axiomantic/tooling-discovery
skills/tooling-discovery/SKILL.md
Use when looking for available tools, MCP servers, or CLI utilities for a task. Triggers: 'what tools do I have', 'is there an MCP for this', 'what's available', 'find a tool for', 'discover tooling', 'what CLI tools exist'. NOT for: documenting existing tools (use documenting-tools).
$ install --global
skillsauthnpx skillsauth add axiomantic/spellbook tooling-discoveryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 3, 2026, 3:23 PM23.0s1 file scanned
SKILL.md
- name:
- tooling-discovery
- description:
- Use when looking for available tools, MCP servers, or CLI utilities for a task. Triggers: 'what tools do I have', 'is there an MCP for this', 'what's available', 'find a tool for', 'discover tooling', 'what CLI tools exist'. NOT for: documenting existing tools (use documenting-tools).
Tooling Discovery
<ROLE> Tool Scout. Your job is to surface every relevant tool for the user's domain, with clear trust classification so they can make informed decisions. </ROLE>Invariant Principles
- Registry is source of truth. Only recommend tools that exist in the curated YAML registry. Never fabricate tool entries.
- Trust tiers are non-negotiable. Always present trust classification. Tier 4+ tools require explicit risk warnings before recommendation.
- Detection before recommendation. Always run the tooling_discover MCP tool to check availability. Do not skip detection and guess.
Workflow
Step 1: Determine Domain Keywords
<analysis> Before calling the discovery tool, analyze the user's request to extract domain keywords: - What technology area is being discussed? - What keywords would match the registry domains? - Is there project context (language, framework) that adds implicit keywords? </analysis>Extract domain keywords from one of:
- User's explicit request (e.g., "what tools exist for Jira integration?")
- Current project context (language, framework, key dependencies)
- Active feature being developed (technologies mentioned)
Combine into a comma-separated keyword string.
Step 2: Call tooling_discover
tooling_discover(
domain_keywords="<comma-separated keywords>",
project_path="<project root or empty for auto-detect>"
)
Step 3: Present Results
<reflection> After receiving results, reflect: - Are the matched domains relevant to the user's actual need? - Are there available tools that the user might not know about? - Are there any tier 4+ tools that need trust warnings? - Did the detection summary reveal unexpected findings? </reflection>Group results by availability and trust:
Available Tools (detected on this system):
- List tools where
available: true, grouped by detection method - For each: name, type, trust tier label, description, how detected
Registry Tools (known but not detected):
- List tools where
available: false - For each: name, type, trust tier label, description, source URL
Trust Warnings (tier 4+):
- For any tool with trust_tier >= 4, prominently display risks and next_steps
Step 4: Suggest Integration
For available but potentially unused tools:
- Suggest how to leverage them in the current workflow
- For MCP servers: note they are already connected
- For CLIs: note they can be called via Bash tool
- For libraries: note they are already in project dependencies
Related Skills
axiomantic/writing-skills
testing
VerifiedTrustedCommunity
Use when creating new skills, editing existing skills, or verifying skills work before deployment. Triggers: 'write a skill', 'new skill', 'create a skill', 'skill doesn't work', 'skill isn't firing', 'edit skill', 'skill quality'. NOT for: general prompt improvement (use instruction-engineering) or command creation (use writing-commands).
5SKILL.mdUpdated Apr 3, 2026
axiomantic/writing-plans
development
VerifiedTrustedCommunity
Use when you have a spec, design doc, or requirements and need a detailed implementation plan before coding. Triggers: 'write a plan', 'create implementation plan', 'plan this out', 'break this down into steps', 'convert design to tasks', 'implementation order'. Also invoked by develop during planning. NOT for: reviewing existing plans (use reviewing-impl-plans).
5SKILL.mdUpdated Apr 3, 2026
axiomantic/writing-commands
testing
VerifiedTrustedCommunity
Use when creating new commands, editing existing commands, or reviewing command quality. Triggers: 'write command', 'new command', 'create a command', 'review command', 'fix command', 'command doesn't work', 'add a slash command'. NOT for: skill creation (use writing-skills).
5SKILL.mdUpdated Apr 3, 2026
axiomantic/verifying-hunches
development
VerifiedTrustedCommunity
Use when about to claim discovery during debugging. Triggers: "I found", "this is the issue", "I think I see", "looks like the problem", "that's why", "the bug is", "root cause", "culprit", "smoking gun", "aha", "got it", "here's what's happening", "the reason is", "causing the", "explains why", "mystery solved", "figured it out", "the fix is", "should fix", "this will fix". Also invoked by debugging, scientific-debugging, systematic-debugging before any root cause claim.
5SKILL.mdUpdated Apr 3, 2026