Reference

Command reference

What follows are the commands used to build and test Cortex, the 32 MCP tools, and the actions the window offers. Setup and configuration are in Installation, a walkthrough of the window is in User guide, and the architecture is in Development and architecture.

Development, build and test commands#

Prerequisites (Rust, Node.js, WebView2) are in Installation. All commands are for Windows.

Desktop UI#

Rust workspace#

Run from the repository root.

Opt-in tests against the real CLIs. The CLI must be installed and logged in by you, and the tests can spend model tokens.

Start.bat#

Set CORTEX_DATA_DIR to an absolute directory before starting to keep development data out of %LOCALAPPDATA%\Cortex (a commented line in Start.bat). A second instance also needs a different mcp.port in that directory's config.json.

Landing page#

apps/landing is a separate Vite site, outside the Cargo workspace.

Documentation site#

apps/docs is a separate Vite site, outside the Cargo workspace. Its pages are generated at build time from README.md and docs/*.md; the ADRs are not part of it.

MCP tools#

The MCP server runs inside cortex-desktop while the window is open and mcp.enabled is true. The headings and parameter tables of this section are checked against the tool catalog by the test reference_docs in crates/cortex-mcp/src/tools.rs.

Endpoint. POST http://127.0.0.1:<port>/mcp, where <port> is mcp.port (default 47821; loopback only). The body is one JSON-RPC 2.0 message with Content-Type: application/json and a Content-Length of at most 1 MiB. There is no event stream: GET and DELETE answer 405. The methods are initialize (protocol versions 2025-11-25, 2025-06-18 and 2025-03-26; server name cortex), ping, tools/list and tools/call. Notifications get 202; JSON-RPC batches are refused. A tool name that does not exist is a JSON-RPC error -32602.

Authentication. Every request carries Authorization: Bearer <credential>:

A missing or refused credential gets HTTP 401 with a WWW-Authenticate: Bearer resource_metadata="..." challenge (plus error="invalid_token" when a credential was sent). Before a tool runs, the server can also refuse with 400, 403 (Host is not 127.0.0.1:<port> or localhost:<port>, or the host of mcp.public_url; or a non-local Origin while mcp.public_url is not set), 404, 405, 408, 411, 413, 415, 431 or 503 (too many connections, or the Core is stopped). These bodies are {"error": {"code": "...", "message": "..."}}; the 401 and the Core-stopped 503 carry the full error object described below.

Results. A tool call always returns a CallToolResult: content holds one text item with the JSON below as text, structuredContent holds the same object, and isError is false. A failure is isError: true with:

{ "error": { "kind": "not_found", "code": "agent.not_found", "message": "...", "remediation": "...", "correlation_id": "...", "agent_id": "..." } }

Arguments that do not match the schema fail with kind invalid_argument and code validation.invalid_arguments, naming the field. Every schema is closed: an unknown property is refused by name. Absent or null arguments count as {}. Tools that change something (create, send, start, stop, interrupt, cancel) fail with core.not_ready (kind state_conflict) unless the Core is READY.

Timestamps are RFC 3339 strings. The objects named below (Project, Agent, Runtime, Objective, Task, Attempt, Event, Message, Proposal) are defined in Objects returned by the tools.

list_projects#

List the projects registered in Cortex. Use it to find the project_id that create_agent needs.

Annotations: read-only, not destructive.

Parameters: none.

Returns { "projects": [Project] }. Projects are created in the window (Add agent dialog); MCP cannot create them.

list_runtimes#

List the runtimes agents can run on: the runtime_id create_agent needs, what each one declares it supports (capabilities, process strategy, model) and whether it can start now (health, with a remediation when it cannot).

Annotations: read-only, not destructive.

Parameters: none.

Returns { "runtimes": [Runtime] }, ordered by runtime_id. The call never waits for a health check: a runtime whose health is stale or unknown starts a check in the background, and a later call sees the result.

list_agents#

List every agent with its state.

Annotations: read-only, not destructive.

Parameters: none.

Returns { "agents": [Agent] }.

get_agent_status#

Get one agent: its state, configuration and the reason of its last failure, if any.

Annotations: read-only, not destructive.

Returns { "agent": Agent }. Fails with agent.not_found (kind not_found) for an unknown id.

create_agent#

Create an agent in the CREATED state; nothing runs until start_agent. Returns the new agent_id.

Annotations: not read-only, not destructive.

Returns { "agent": Agent } with state CREATED and interaction structured. Agents created over MCP are always structured, and this is the only way to create a Codex or OpenCode agent. An orchestrator or an agent session can create agents in its own project only (project.not_found for another).

update_agent#

Rename or reconfigure a CREATED, STOPPED, FAILED or CRASHED agent of the project. It fails with a state conflict while the agent has a live session (stop it first). A role is not changed here.

