[helpcodeai]

Summary

Workspace skills v2, see #1148. Builds on #1146: until that is merged this PR also shows its commit; the changes here are in the last commit, "Serve workspace skills on demand with procedures and versions".

Today every applied skill of a server is pasted into the MCP initialize instructions, a skill can only hold a 2,000-character rule, and an edit overwrites it. Workspaces with many skills or real procedures ended up keeping them outside AnythingMCP and pointing to them. This serves skills on demand, lets a skill carry a full procedure, and keeps versions and usage.

Changes

• On-demand tools on /mcp/:serverId, offered when the caller can see at least one applied skill:
  • skills_list(query?): id, title, when to use, version, whether it has a procedure.
  • skill_get(skill): one skill in full, by id or exact title (case-insensitive). Counts the use.
  • Both read at call time and only return skills of the server's organization, scoped to the server and the caller's visible connectors. A skill the caller cannot see answers the same as one that does not exist.
• MCP prompts: each visible applied skill is registered as a prompt (slug of the title, deduplicated), so clients with a prompt picker can start it.
• Delivery mode per server (mcp_server_configs.skills_delivery, editable on the MCP server page and via PUT /api/mcp-servers/:id):
  • auto (default): full text up to 6,000 characters, otherwise an index of ids, titles and "when to use", capped at about 8,000 characters with a pointer to skills_list.
  • inline: always the full text (today's format, unchanged byte for byte for skills without a procedure).
  • index: always the index.
  • The migration sets inline on servers whose applied server-scoped skills are already above 6,000 characters.
• Procedure (body, markdown, up to 20,000 characters): never pasted into the instructions. Full-text mode mentions it with the skill id; skill_get and the prompt return it. The shared /mcp workspace guide has no skill_get, so it returns procedures in full. skills_save_to_workspace accepts an optional procedure.
• Versions: an edit that changes title, when to use, instruction or procedure writes the previous content to kg_skill_versions and increments version; status-only changes do not. GET /api/knowledge-graph/skills/:id/versions (ADMIN/EDITOR).
• Usage: use_count and last_used_at, incremented by skill_get and prompt use (best effort, never fails the read).
• Consolidate with AI leaves skills that have a procedure untouched (the merge works on short rules and would drop it).
• kg_how_to_obtain and the knowledge-graph resource list skill ids and point to skill_get.
• UI: AI Skills page shows source, version, usage, a collapsible procedure, history, and a procedure field when creating or editing. The MCP server page gets "Workspace skills on connect".
• Docs: docs/knowledge-graph.md, "How skills reach the AI client".

Cloud and self-hosted behave the same. The shared /mcp toolset is unchanged.

Behaviour change for existing servers

Checked against current data before writing the migration: only servers above the threshold change mode (they are pinned to inline, which keeps today's text); every other server with skills stays under 6,000 characters, so auto produces exactly today's text. What is new for servers with applied skills is two read-only tools (skills_list, skill_get) and the skill prompts.

Type

• New feature
• Documentation

Testing

• Added/updated unit tests
• Tested manually

Commands and results:

• packages/backend: npx prisma generate, npx tsc --noEmit -p tsconfig.json: no errors
• packages/backend: npm run lint: 0 errors (existing warnings only); eslint --fix rewrites of untouched files were reverted
• packages/backend: npx jest: 676 suites passed, 4 skipped; 20429 tests passed, 1496 skipped
• packages/frontend: npx tsc --noEmit -p tsconfig.json: no errors; eslint on the changed files: no findings
• Migration: prisma migrate deploy on an empty scratch database, prisma migrate diff against the schema: empty. Data check on a scratch database: a server with 25 applied skills (about 7,500 characters) became inline, a server with one short applied skill and one long pending skill stayed auto.

New unit tests cover the delivery modes (inline format unchanged, procedure referenced not pasted, auto switch, index budget and overflow), getForCaller scope and usage counting, versioning (content change vs status-only, other organization refused), and the endpoint (tools and prompts only when a skill is visible, scope arguments, skill_get text and not-found).

Manual end-to-end on a local backend (scratch database, MCP API key, JSON-RPC over /mcp/:serverId):

• No skills: tool list unchanged, no skills_list / skill_get.
• Skill with a procedure created: instructions end with the skill and (full procedure: skill_get "<id>"); both tools appear; skill_get by exact title (different case) returns the procedure; prompts/list shows angebot-erstellen and prompts/get returns the skill.
• Edit of the instruction: version 2, history holds version 1 with the editor; a status-only change keeps version 2; usage shows 2 (skill_get + prompt).
• A 20,001-character procedure is rejected with 400; an unknown skillsDelivery is rejected with 400.
• Server switched to index: the instructions show the index; switched back to auto from the UI, saved and confirmed via the API.
• Second workspace (same user, separate server and key): skill_get with the first workspace's skill id or title returns "No skill … on this server"; skills_list shows only its own skill; the versions endpoint returns 404.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (backend npx jest)
• This PR has a descriptive title

Related Issues

Fixes #1148
Depends on #1146

[helpcodeai]

Update after review (19 Oct): verified with a real model (gpt-4o-mini driving the MCP server as a chat client) and two independent security reviews. Fixes are in the PRs they belong to:

• Workspace skills v2: on-demand skills, procedures, versions and usage #1149: the skills_v2 migration now pins every server that receives applied skills today (its own or its connectors') to inline, so no existing server changes behaviour. On Cloud that is 13 servers.
• Folders for skills and company memory, with role limits #1154: folder references use NO ACTION (not cascade / set null), so a racing delete cannot move limited content to the top level.
• Learn skills from fixed errors, consolidate as proposals, link memory to the graph #1158: the remaining fixes (server-workspace scoping of per-server calls, explicit _intent request, any-word memory search, injection-like memory refused, error codes only in proposals, folder visibility for editors, call-time rechecks in stateful sessions, and more); see its description.

Merge the stack in order (#1146 → #1149 → #1152 → #1154 → #1158) and release them together.