Skip to content
Back to skills

Learnings

ASecurity

The Pencil MCP server (Go binary inside `highagency.pencildev` IDE extension) couldn't be bundled in plugin.json. The previous solution (see `2026-02-14-pencil-mcp-local-binary-constraint.md`) was "degrade gracefully and link to docs." But users still had to manually install, locate the binary, and register it — with registration going stale on every extension update.

  • 16 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 27, 2026
data-aigoshellbash

Works with

  • cli
  • mcp

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned May 27, 2026

npx -y skills add jikig-ai/soleur --skill learnings --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Learnings?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Learnings
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/jikig-ai-learnings/badge)](https://www.skillsdirectory.com/skills/jikig-ai-learnings)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
title: Automating Pencil MCP Registration via Skill
date: 2026-02-27
category: infrastructure
tags: [integration-issues, pencil-setup, mcp-registration, claude mcp add fails on duplicate, stale mcp binary path after extension update]
---

# Learning: Automating Pencil MCP Registration via Skill

## Problem

The Pencil MCP server (Go binary inside `highagency.pencildev` IDE extension) couldn't be bundled in plugin.json. The previous solution (see `2026-02-14-pencil-mcp-local-binary-constraint.md`) was "degrade gracefully and link to docs." But users still had to manually install, locate the binary, and register it — with registration going stale on every extension update.

## Solution

Created a `pencil-setup` skill with inline bash that handles the full lifecycle:

1. **`claude mcp add` is NOT idempotent** — exits 1 on duplicate name. Always `remove` then `add`.
2. **Use `-s user` scope** — default is `local` (project-level). Global scope ensures Pencil works across all projects.
3. **Glob for binary, not hardcoded paths** — `ls -d ${EXTDIR}/highagency.pencildev-*/out/mcp-server-* | sort -V | tail -1` handles version drift, multiple coexisting versions, and platform detection in one command.
4. **`--app <ide>` is always required** — the binary won't start without it. HTTP mode (`-http -http-port`) also requires `--app`.
5. **`command -v` over `which`** — POSIX-portable alternative found during review.

## Key Insight

When a CLI tool (`claude mcp add`) isn't idempotent, the remove-then-add pattern makes fresh installs, version updates, and re-registration all follow the same code path — no separate drift detection needed. This is the simplest approach when the remove operation is itself idempotent (which it is: `claude mcp remove` succeeds silently if nothing to remove).

## Session Errors

1. **Edit before Read** — Edit tool rejected modification of `bug_report.yml` without prior Read. Always read first.
2. **marketplace.json version drift** — Was at 3.5.0 (not 3.5.1) due to parallel branch. Always fetch main before bumping.
3. **Plan overengineered** — First pass had a 7-function shell script, version drift detection, snap paths, and HTTP docs. Reviewers correctly cut it to inline SKILL.md only. Skills that are ~5 sequential commands don't need script abstractions.
4. **Review false positive** — Agent flagged non-existent `docs/_data/skills.js`. Validate review findings before acting.
5. **README table count missed** — Bumped plugin.json description (52→53) but missed README markdown table. The versioning checklist should include "README component count tables" explicitly.

## Tags

category: integration-issues
module: pencil-setup, mcp-registration
symptoms: claude mcp add fails on duplicate, stale MCP binary path after extension update

Files in this skill

  • 2026-02-06-docs-consolidation-migration.md2.4 KB
  • 2026-02-06-parallel-plan-review-catches-overengineering.md4.4 KB
  • 2026-02-06-spec-workflow-implementation.md3.4 KB
  • 2026-02-09-parallel-subagent-fan-out-in-work-command.md2.3 KB
  • 2026-02-09-plugin-staleness-audit-patterns.md2 KB
  • 2026-02-09-worktree-cleanup-gap-after-merge.md2.8 KB
  • 2026-02-10-api-key-leaked-in-git-history-cleanup.md3.6 KB
  • 2026-02-10-parallel-feature-version-conflicts-and-flag-lifecycle.md1.9 KB
  • 2026-02-12-brand-guide-contract-and-inline-validation.md2.5 KB
  • 2026-02-12-command-vs-skill-selection-criteria.md2.1 KB
  • 2026-02-12-plugin-loader-agent-vs-skill-recursion.md2.2 KB
  • 2026-02-12-review-compound-before-commit-workflow.md2.4 KB
  • 2026-02-12-ship-integration-pattern-for-post-merge-steps.md1.5 KB
  • 2026-02-13-agent-prompt-sharp-edges-only.md1.8 KB
  • 2026-02-13-base-href-breaks-local-dev-server.md1.8 KB
  • 2026-02-13-brainstorm-domain-routing-pattern.md2.3 KB
  • 2026-02-13-parallel-subagent-css-class-mismatch.md1.8 KB
  • 2026-02-13-static-docs-site-from-brand-guide.md2.2 KB
  • 2026-02-13-terraform-best-practices-research.md28.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.