3 ms·

Show HN: Sx – an open-source package manager for AI skills, MCPs, and commands

50 points by detkin 5mo ago

detkin 5mo ago
Hi HN — I'm one of the maintainers. The short version: sx treats skills, MCP server configs, slash commands, agents, hooks, and rule files as versioned packages. You define them once, push them to a vault (a local folder, a git repo, or our hosted backend), and install them where they belong. There's a lockfile so installs are reproducible, scope levels for org / team / repo / individual, and the CLI translates the same asset into the format each AI client expects. Supported clients today: Claude Code, Cursor, GitHub Copilot, Cline, Codex, Gemini (CLI / VS Code / JetBrains / Android Studio), Kiro, claude.ai, chatgpt.com. The last two are what let non-engineering teams (marketing, legal, ops) use the same primitive instead of being locked out of the AI-assets ecosystem. The thing I'd most like feedback on is whether the scope model is the right shape. Org → team → repo → path → individual is what's emerged from talking to ~60 teams over the last six months, but I expect bigger orgs will surface scopes we haven't modeled (sub-team, environment, etc.). Why this and not just plugins / vendor marketplaces? Claude Code plugins are real and a good step up over raw git-checked-in CLAUDE.md files. The limitations show up at scale: each plugin is scoped to its publishing repo, so teams duplicate skills across plugins, and you're still locked to a single vendor's client. Full writeup with the technical details: https://www.sleuth.io/post/there-s-an-npm-shaped-hole-in-the-ai-tooling-stack/ https://www.sleuth.io/post/there-s-an-npm-shaped-hole-in-the...
- giancarlostoro 5mo ago
  Will there be support for importing other tools that have their own CLIs?
  - detkin 5mo ago
    Say more, what kind of tools are you thinking about? The tool support is certainly one of the key pillars of the project so we're open to any tool additions that will help people get value from the project.
    - giancarlostoro 5mo ago
      I have a tool that I built in Go[0], so it has its own binary, would this help to facilitate helping people install those? I have seen tools coded in Rust and Go distributed by npm install and it always bothers me, especially with npm repeatedly being a hotbed of hacked accounts. Tools that come to mind: RTK (Rust Token Killer since googling the acronym yields terrible results, asking an LLM without spelling it out too) Beads (what GuardRails was inspired by) ... and an endless list of tools people have made in place of making an MCP. I too thought about having a "AI Package manager" just found the message I sent a friend several months back. [0]: https://github.com/Giancarlos/guardrails https://github.com/Giancarlos/guardrails
- guilhermecgs 5mo ago
  not sure if this premise is valid. In most cases, skills (and other assets) are not independent of each other. Take gstack por example; it would be weird to install skill A without installing skill B. They work together. So, it is true that some skills are independent, but not all. IN my company, we ship assets by domain and workflows (development, discovery, data science, etc)
  - detkin 5mo ago
    We added the idea of dependencies for exactly that reason. However, honestly, I've not see any usage of it in the wild. Seems like most folks are ok with either bundling them and calling it a day or not really worrying about it. Very interesting about the domain and workflows. Do you think domain could map to a team or is it different? At your company how are you shipping your assets? How do you do the domain and workflow grouping?
    - guilhermecgs 5mo ago
      we are shipping as plugins. we have a internal cli that creates the plugin on the fly after you select the domains you want to work with. This cli is a standalone cli + wizard that does it all. Generally speaking, we have skills that are code related and mostly independent (ex: a skill to teach python how to log in our tech stack). Another type are skills related to our workflow (a skill to plan that outputs a file that is used in the next step "implement", together with a dev agent and so on)
      - detkin 5mo ago
        Thank you for sharing, this is exactly the kind of thing I'm interested in learning. Is this just for engineering or is it being used for other functions, like Marketing and HR as well?
        guilhermecgs 5mo ago
        engineering, product managers, business people. the problem we have right now is the repository (where to store the documents). lets say i'm a business expert and want to use a skill to create a md file with all the info about some area. It is ok to learn claude/cursor, but to upload this generated material to git is another level of problem...
chimen 5mo ago
[dead]
abelzentric 5mo ago
[flagged]
maxdo 5mo ago
why this do not belong to git, and does not go with release cycle. With bigger autonomy, I'd like my skill be tight to my release in prod/commit sha for dev, to figure out what version caused harm/bug. What is the motivation to decouple and make it a separate thing?
- maxdo 5mo ago
  with git, you even have git blame and everything else that makes it nice, once you merge it everyone else got access to it, with exception to local branch, which is a gray area, you can argue you want to lock the skill version to your code.
  - detkin 5mo ago
    The sx vault also stores things in git, I agree that it's a pretty good medium for storage. My main argument is that just using vanilla git where you store it in the directory that the AI coding agent expects means that you can't share across teams or orgs. Also, not every kind of team is comfortable with git. How would you distribute these assets to a Marketing team?
    - huflungdung 5mo ago
      [dead]
    - maxdo 5mo ago
      we are in the world where everyone is doing things differently now, but here is my 5 cents. I almost 100% sure everything that you described is part of nested harness of your company, not some external registry. what would you like to share? there a few generic skills, that are optional , e.g. tdd, etc. sure. Maybe environment related items, like going to db , how to use secrets etc, the surface of that is very very thin. you place them in git, and vibe code a tiny script on how to pull it in. done? the rest are debugging scripts, very specific skills, that are very coupled to the root repo. I tried a few similar "external" systems. Anything beyond ralph loop/use tdd skills, feels hostile in your internal system.
RGJorge 5mo ago
[dead]
KaiShips 5mo ago
[flagged]
big-chungus4 5mo ago
seven
- huflungdung 5mo ago
  [dead]
garettmd 5mo ago
How does one pronounce this tool
- detkin 5mo ago
  lol, just s ... x, the two letters. We wanted something short and easy to remember
  - gchamonlive 5mo ago
    It's like in "essex" but I fear those more adventurous will short it out at the first "e".
  - worldsavior 5mo ago
    So include the 'e'. Social media platforms monotoize sexual topics because research shows people are more attracted to them than other topics.
waffleman21 5mo ago
I've been working on something very similar: https://github.com/shrug-labs/aipack/tree/main/ https://github.com/shrug-labs/aipack/tree/main/ I therefore love the idea. Thanks for sharing
- detkin 5mo ago
  Very cool! What would you say is the biggest learning you've had about how people are using it?
  - waffleman21 5mo ago
    That all my users have different mental models for what goes into making/customization an agent, so the first step was establishing a shared vocabulary. Packs are like plugins, but more inclusive
darthproton 5mo ago
[dead]
eqvinox 5mo ago
One more package manager will fix it. One more! I don't disagree there's probably a need and niche, but why not extend and adapt an existing package manager?
lanycrost 5mo ago
[flagged]
SidVikJay 5mo ago
Congrats on the launch! Really clean approach to solving a fragmented workflow. Looking forward to diving into the repo.
tommy29tmar 5mo ago
[flagged]
dlfelps 5mo ago
Could there be a way to somehow create / export / import a local config of skills? it seems like that could be really useful to share across a single team.
- detkin 5mo ago
  Yes. You can just point sx add at your existing skill directories and it will put them into the git vault which you can easily share via Github access control.

