".","included_files":[],"name":"ship-mcp-servers","skill_md_contents":"---\nname: ship-mcp-servers\ndescription: Use when the user wants the SHIP agents to use an MCP server, or asks which MCP servers the agents can use. It lets the SHIP agents use the MCP servers that this repository declares. Bind a server to agent roles with a credential, approve its tools, start an OAuth sign-in, choose the MCP file or remove a binding. For example, the user says \"let the SHIP agents use our GitHub MCP server\" or \"give the planner Linear access\".\n---\n\n# Give the agents MCP servers\n\nThe SHIP agents can use the MCP servers that the repository declares in its MCP file, which is `.mcp.json` by default.\nSHIP never loads that file on its own. A server reaches the agents only through a binding. A binding names the agent\nroles that may use the server, the tools that they may call, and the credential that SHIP attaches. The agents never\nsee the credential.\n\nThis skill needs the `ship` CLI and a `SHIP_API_TOKEN`. If you do not have them, do the setup at\n<https://letsship.ai/SKILL.md> first. If this file has no `version` in its frontmatter, you read the hosted copy, so do\nthe setup too. If its `version` is older than `ship --version`, run `ship init --force`.\n\n| Command | Token scope |\n| --- | --- |\n| `ship mcp list`, `ship mcp bindings` | `connectors:read` |\n| `ship mcp tools` without flags | `connectors:read` |\n| `ship mcp bind`, `ship mcp connect`, `ship mcp remove`, `ship mcp file` | `connectors:write` |\n| `ship mcp tools --refresh`, `ship mcp tools --approve` | `connectors:write` |\n\nChanges also need the admin or owner role in the organization. A token never has more access than the person who\ncreated it.\n\n## See what the repository declares\n\n```bash\nship mcp list --project prj_123\nship mcp bindings\n```\n\n`ship mcp list` shows the servers in the MCP file of one project and the binding of each. `ship mcp bindings` shows\nevery binding in the projects of your organization. Neither command shows a credential value. They show only the names\nof the fields that are set.\n\n## Bind a server\n\n`--roles` lists every agent that may use the server: `planner`, `builder`, `reviewer` and `qa`, or `none`. The Reviewer\nand the QA agent get only the tools that read, and they cannot use a server that runs inside the sandbox.\n\n```bash\nship mcp bind github --roles planner,qa --header-file Authorization=gh.txt\nship mcp bind sentry --roles qa --env-var-file KEY=t --allow-host sentry.io\nship mcp bind linear --roles planner,builder --no-credential\n```\n\nGive credentials as files, so that they stay out of the shell history. Do not put a token in a command line.\n\n- `--header-file <Name=path>`: a request header for a remote server. The file holds the complete value, for example\n  `Bearer <token>`. You can give the flag more than one time.\n- `--env-var-file <NAME=path>` with `--allow-host <host>`: an environment variable for an isolated server, and the hosts\n  that the credential may go to. These flags imply `--transport isolate`.\n- `--no-credential`: bind with no credential, and remove a stored one.\n\nWithout a credential flag, the binding keeps the credential that it has.\n\n`--transport` is `remote`, `isolate` or `local`. With `remote`, SHIP sends requests to the URL of the server. With\n`isolate`, SHIP runs the npm package of the server in isolation, so that the server can hold a secret. With `local`, the\nserver runs inside the sandbox with no credential. The default is what the declaration of the server allows. `--url`\nsets a fixed https URL for the server. Without `--transport` or `--url`, the binding keeps its current server.\n\n## Approve the tools\n\nA new binding gives the agents no tools. Approve them after you bind the server:\n\n```bash\nship mcp tools github --refresh\nship mcp tools github --approve get_issue,get_file --attest get_file\n```\n\nWithout flags, the command prints the last tool list of the server, with the approval of each tool and whether it only\nreads. The `--refresh` flag gets the current list from the server first. The `--approve` flag replaces the approved set\nwith the tools that you name. A tool that has no annotation from the server goes to the Reviewer and the QA agent only if you also\nname it in `--attest`. With `--attest`, you confirm that the tool only reads. Name only the tools that the task needs.\n\n## Sign in to a server that uses OAuth\n\n```bash\nship mcp connect linear --project prj_123\n```\n\nThe command prints a link. A person opens it in a browser where they are signed in to the SHIP console. The provider\nthen sends them back to the console, which stores the credential. You cannot complete this step for the user. Give the\nuser the link. The link works one time and expires.\n\n## Remove a binding or change the MCP file\n\n```bash\nship mcp remove notion --project prj_123\nship mcp file .cursor/mcp.json --project prj_123\nship mcp file default\n```\n\n`ship mcp remove` deletes the binding and its stored credential. From their next run, the agents do not get the server.\nThe command does not change the MCP file of the repository.\n\n`ship mcp file` sets the file that declares the servers of the project, for example `.cursor/mcp.json`. The value\n`default` sets it back to `.mcp.json`. SHIP refuses the command while the `ship.yml` of the repository sets\n`mcp.config`, because that setting has priority.\n\n## Exit codes\n\nEvery command also takes `--json`, which prints the raw API response.\n\n| Exit code | Meaning | What to do |\n| --- | --- | --- |\n| 2 | The arguments are wrong. The message names the problem. | Fix the command. |\n| 3 | The token is not set, or it does not have the scope of the command, or the role cannot change it. | Ask the user for a token with the scope, from an admin. Do not retry. |\n| 4 | SHIP found no such server, binding or project. | Check the server name with `ship mcp list`, or give `--project <id>`. |\n| 5 | The change needs something that is not true yet. | Do what the message says, then run the command again. |\n| 6 | The organization did not finish the onboarding. | Ask the user to finish it in the console. |\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}