The development server ships as an Agent Plugin

Two manifests at the package root

plugin.json identifies the plugin against the canonical 1.0.0 schema. mcp.json declares how to launch it. Both are published in the package files list, so they are present in the installed package rather than only in the source repository.

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "smrt-dev-mcp",
  "description": "Development MCP server and SMRT code-review skill."
}

The declared server is local and plugin-relative

mcp.json declares one stdio server whose command stays inside the resolved plugin root. The executable path must remain contained after resolution.

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
  "mcpServers": {
    "smrt-dev-mcp": {
      "type": "stdio",
      "command": "./dist/index.js"
    }
  }
}

Skills are found by location, not by declaration

plugin.json carries no skills field. Bundled skills live under the fixed skills directory for Agent Plugins discovery. The package ships skills/smrt-code-review/SKILL.md and its referenced output guide. Each skill is plain Markdown with YAML frontmatter naming and describing it. A skill-unaware harness can ignore the frontmatter and read the body.

• Skill-aware clients discover the file directly from the installed package root.
• Other MCP clients can reach the same content through the get-agent-skill tool.
• It is also published as a prompt and as a resource for native MCP clients.

Schemas are pinned for offline validation

The package ships byte-for-byte snapshots of the 1.0.0 plugin and mcp schemas under a versioned schemas directory, with their recorded digests. Clients validate against those local copies; loading a plugin must not fetch a schema over the network.

• The manifests stay pinned to the canonical 1.0.0 schema identifiers.
• Agent Plugins 1.0.0 is a Working Draft, and this package targets only that revision.

Credentials stay with the client

Portable configuration contains no credentials, secrets, authorization headers, or OAuth settings. The client provides the reserved plugin root and persistent plugin data directories; the package neither sets nor overrides them. Clients own authorization interaction and credential storage.

• Do not add secret-bearing environment variables or headers to portable configuration.
• The plugin declares no HTTP transport; only the local stdio server is shipped.

How this relates to direct MCP configuration

Packaging is a distribution convenience, not a different server. Manifest-based and manually configured clients launch the same stdio binary. Both clients receive the same tools, prompts, and resources. Use direct configuration when your client does not support Agent Plugins or needs an absolute launcher path.