Leanmcp/gateway-skills

---

name: claude-code-dev

description: How to develop, modify, and extend the Claude Code codebase following its established programming style, patterns, and conventions. Use this skill whenever working on the claude-code source — adding tools, commands, utils, components, types, hooks, services, or fixing bugs. Also use when the user asks about claude-code architecture, coding standards, file organization, or wants to understand how the codebase works. This skill ensures all contributions match the existing codebase style exactly.

---

name: analyze-exports

description: Analyze tau2-bench task export files to identify exactly where and why tasks failed. Map failures to specific conversation rounds, show root causes, check whether relevant documentation was available, and cite sources. Use this skill whenever you need to debug a tau2-bench evaluation, understand why an agent made wrong decisions, identify missing knowledge, or review task performance—especially when context length, eligibility criteria, or policy compliance might be at fault.

---

name: code-explanation

description: Generate a complete, beginner-friendly explanation of an entire code repository as a set of markdown files. Maps the repo structure with `treecap` (installing it if missing), studies the actual source, then writes a `CODE_EXPLANATION/` folder containing an `OVERVIEW.md` plus numbered deep-dive files (01_architecture.md, 02_models.md, ...) that explain how the code is built, what it does, and how the pieces fit together — illustrated with real code excerpts. Use this skill whenever the user wants to understand, document, onboard onto, or get a walkthrough of a codebase: phrases like "explain this repo", "explain the code", "code explanation", "walk me through this codebase", "help me understand how this is built", "document the architecture", or "what does this project do" — even if they don't say the word "skill". Prefer this over ad-hoc summaries whenever the goal is a durable, written explanation of a whole repo.

---

name: fireworks-inference

description: Run inference on Fireworks AI — direct, through the Leanmcp AI Gateway proxy (aigateway.leanmcp.com) for observability, or via LiteLLM / the OpenAI SDK / raw HTTP. Covers the endpoint-and-key matrix for each route, serverless vs dedicated deployments and their cold starts, browsing and filtering the model catalogue, reasoning models that return content:null with the answer in reasoning_content, function calling, concurrency and load testing, and runner scripts where many models share one protocol with a --use-proxy toggle. Use this skill whenever the user mentions Fireworks, FIREWORKS_API_KEY, api.fireworks.ai, fireworks_ai/ model ids, accounts/fireworks/models/..., a Fireworks deployment id, the Leanmcp gateway or LEANMCP_API_KEY, app.leanmcp.com observability, or gpt-oss / kimi / glm / qwen / deepseek served on Fireworks; wants to route LLM calls through a proxy for logging or cost tracking; is debugging empty responses, 404s, scope errors, cold starts, or "the gateway isn't working"; wants to pick a Fireworks model with tool calling; or wants to sweep several models over one benchmark. Reach for it even on vague asks like "why is this model returning nothing" or "set up inference for these models" when Fireworks is in play.

---

name: godot-city-game-3d

description: Build, run, debug and ship 3D city games in Godot 4 — procedurally generated cities (block grids, districts, weighted building typologies, MultiMesh batching, facade shaders, terrain, day/night, landmarks), first-person controllers, headless verification, Blender-generated .glb assets, rigged character and animation packs, real OpenStreetMap-derived cities, WebAssembly export, and cloud GPU streaming on GCP. Use this skill whenever the work involves Godot or a .gd/.tscn/.gdshader/project.godot file; whenever someone wants to start, set up, clone onto a new machine, or stand up a 3D game or city generator; whenever they mention procedural city, city generator, block grid, building typology, MultiMesh, facade shader, terrain heightmap, navmesh, Godot export templates, export presets, headless Godot, .glb pipeline, Blender asset generation, character rigs or borrowed animations; and whenever they want to deploy or share a game — web export, SharedArrayBuffer/COOP/COEP, Selkies, pixel streaming, GPU VM, or "let people play this without installing anything." Reach for it even on vague asks like "get this running", "why is my city slow", "my model faces backwards", "make it work on a cloud machine", or "set this up somewhere else too" when a Godot 3D project is in play.

