Consolidate 5 plugins into AgentKit and SaaSKit (v2.0.0)#20
Open
saif-at-scalekit wants to merge 65 commits into
Open
Consolidate 5 plugins into AgentKit and SaaSKit (v2.0.0)#20saif-at-scalekit wants to merge 65 commits into
saif-at-scalekit wants to merge 65 commits into
Conversation
Shift the agent-auth plugin toward a Tessl-like docs/skills/rules layout so durable AgentKit guidance is separated from Claude-specific runtime files. This makes live metadata the documented source of truth for tools while keeping existing connector notes available as secondary references. Co-authored-by: Cursor <cursoragent@cursor.com>
Raise the agent-auth plugin manifest to 2.0.0 so the hybrid AgentKit reorganization can ship as a major update and users can pick up the new version cleanly. Co-authored-by: Cursor <cursoragent@cursor.com>
Add a one-line Claude Code installer that adds the marketplace, installs the agent-auth plugin, and points users to enable auto-update. Also thread official docs.scalekit.com AgentKit links through the new canonical docs so the plugin can point back to the published product documentation. Co-authored-by: Cursor <cursoragent@cursor.com>
Add the stable llms.txt and sitemap-0.xml links to the main Claude Code auth stack docs and the canonical agent-auth docs entrypoints so users and agents have clear fallback indexes into published Scalekit documentation. Co-authored-by: Cursor <cursoragent@cursor.com>
Move the live AgentKit discovery and execution workflow into the testing skill so the plugin follows the modern skills-first structure. Keep `/test-tool` only as a legacy compatibility alias to preserve older usage without making `commands/` the source of truth. Co-authored-by: Cursor <cursoragent@cursor.com>
Restructure the marketplace from 5 separate plugins (agent-auth, full-stack-auth, mcp-auth, modular-sso, modular-scim) into 2 focused plugins: AgentKit (AI agent authentication) and SaaSKit (B2B SaaS auth). AgentKit (5 skills): - Renamed from agent-auth, adopting Scalekit AgentKit branding - Added docs/ + rules/ content model from PR #19 - Skills: integrating, discovering tools, testing tools, MCP server, production readiness SaaSKit (11 skills): - New plugin consolidating FSA, SSO, SCIM, and MCP server auth - 13 docs files including framework guides (Python, Next.js, Go, Spring Boot, Laravel) - Thin skills routing into docs/ layer - Skills: core auth, sessions, access control, SSO, SCIM, MCP OAuth, API auth, Python frameworks, Next.js, migration, production readiness - Consolidated agents, commands, hooks, and references from all 4 source plugins Both plugins at version 2.0.0 with the docs/ + rules/ + thin skills/ content model.
2 tasks
The Scalekit MCP server at mcp.scalekit.com provides tool discovery, auth link generation, and tool execution natively. The testing skill forced users to set up env vars, remember slash command syntax, and wait for a Python script — all to get the same result. Updated discovering-connector-tools, integrating-agentkit, and docs to point to the MCP server as the live playground.
… mcp-helper Removed 3 agents that don't justify being separate agents: - sdk-version-advisor: just a lookup, skills already cover SDK install - session-management-reviewer: preserved as references/session-management-patterns.md - scalekit-mcp-helper: 22 lines, MCP server + skills cover this Also removed duplicate setup-scalekit from agentkit (kept in saaskit). Remaining agents: setup-scalekit, scalekit-mcp-auth-troubleshooter.
Per-connector docs (scopes, quirks, tool categories) were present in cursor and codex but missing from claude-code. Copied full set to maintain parity across all auth stacks.
Per-connector docs are unmaintainable — live AgentKit metadata and docs.scalekit.com/agentkit/connectors/ are the source of truth.
…ng-auth-setup skill
Old skill names (add-auth-fastmcp, express-mcp-server, fastapi-fastmcp) were renamed to adding-mcp-oauth during consolidation. Update links to point to the correct SKILL.md and framework-specific reference files.
/mcp/authentication -> /authenticate/mcp/quickstart/
All 18 skills updated with quality improvements: - Removed verbose meta-commentary, added verification commands - Added concrete code examples from scalekit-code-doctor references - Consolidated duplicated content into reference files - Improved descriptions with specific trigger terms New reference files added for scalekit-code-doctor (EXAMPLE-REPOS.md).
