Skip to main content
JaaS Skills lets teams publish, discover, and run AI-agent skill packages the way a package registry handles libraries — with the addition of publish-time content-safety scanning, cryptographic provenance, and fine-grained sharing across tenants. A skill is an immutable, versioned unit of agent capability: a manifest, an I/O schema, a permissions declaration, its dependency list, and an entrypoint (a prompt, a script, or a compiled module). Once published, a given id@version never changes — publishing a fix means publishing a new version, the same discipline package registries like npm or PyPI enforce.

Discover & publish

Search a growing catalog by name, tag, category, or runtime; publish through a web authoring workflow or straight from CI on a git tag.

Version-controlled

Stateless and GitOps-driven — every publish is a fully traceable, signed event; nothing is ever mutated in place.

Guardrailed

Every publish is scanned by a standalone content-safety service before anything is persisted — secrets, unsafe code, prompt injection, license and PII exposure.

Governed

Publish a skill privately, share it with named users or tenants, or make it public — visibility is enforced per-request, never baked into the index.

​
Where to start

Run the stack locally

Get the web UI, registry API, and guardrails service running.

Understand the architecture

Three independent services, talking only over HTTP.

Publish a skill

Author in the web UI, or release straight from CI on a git tag.

Every corner case

Exactly what happens for every deterministic edge case the registry handles.