libs/skills/catalog/frontmcp-extensibility/SKILL.md
Extend FrontMCP servers with external npm packages and libraries. Covers VectoriaDB for semantic search, and patterns for integrating third-party services into providers and tools. Use when adding search, ML, database, or external API capabilities beyond the core SDK.
npx skillsauth add agentfront/frontmcp frontmcp-extensibilityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Patterns and examples for extending FrontMCP servers with external npm packages. The core SDK handles MCP protocol, DI, and lifecycle — this skill shows how to integrate third-party libraries as providers and tools.
frontmcp-development)frontmcp-config)create-plugin)Decision: Use this skill when integrating external libraries into your FrontMCP server as providers or tools.
frontmcp-setup if you don't have one).dependency (not devDependency).create-provider, create-tool).@Provider class so consumers depend on the boundary, not the library.@App({ providers: [...] }) or @FrontMcp({ providers: [...] }).this.get(TOKEN) in ToolContext/ResourceContext; never import the library directly from the tool.PublicMcpError/InvalidInputError so MCP clients see structured failures.| Scenario | Reference | Description |
| --------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------- |
| Add in-memory semantic search with VectoriaDB | references/vectoriadb.md | TF-IDF or ML semantic indexing, provider+tool pattern |
| Add tamper-evident skill audit logging | references/skill-audit-log.md | Hash-chained, signed audit records for skill executions |
| Load an app from an npm package | multi-app-composition (in frontmcp-setup) | App.esm('@scope/pkg@^1.0.0', 'AppName') pattern |
| Connect to a remote MCP server | multi-app-composition (in frontmcp-setup) | App.remote('https://...', 'ns') pattern |
| Build a reusable plugin with hooks | create-plugin-hooks (in frontmcp-development) | DynamicPlugin, context extensions, lifecycle hooks |
| Build a custom adapter for an external source | create-adapter (in frontmcp-development) | DynamicAdapter for OpenAPI, GraphQL, or custom sources |
| Auto-generate tools from an OpenAPI spec | official-adapters (in frontmcp-development) | OpenapiAdapter with filtering, auth, and transforms |
The standard pattern for integrating any external library:
@App({ providers: [...] }) or @FrontMcp({ providers: [...] })this.get(ProviderClass) (the class itself is the DI token)// 1. Provider wraps the library (the class itself is the DI token)
@Provider({ name: 'my-search', scope: ProviderScope.GLOBAL })
export class SearchProvider {
private client: ExternalLibrary;
constructor() {
this.client = new ExternalLibrary({
/* config */
});
}
async search(query: string) {
return this.client.query(query);
}
}
// 2. Tool exposes it
@Tool({ name: 'search', inputSchema: { query: z.string() } })
export default class SearchTool extends ToolContext {
async execute(input: { query: string }) {
return this.get(SearchProvider).search(input.query);
}
}
| Library | Purpose | Reference |
| ------------------- | ---------------------------------------------------- | ------------------------------- |
| VectoriaDB | In-memory TF-IDF semantic search | references/vectoriadb.md |
| Skill audit log | Tamper-evident hash-chained audit log for skill runs | references/skill-audit-log.md |
More integrations can be added as references (e.g., enclave-vm, applescript, database clients).
| Pattern | Correct | Incorrect | Why |
| -------------------- | ------------------------------------------ | ---------------------------------------- | ------------------------------------------------------------------- |
| Library access | this.get(SearchToken) from a tool | import { client } from 'lib' in a tool | DI boundary lets you swap implementations and test in isolation |
| Provider scope | ProviderScope.GLOBAL for shared clients | New instance per request | Library clients (DB pools, indices) are expensive to construct |
| Async initialisation | onInit() lifecycle hook on the provider | Constructor await | Constructors can't be async; onInit is the framework's init seam |
| Error surfaces | Throw PublicMcpError/InvalidInputError | Re-throw raw library errors | Library stack traces leak internals and aren't JSON-RPC error-coded |
dependencies (not devDependencies)@App or @FrontMcp providers: [...] array (the class itself is the DI token)this.get(ProviderClass) to access the provider (not direct imports)| Problem | Cause | Solution |
| -------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Cannot find module '<lib>' at runtime | Library declared as devDependency only | Move to dependencies; rebuild the bundle if deploying as MCPB/CLI |
| Provider constructed once per request | Default scope used; expensive client recreated each call | Set scope: ProviderScope.GLOBAL on the @Provider decorator |