… skills - install.sh: make plugin install idempotent (|| true); fix post-install message - agentkit plugin.json: update stale homepage URL to /agentkit/overview/ - scim-provisioning: pip install scalekit-sdk → scalekit-sdk-python - adding-mcp-oauth: Scalekit → ScalekitClient (import + constructor) - connectors/README.md: remove false claim about deleted connector notes - CHANGELOG.md: fix wrong skill names, wrong count, Removed → Aliased - agentkit README: add missing scalekit-code-doctor skill - saaskit README: add missing testing-auth-setup and scalekit-code-doctor skills Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…, dedup - implementing-modular-sso: fix access token expiry 24h → 5min (configurable) - implementing-saaskit-python: add django-reference.md and flask-reference.md - agentkit: remove duplicate scalekit-code-doctor; point README to /saaskit:scalekit-code-doctor - agentkit/saaskit README: fix invalid shell install command (claude /plugin → /plugin inside REPL) - agentkit README: document MCP OAuth 2.1 auth behavior and troubleshooting steps - root README: add Windows install caveat (install.sh requires macOS/Linux/WSL) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Addresses CTO review issue #6 — new users facing 13 overlapping choices with no entry point. Both /agentkit:setup and /saaskit:setup ask 2-3 questions about framework and use case, then route to the right skill. Covers orientation (concepts table), environment setup steps, and cross-skill navigation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- implementing-saaskit-nextjs: scalekit.io → scalekit.com in env URL - docs/frameworks/laravel.md: scalekit.io → scalekit.com - docs/frameworks/nextjs.md: scalekit.io → scalekit.com - implementing-saaskit/laravel-reference.md: scalekit.io → scalekit.com - implementing-modular-sso: validate_token → validate_access_token_and_get_claims (Python) - implementing-access-control SKILL.md: decode_access_token → validate_access_token_and_get_claims - docs/access-control.md: decode_access_token → validate_access_token_and_get_claims - adding-mcp-oauth SKILL.md: validate_token → validate_access_token_and_get_claims (Python middleware) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…lization - Node: Scalekit → ScalekitClient in express-reference and bring-your-own-auth - SCIM: getPrimaryDirectoryByOrganizationId → listDirectories pattern - SCIM webhook: fix try/catch on bool return, use raw body for signature verification - MCP server: use sub-client methods (organization.createOrganization etc.) - auth-flows: getLogoutUrl positional args → options object - sso.md: replace process.env in browser with literal constant - Python: dict options → typed AuthorizationUrlOptions/LogoutUrlOptions classes - Env var: SCALEKIT_ENV_URL → SCALEKIT_ENVIRONMENT_URL - Domain: .scalekit.io → .scalekit.com in .env.example
…uncated agent file - Strip .md suffix from 22 docs.scalekit.com URLs - SCALEKIT_ENV_URL → SCALEKIT_ENVIRONMENT_URL (41 remaining instances) - Fix Python module shadowing: scalekit = scalekit.client.ScalekitClient → sk_client = ScalekitClient - Complete truncated scalekit-mcp-auth-troubleshooter section 8 + add section 9 - Remove 5 [web:NN] citation markers from troubleshooter agent
…rnal imports, Go SDK path
…ct→AuthorizationUrlOptions in flask/django refs
Code reviewFound 3 issues:
claude-code-authstack/scripts/install.sh Lines 27 to 33 in 158a073
claude-code-authstack/plugins/agentkit/.env.example Lines 1 to 3 in 158a073
claude-code-authstack/plugins/agentkit/skills/integrating-agentkit/SKILL.md Lines 286 to 288 in 158a073 🤖 Generated with Claude Code - If this code review was useful, please react with 👍. Otherwise, react with 👎. |
…et_logout_url - get_authorization_url: pass AuthorizationUrlOptions object, not dict - get_logout_url: pass LogoutUrlOptions object, not bare kwargs Both methods use attribute access internally — dicts/kwargs crash at runtime.