---

name: ios-bootstrap-testflight

description: Scaffold a native iOS app (SwiftUI, no dependencies) from nothing, run it in the Simulator, and archive + upload it to TestFlight entirely from the command line. Bundles working scripts for icon generation, simulator run, and signed upload via the App Store Connect API. Use this whenever the user wants to build, run, ship, or debug an iOS/iPhone/iPad app, mentions Xcode, SwiftUI, .xcodeproj, xcodebuild, simctl, provisioning, code signing, App Store Connect, TestFlight, archiving, or "get this on my phone" — and also when an existing iOS build is failing on icons, signing, teams, destinations, or duplicate build numbers.

---

name: leanmcp-builder

description: Build MCP servers using the Leanmcp SDK with decorator-based TypeScript. Use this skill when users ask for "leanmcp", "MCP with decorators", "MCP with authentication", "MCP with elicitation", "MCP with environment injection", or want a simpler, more elegant way to build MCP servers. Leanmcp provides automatic schema generation, dependency injection, authentication, and user input collection.

---

name: mcp-apps-builder

description: Build MCP Apps with interactive React UIs using the Leanmcp UI SDK. Use this skill when users ask for "MCP with UI", "MCP App", "interactive MCP", "leanmcp UI", "MCP dashboard", or want to create rich visual interfaces for their MCP tools. This skill covers @UIApp decorator, React components with useTool/useResource hooks, ToolDataGrid, ToolForm, ToolButton, and ChatGPT Apps support.

---

name: mcp-builder

description: Build MCP (Model Context Protocol) servers using the official @modelcontextprotocol/sdk. Use this skill when users ask to create an MCP server, MCP tools, MCP resources, or want to expose APIs/functionality to AI agents. This skill covers vanilla MCP implementation with Streamable HTTP transport, session management, tools, resources, and prompts.

---

name: posthog-adblock-bypass

description: Configure a Next.js app using posthog-js so session recording and dead-click capture survive browser ad blockers. Aliases the three blocker-flagged JS chunks (dead-clicks-autocapture.js, recorder.js, posthog-recorder.js) to bland same-origin paths via Next.js rewrites, and monkey-patches HTMLScriptElement so posthog-js requests the aliases. TRIGGER when posthog-js session replay or dead-click capture is failing in production with ERR_BLOCKED_BY_CLIENT or 404s on /static/dead-clicks-autocapture.js / /static/recorder.js / /static/posthog-recorder.js, or when the user wants to bypass ad blockers for these specific assets. Works alongside an existing PostHog reverse proxy (managed or otherwise) — only the three blocked files divert through Next.js, all other PostHog traffic stays on the original api_host. SKIP for unrelated PostHog setup, non-Next.js apps, or when capture/decide endpoints (/e/, /decide/, /array/*/config.js) are the ones being blocked — those need a different treatment.

---

name: publicity-distribution

description: Write and distribute launch and publicity content across LinkedIn, X/Twitter, Instagram, Discord, Medium, Substack, and YouTube. Produces per-platform copy that does not read as AI-written (no em dashes, no "thrilled to announce", no engagement-bait), plus the exact image/video specs and character limits each platform wants. Use this skill whenever the user wants to announce, launch, publicize, promote, cross-post, or share anything - a product, a feature, an open-source release, a research paper, a blog post, a demo video, a milestone, a job opening, or a conference talk. Trigger it on phrases like "post this on LinkedIn", "write a launch tweet", "announce this", "share this in Discord", "turn this into a thread", "what should I post", "write a Medium article about", "help me with distribution", "draft a YouTube description", "make this sound less like AI", or "de-slop this post". Also use it when the user has just finished shipping something and asks how to get it in front of people.