50 points by detkin 5mo ago

Hi HN — I'm one of the maintainers. The short version: sx treats skills, MCP server configs, slash commands, agents, hooks, and rule files as versioned packages. You define them once, push them to a vault (a local folder, a git repo, or our hosted backend), and install them where they belong. There's a lockfile so installs are reproducible, scope levels for org / team / repo / individual, and the CLI translates the same asset into the format each AI client expects. Supported clients today: Claude Code, Cursor, GitHub Copilot, Cline, Codex, Gemini (CLI / VS Code / JetBrains / Android Studio), Kiro, claude.ai, chatgpt.com. The last two are what let non-engineering teams (marketing, legal, ops) use the same primitive instead of being locked out of the AI-assets ecosystem. The thing I'd most like feedback on is whether the scope model is the right shape. Org → team → repo → path → individual is what's emerged from talking to ~60 teams over the last six months, but I expect bigger orgs will surface scopes we haven't modeled (sub-team, environment, etc.). Why this and not just plugins / vendor marketplaces? Claude Code plugins are real and a good step up over raw git-checked-in CLAUDE.md files. The limitations show up at scale: each plugin is scoped to its publishing repo, so teams duplicate skills across plugins, and you're still locked to a single vendor's client. Full writeup with the technical details: https://www.sleuth.io/post/there-s-an-npm-shaped-hole-in-the-ai-tooling-stack/ https://www.sleuth.io/post/there-s-an-npm-shaped-hole-in-the...