…rd arg, code-doctor /v2 + claims row
…t PostHog token exception
The dryrun commands use npx @scalekit-sdk/dryrun — a separate package. Installing @scalekit-inc/cli provides no dryrun capability and was misleading. The npx invocation already handles on-demand download. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
agentkit-only installs had no setup agent — it lived solely in saaskit. Add plugins/agentkit/agents/setup-scalekit.md with agentkit-scoped routing (integrating-agentkit, discovering-connector-tools, exposing-agentkit-via-mcp, production-readiness-agentkit). Trim the cross-plugin "Agent auth" row from the saaskit version and replace with an install nudge, keeping each plugin self-contained. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Simulates Claude Code skill injection: SKILL.md as cached system context, test prompt as user turn, then checks response against string pattern matchers and a judge-model rubric. 6 scenarios across agentkit and saaskit: - agentkit: integrate-agentkit, discover-tools, code-doctor-bad-import - saaskit: implement-saaskit-nodejs, implement-sso, testing-auth-setup testing-auth-setup scenario is a regression test for the @scalekit-inc/cli prereq bug fixed in this PR — forbidden_patterns: ["@scalekit-inc/cli"]. Usage: cd evals && pip install -r requirements.txt && python run.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
discovering-connector-tools: add ACTIVE account check rule before tool execution — tool calls silently fail against unauthorized accounts. integrating-agentkit: surface connection_name as an explicit key concept near the top; previously only appeared in code examples. implementing-saaskit: add SCALEKIT_REDIRECT_URI to the env vars block with a note that it must match the dashboard Allowed Redirect URIs. implementing-modular-sso: add organization_id key concept to the Quick Start section so it appears early in any response, not just in Step 3. All 6 evals now pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add 18 new eval scenarios: - agentkit: expose-via-mcp, production-readiness, setup-routing - saaskit: managing-sessions, access-control, python-fastapi, nextjs, scim-provisioning, mcp-oauth, api-auth, migration, production-readiness - security: no-hardcoded-credentials, no-tokens-in-logs, no-localstorage-tokens - routing: agentkit-code-error, saaskit-sso-from-base, saaskit-scim-from-base Fix skill gaps surfaced by the new evals: - setup/SKILL.md (agentkit, saaskit): add routing directives — skills now tell users which skill to invoke and stop; include orientation notes for SSO/SCIM/MCP; fix .scalekit.dev placeholder URL - production-readiness-saaskit/SKILL.md: expand smoke test to include protected route access and token refresh steps - implement-sso.yaml scenario: fix organization_id → organizationId (JS SDK) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove false positives from scenario checks: - no-hardcoded-credentials: 'hardcode' → 'hardcode the' (avoids firing on 'don't hardcode') - agentkit/production-readiness: remove '.scalekit.dev' forbidden (appears as counter-example) - saaskit/mcp-oauth: 'StreamableHTTP' → 'Streamable' (matches both "Streamable HTTP" and SDK class) - saaskit/migration: remove flaky SCALEKIT_ENVIRONMENT_URL code_pattern Update routing rubrics to match actual routing-skill behavior: - routing/agentkit-code-error, saaskit-scim, saaskit-sso: accept correct routing + brief context, don't require implementation-level detail from a routing skill - Fix YAML colon-in-string issue (items now quoted) - saaskit/production-readiness, scim-provisioning: loosen over-prescriptive rubric wording Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- implement-nextjs, managing-sessions: add explicit context to prompts so Claude doesn't ask clarifying questions when not in a real app dir - agentkit/setup-routing: soften rubric phrasing for routing confirmation - agentkit/expose-via-mcp: move connection_name/SCALEKIT_ENVIRONMENT_URL from code_patterns to rubric (appear only in full code responses); fix streamable_http → streamable to match both transport string forms Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ility - agentkit/production-readiness: remove SCALEKIT_ENVIRONMENT_URL code_pattern (production-readiness skill outputs checklists, not always raw code) - routing/agentkit-code-error: replace negative rubric item with positive assertion the judge can confirm unambiguously - routing/saaskit-scim-from-base: relax Scalekit-specific phrasing in rubric items; response may say "SCIM bridges" instead of "Scalekit bridges" Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restructures the marketplace from 5 separate plugins into 2 focused plugins: AgentKit and SaaSKit.
This PR incorporates the work from #19 (docs/agent-auth-hybrid-layout) and builds the full restructure on top.
Backward Compatibility
Old plugin names are preserved as symlinks so existing install commands keep working:
plugins/agent-authagentkitplugins/full-stack-authsaaskitplugins/mcp-authsaaskitplugins/modular-ssosaaskitplugins/modular-scimsaaskitTested:
claude plugin install agent-auth@scalekit-auth-stackresolves through the symlink and loads AgentKit skills. Claude Code's marketplace uses git clone, which preserves symlinks on disk.The install script (
scripts/install_claude_marketplace.sh) now:Namespace Change
/agentkit:or/saaskit:namespaceAgentKit (5 skills)
Renamed from
agent-auth, adopting Scalekit AgentKit branding withdocs/ + rules/ + thin skills/content model.integrating-agentkitdiscovering-connector-toolsexposing-agentkit-via-mcpproduction-readiness-agentkitscalekit-code-doctorSaaSKit (13 skills)
New plugin consolidating FSA, SSO, SCIM, and MCP server auth into one coherent surface.