---

name: research-observability

---

name: research-paper-integrity

description: Standards and audits for writing academic papers, especially ML/NLP submissions to NeurIPS, ICML, ICLR, ACL, EMNLP, NAACL. Covers the author's house prose rules (zero em dashes, zero fluff, every sentence earns its place), verification of hallucinated claims and hallucinated or malformed bibliography entries, the ACL policy on AI writing assistance and what must be disclosed, and best practices for paper structure, experiments, reproducibility checklists, and rebuttals. Use this skill whenever the user is drafting, editing, polishing, restructuring, or reviewing a paper, abstract, intro, related work, rebuttal, or camera-ready; whenever they ask to "clean up" or "tighten" academic writing; whenever citations or a .bib file need checking; and whenever they ask what has to be disclosed about AI assistance. Reach for it even when the user only says "make this section better", "check my references", or "is this ready to submit".

---

name: security-repro

description: Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.

---

name: tinker-training-inference

description: Train and run models on Tinker (Thinking Machines) — LoRA and full fine-tuning, SFT with correct loss masking, RL/RFT with group-relative advantages and importance sampling, agentic RL over multi-turn tool-using agents, inference via the SamplingClient or the OpenAI-compatible endpoint, checkpoint management and export, every hyperparameter, and cost estimation from the live price table. Use this skill whenever the user mentions Tinker, tinker://, TINKER_API_KEY, console.tinker.ai, or the tinker CLI; wants to fine-tune, SFT, RFT, or RL a model on Tinker; asks about Tinker models, context windows, LoRA rank, sampling params, loss functions (cross_entropy, importance_sampling, ppo, cispo, dro), Datum construction, forward_backward or optim_step; wants to sample from, download, resume, merge, or export a Tinker checkpoint; or asks what a Tinker run will cost. Whenever Tinker work is initialized in a project, this skill also creates a TINKER_PRICING.md there so prices sit next to the training code. Reach for it even on vague asks like "train a model on this data" or "get inference working" when Tinker is the platform in play.

---

name: translate-explanation

description: Translate existing code-explanation docs into another language, Chinese by default. Translates a whole `CODE_EXPLANATION/` folder into a parallel `CODE_EXPLANATION_<LANG>` copy (e.g. `CODE_EXPLANATION_ZH`), or a single file — either bilingually in place (English + translation interleaved) for small files or as a `<name>_<lang>.<ext>` sidecar copy for larger ones. Keeps filenames, code, identifiers, file paths, and technical terms in English — only the explanatory prose is translated. Use this skill whenever the user wants to translate, localize, or produce a non-English version of code-explanation / codebase documentation: phrases like "translate-explanation", "translate the code explanation", "translate the CODE_EXPLANATION folder", "localize these docs to Chinese", "make a Chinese version of the explanation", or naming any target language for the explanation files. Default to Chinese (ZH) when no language is specified.

---

name: vuln-repro

description: End-to-end methodology for reproducing AND patching publicly disclosed, already-fixed vulnerabilities: sourcing the advisory and the fix commit, reading the patch diff, rebuilding a pinned offline lab, building a vulnerable-vs-patched contrast harness with proper controls, minimizing the trigger, designing and validating the fix, and writing it up as a blog post or whitepaper. Use this skill whenever the user wants to reproduce, demonstrate, understand, teach, or write about a known vulnerability or security incident: "reproduce this CVE", "build a repro for", "how did EchoLeak / Log4Shell / the postmark-mcp package actually work", "show me how this exploit worked", "write a blog post about this vulnerability", "set up a lab for CVE-XXXX", "pull the NVD/CVE/OSV details", or "make a PoC I can publish". Use it just as eagerly for the patching half: "how should this be fixed", "is this patch correct", "what would have caught this", "review this security fix", "write a regression test for this CVE", "how do I backport this", or "what's the right fix for this bug class" - even when the user never says the word "reproduce". Reach for it on vague asks like "help me understand this security advisory", "I want to write about this incident", or "can we test whether we were vulnerable" when a disclosed vulnerability is in play. This skill only handles ALREADY-PATCHED, publicly disclosed issues and refuses zero-day discovery, live targets, and weaponization.