| Tool sees undefined from this.get(TOKEN) | Provider not registered in the active @App/@FrontMcp scope | Add the provider class to the scope's providers: [...] array |
| Browser build fails with Node-only library | Library uses node: modules not available at the target | Gate behind availableWhen.platform, or move the integration into a server-only app and call it via a remote transport |
Each reference has matching examples under examples/<reference>/:
vectoriadb| Example | Level | Description |
| ----------------------------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| product-catalog-search | Advanced | Shows advanced VectoriaDB usage with typed document metadata, batch operations, filtered search by multiple criteria, and batch indexing of a product catalog. |
| semantic-search-with-persistence | Intermediate | Shows how to use VectoriaDB for semantic search with transformer models, filtered search, and FileStorageAdapter for persistence across restarts. |
| tfidf-keyword-search | Basic | Shows how to use TFIDFVectoria for zero-dependency keyword search in a FrontMCP provider, with field weights and index building. |
Skills are distributed as plain SKILL.md files plus a sibling references/
and examples/ tree, so consumers can pick whichever access mode fits:
| Mode | How it works |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Filesystem | Read libs/skills/catalog/frontmcp-extensibility/ directly from a clone of the catalog repo, or from a published @frontmcp/skills install. SKILL.md is the entry point. |
| frontmcp CLI | frontmcp skills list, frontmcp skills read frontmcp-extensibility, frontmcp skills read frontmcp-extensibility:references/<file>.md, frontmcp skills install frontmcp-extensibility — no server required. |
| MCP skill:// | When a developer mounts this skill into their own FrontMCP server (@FrontMcp({ skills: [...] })), the SDK exposes it via SEP-2640 resources: skill://frontmcp-extensibility/SKILL.md, skill://frontmcp-extensibility/references/{file}.md, etc. The server’s skill://index.json returns the SEP-2640 discovery document for everything mounted on it. |
The catalog itself is not an MCP server. The skill:// URIs only resolve
when a server has been configured to host this skill.
create-provider, create-tool, frontmcp-developmenttools
ALWAYS use this skill when the user asks to build, modify, or audit a FrontMCP tool. Covers everything inside `@Tool({...})`: class and function-style tools, Zod input/output schemas with derived `execute()` types, dependency injection (`this.get` / `this.tryGet`), error handling (`this.fail`, MCP error classes), throttling (rate-limit / concurrency / timeout), auth providers (single / multi / vault), availability constraints (`availableWhen`), elicitation (`this.elicit`), interactive UI widgets via `@Tool({ ui })` (MCP Apps / SEP-1865 — including `.tsx` FileSource, CSP, `window.FrontMcpBridge`, host-detect `resourceMode`), annotations (`readOnlyHint` / `destructiveHint` / …), `examples` metadata, registration in `@App({ tools })`, and per-tool unit testing. Does NOT cover: - Read-only data exposed via a URI — use `create-resource` - Conversation templates / system prompts — use `create-prompt` - Multi-tool orchestration loops — use `create-agent` - Background work / pipelines — use `create-job` / `create-workflow` - Server-level config (transport, sessions, auth modes) — use `config` / `auth` Triggers: `@Tool`, ToolContext, tool decorator, MCP tool, snake_case tool name, inputSchema, outputSchema, ToolInputOf, ToolOutputOf, `@Tool({ ui })`, tool UI widget, MCP Apps widget, FileSource widget, `.tsx` widget, ui.csp, ui.resourceMode, window.FrontMcpBridge, tool annotations, readOnlyHint, destructiveHint, rate-limit tool, throttle tool, concurrency tool, tool timeout, this.fail, this.respond, this.fetch, this.notify, this.progress, this.elicit, ElicitationDisabledError, ToolContext.execute, this.get(TOKEN), this.tryGet, register tool in @App, tool examples metadata, availableWhen, missingAxes, `tool()` function builder, Tool.esm, Tool.remote, PublicMcpError, ResourceNotFoundError, MCP_ERROR_CODES, ui://widget.
tools
Use when you want to add tracing, structured logging, or monitoring to your FrontMCP server. Covers OpenTelemetry instrumentation, vendor integrations (Coralogix, Datadog, Logz.io, Grafana), this.telemetry API for custom spans, structured JSON logging with sinks, and testing observability. Triggers: observability, telemetry, tracing, logging, monitoring, opentelemetry, otel, spans, datadog, coralogix, logz, grafana, winston, pino.
development
Use when implementing authorization, access control, RBAC, ABAC, or ReBAC for tools, resources, prompts, or skills. Covers JWT claims mapping, authority profiles, and policy enforcement.
testing
Use when you want to write tests, run tests, add e2e tests, improve test coverage, test a tool, test a resource, or learn how to test any FrontMCP component. The skill for ALL testing needs.