implementing-saaskitmanaging-saaskit-sessionsimplementing-access-controlimplementing-saaskit-pythonimplementing-saaskit-nextjsimplementing-modular-ssoimplementing-scim-provisioningadding-mcp-oauthadding-api-authmigrating-to-saaskitproduction-readiness-saaskittesting-auth-setupscalekit-code-doctorContent model
Both plugins follow:
docs/(canonical documentation) +rules/(cross-cutting guidance) + thinskills/(routing layers pointing to docs)Cleanup in this PR
test-tool.mdcommand aliasagent-connectors/*.mdfiles — pointed todocs.scalekit.com/agentkit/connectors/insteadproviders.md→connectors.mdto match product terminologybuilding-agentkit-mcp-server→exposing-agentkit-via-mcp(configuring, not building)discovering-agentkit-tools→discovering-connector-tools(tools belong to connectors)dryruncommand →testing-auth-setupskill (discoverable via natural language)saaskit/hooks/hooks.json—typewas on wrong nesting levelPre-merge Coordination Checklist
1. docs.scalekit.com (developer-docs repo)
Claude Code install templates — update to use new plugin names:
src/components/templates/coding-agents/_agentkit-claude-code.mdx—agent-auth@→agentkit@src/components/templates/coding-agents/_fsa-claude-code.mdx—full-stack-auth@→saaskit@src/components/templates/coding-agents/_mcp-auth-claude-code.mdx—mcp-auth@→saaskit@src/components/templates/coding-agents/_sso-claude-code.mdx—modular-sso@→saaskit@src/components/templates/coding-agents/_scim-claude-code.mdx—modular-scim@→saaskit@GitHub Copilot CLI and Codex templates — same pattern:
_agentkit-github-copilot-cli.mdx/_agentkit-codex.mdx_fsa-github-copilot-cli.mdx/_fsa-codex.mdx_mcp-auth-github-copilot-cli.mdx/_mcp-auth-codex.mdx_sso-github-copilot-cli.mdx/_sso-codex.mdx_scim-github-copilot-cli.mdx/_scim-codex.mdxDocs pages with inline install commands:
src/content/docs/dev-kit/build-with-ai/index.mdx— master plugin install tablesrc/content/docs/cookbooks/set-up-agentkit-with-your-coding-agent.mdxsrc/content/docs/agentkit/quickstart.mdxsrc/content/docs/authenticate/fsa/quickstart.mdxsrc/content/docs/authenticate/mcp/quickstart.mdxsrc/content/docs/authenticate/sso/add-modular-sso.mdxsrc/content/docs/directory/scim/quickstart.mdxsrc/content/docs/home/saaskit/index.mdxsrc/content/docs/sso/quickstart.mdxsrc/content/docs/passwordless/quickstart.mdxsrc/content/docs/passwordless/oidc.mdxsrc/content/docs/agent-auth/start-agent-auth-coding-agents/(referenced in web search)Config files:
src/configs/agent-instructions.tssrc/configs/llms.config.ts2. scalekit.com marketing pages
scalekit.com) — has inline Claude plugin install commands with old names/agent-authproduct page — hasagent-auth@scalekit-auth-stackinstall command/product-updates/add-scalekit-from-your-coding-agent— has old install commands3. scalekit.com blog posts
/blog/outbound-prospecting-agent-development— hasagent-auth@scalekit-auth-stack4. Scalekit dashboard app (app.scalekit.com)
app/scalekit-web-ui/src/pages/Quickstart/snippets.ts— has old plugin install commands5. build-with-ai/skills repo (scalekit-inc/skills)
17 files reference old plugin names:
skills/setup-scalekit/SKILL.mdskills/integrating-agent-auth/SKILL.mdskills/building-agent-mcp-server/SKILL.mdskills/production-readiness-agent-auth/SKILL.mdskills/production-readiness-full-stack-auth/SKILL.mdskills/production-readiness-mcp-auth/SKILL.mdskills/modular-sso/SKILL.mdskills/mcp-auth-expressjs-scalekit/SKILL.mdskills/mcp-auth-fastmcp-scalekit/SKILL.mdskills/mcp-auth-fastapi-fastmcp-scalekit/SKILL.mdskills/mcp-oauth-fastmcp/SKILL.mdskills/adding-mcp-oauth/SKILL.mdskills/express-mcp-server/SKILL.mdskills/fastapi-fastmcp/SKILL.mdskills/README.md6. Third-party listings
These are external and may update automatically, but worth tracking:
7. Install script — Windows compatibility
install.shuses bash (set -euo pipefail,curl,tar,mktemp) — does not work on Windowsinstall.ps1) or cross-platform alternative/plugin marketplace addmethod8. Post-merge verification
claude --plugin-dir(tested locally)/plugin marketplace add scalekit-inc/claude-code-authstack→/plugin install agentkit@scalekit-auth-stack/plugin install saaskit@scalekit-auth-stack/plugin install agent-auth@scalekit-auth-stack(should resolve via symlink)--plugin-dirlocal testing works for both plugins