Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.181 Home All releases ←olderv2.1.179 v2.1.182newer→
Claude Code v2.1.181

MCP Archive Skills

What

MCP servers can now deliver skills (slash commands) as downloadable tar.gz or zip archive bundles. Claude Code fetches, validates, and unpacks the archive, then registers its SKILL.md as a command — all transparently.

Usage
(Automatic — no user action required. Archive skills appear in the command list
 alongside regular MCP skills once the server is connected.)
Details
  • Archives are fetched via the MCP resources/read protocol.
  • Supported formats: application/gzip / application/x-gzip (tar.gz) and application/zip.
  • Cached by content hash or declared digest field; subsequent connections to the same server skip re-downloading if nothing changed.
  • Hard limits enforced: maximum archive size, maximum file count, maximum uncompressed size.
  • Security: rejects path traversal entries, symlinks/hardlinks, sparse/GNU-extension tar entries, base-256 numeric fields, and entries that alias the same disk path under case-folding or dot-segment normalization.
  • Requires the MCP server to declare a digest or the archive's SHA-256 to be consistent between calls.
  • On load, shows progress message: "Downloading skill archive from \<server\>".
Evidence

Archive fetch and extraction (search for "Downloading skill archive from") — WUd() at line ~324105; tar parser (search for "tar archive contains an unsafe entry") — YZi at line ~323530

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.181 →