giancarlostoro 5mo ago
Will there be support for importing other tools that have their own CLIs?
- detkin 5mo ago
  Say more, what kind of tools are you thinking about? The tool support is certainly one of the key pillars of the project so we're open to any tool additions that will help people get value from the project.
  - giancarlostoro 5mo ago
    I have a tool that I built in Go[0], so it has its own binary, would this help to facilitate helping people install those? I have seen tools coded in Rust and Go distributed by npm install and it always bothers me, especially with npm repeatedly being a hotbed of hacked accounts. Tools that come to mind: RTK (Rust Token Killer since googling the acronym yields terrible results, asking an LLM without spelling it out too) Beads (what GuardRails was inspired by) ... and an endless list of tools people have made in place of making an MCP. I too thought about having a "AI Package manager" just found the message I sent a friend several months back. [0]: https://github.com/Giancarlos/guardrails https://github.com/Giancarlos/guardrails
guilhermecgs 5mo ago
not sure if this premise is valid. In most cases, skills (and other assets) are not independent of each other. Take gstack por example; it would be weird to install skill A without installing skill B. They work together. So, it is true that some skills are independent, but not all. IN my company, we ship assets by domain and workflows (development, discovery, data science, etc)
- detkin 5mo ago
  We added the idea of dependencies for exactly that reason. However, honestly, I've not see any usage of it in the wild. Seems like most folks are ok with either bundling them and calling it a day or not really worrying about it. Very interesting about the domain and workflows. Do you think domain could map to a team or is it different? At your company how are you shipping your assets? How do you do the domain and workflow grouping?
  - guilhermecgs 5mo ago
    we are shipping as plugins. we have a internal cli that creates the plugin on the fly after you select the domains you want to work with. This cli is a standalone cli + wizard that does it all. Generally speaking, we have skills that are code related and mostly independent (ex: a skill to teach python how to log in our tech stack). Another type are skills related to our workflow (a skill to plan that outputs a file that is used in the next step "implement", together with a dev agent and so on)
    - detkin 5mo ago
      Thank you for sharing, this is exactly the kind of thing I'm interested in learning. Is this just for engineering or is it being used for other functions, like Marketing and HR as well?
      - guilhermecgs 5mo ago
        engineering, product managers, business people. the problem we have right now is the repository (where to store the documents). lets say i'm a business expert and want to use a skill to create a md file with all the info about some area. It is ok to learn claude/cursor, but to upload this generated material to git is another level of problem...

chimen 5mo ago

[dead]

abelzentric 5mo ago

[flagged]

maxdo 5mo ago

why this do not belong to git, and does not go with release cycle. With bigger autonomy, I'd like my skill be tight to my release in prod/commit sha for dev, to figure out what version caused harm/bug. What is the motivation to decouple and make it a separate thing?

maxdo 5mo ago
with git, you even have git blame and everything else that makes it nice, once you merge it everyone else got access to it, with exception to local branch, which is a gray area, you can argue you want to lock the skill version to your code.
- detkin 5mo ago
  The sx vault also stores things in git, I agree that it's a pretty good medium for storage. My main argument is that just using vanilla git where you store it in the directory that the AI coding agent expects means that you can't share across teams or orgs. Also, not every kind of team is comfortable with git. How would you distribute these assets to a Marketing team?
  - huflungdung 5mo ago
    [dead]
  - maxdo 5mo ago
    we are in the world where everyone is doing things differently now, but here is my 5 cents. I almost 100% sure everything that you described is part of nested harness of your company, not some external registry. what would you like to share? there a few generic skills, that are optional , e.g. tdd, etc. sure. Maybe environment related items, like going to db , how to use secrets etc, the surface of that is very very thin. you place them in git, and vibe code a tiny script on how to pull it in. done? the rest are debugging scripts, very specific skills, that are very coupled to the root repo. I tried a few similar "external" systems. Anything beyond ralph loop/use tdd skills, feels hostile in your internal system.

RGJorge 5mo ago

[dead]

KaiShips 5mo ago

[flagged]

big-chungus4 5mo ago

seven

huflungdung 5mo ago
[dead]

garettmd 5mo ago

How does one pronounce this tool

detkin 5mo ago
lol, just s ... x, the two letters. We wanted something short and easy to remember
- gchamonlive 5mo ago
  It's like in "essex" but I fear those more adventurous will short it out at the first "e".
- worldsavior 5mo ago
  So include the 'e'. Social media platforms monotoize sexual topics because research shows people are more attracted to them than other topics.

waffleman21 5mo ago

I've been working on something very similar: https://github.com/shrug-labs/aipack/tree/main/ https://github.com/shrug-labs/aipack/tree/main/ I therefore love the idea. Thanks for sharing

detkin 5mo ago
Very cool! What would you say is the biggest learning you've had about how people are using it?
- waffleman21 5mo ago
  That all my users have different mental models for what goes into making/customization an agent, so the first step was establishing a shared vocabulary. Packs are like plugins, but more inclusive

darthproton 5mo ago

[dead]

eqvinox 5mo ago

One more package manager will fix it. One more! I don't disagree there's probably a need and niche, but why not extend and adapt an existing package manager?

lanycrost 5mo ago

[flagged]

SidVikJay 5mo ago

Congrats on the launch! Really clean approach to solving a fragmented workflow. Looking forward to diving into the repo.

tommy29tmar 5mo ago

[flagged]

dlfelps 5mo ago

Could there be a way to somehow create / export / import a local config of skills? it seems like that could be really useful to share across a single team.

detkin 5mo ago
Yes. You can just point sx add at your existing skill directories and it will put them into the git vault which you can easily share via Github access control.