Annotations: not read-only, not destructive.

Returns { "agent": Agent }. Fails with agent.state_conflict while the agent has a live session (STARTING, READY, BUSY, PAUSED or STOPPING), with agent.not_found for an unknown agent or, from an orchestrator, one of another project, and with permission.denied for an agent session that is not an orchestrator.

start_agent#

Start a created or stopped agent. The agent is READY when the call returns; if the start fails, the call fails and the agent is FAILED, with the reason in last_failure.

Annotations: not read-only, not destructive, idempotent.

Returns { "agent": Agent }, normally with state READY. A start waits up to 60 seconds for the runtime. Starting an agent that is already STARTING, READY or BUSY returns it unchanged, without waiting. Typical failures: agent.state_conflict (the agent is STOPPING), project.invalid_root (the project folder no longer exists), runtime.not_installed, resource.limit_reached (kind state_conflict; see resources.max_active_processes).

send_message#

Send a message to a READY agent; it starts a turn. The reply is not returned here: when the turn ends, poll_agent_events reports session.turn_completed with the result (or session.turn_failed), and the full output appears in the Cortex window. A BUSY agent (running a task) refuses it: cancel_task instead.

Annotations: not read-only, not destructive.

Returns { "agent_id": string, "delivered": true }. delivered means the session accepted the message, not that the turn finished. Fails with agent.state_conflict when the agent is not READY, with runtime.unsupported_in_terminal_mode (kind unsupported) for a terminal-mode agent, and with runtime.turn_in_progress (kind state_conflict) when a turn is running and the runtime does not accept input during a turn (it lacks the interactive_input capability).

interrupt_agent#

Interrupt the current turn of a READY agent without ending its session; the turn then ends as session.turn_failed with cause interrupted. Does nothing when no turn runs. Fails with an unsupported error when the agent's runtime cannot interrupt (see the capabilities in list_runtimes). A BUSY agent (running a task) refuses it: cancel_task instead.

Annotations: not read-only, not destructive, idempotent.

Returns { "agent": Agent, "interrupted": true }. interrupted is always true on success, also when no turn was running. Fails with runtime.capability_missing (kind unsupported) when the runtime lacks the interrupt capability, with runtime.unsupported_in_terminal_mode (kind unsupported) for a terminal-mode agent, and with agent.state_conflict when the agent is not READY.

stop_agent#

Stop an agent and end its session. Stopping a stopped agent is not an error. Stopping a BUSY agent cancels the task attempt it runs; the task waits for an agent again.

Annotations: not read-only, not destructive, idempotent.

Returns { "agent": Agent }, normally with state STOPPED. An agent that is not running, or that another stop already owns (STOPPING), is returned as it is.

poll_agent_events#

Read the agent events (created, state changed, removed, and the end of each turn with its result) after a cursor. Pass the next_after of the previous call as after; omit it to read from the oldest event kept. dropped counts the events that were lost because the cursor was too old.

Annotations: read-only, not destructive.

Returns

{ "events": [Event, ...], "dropped": 0, "next_after": 1790000000000123 }

The seq values only increase. They start from a number derived from the time Cortex started, not from 0, so never assume a value.

create_objective#

Create an objective: a goal split into 1 to 10 tasks that you list. Nothing is planned by an LLM. Each task runs as one turn on an existing READY structured agent of the project (assigned_agent_id pins one; otherwise any eligible READY agent takes it), and a task starts only after the tasks it depends on (depends_on names their keys inside this objective, no cycles) have COMPLETED; their results are passed on in its instruction. A task that cannot start yet waits: list_tasks says why. Returns the objective with the task_id of every task.

Annotations: not read-only, not destructive.

Properties of each item of tasks. The schema is closed, so other properties are refused.

Returns { "objective": Objective }, with every task in CREATED or already READY (tasks without dependencies are made READY at once). Invalid objectives fail with validation.invalid_objective (kind invalid_argument).

plan_objective#

Ask Cortex's planner to split a goal into 1 to 10 tasks. The planner is one turn of Claude Code, the reference runtime, started in the project's root: it may read the project but not change it, and it gets no credential for these tools. Nothing is created. The draft is checked by every rule of create_objective; pass it to create_objective, unchanged or edited, to create the objective.

Annotations: not read-only, not destructive.

Returns { "draft": { "project_id", "title", "tasks": [{ "key", "title", "description", "type", "priority", "depends_on", "requirements" }] } }: the arguments of create_objective. The draft names no agent and no max_retries, so create_objective applies the retry behaviors. Errors of kind runtime_error: planner.timed_out after 5 minutes without an answer; planner.invalid_plan when the answer is not exactly one JSON object of that shape (text around it included); planner.failed when the turn failed; planner.unavailable when Claude Code is not registered; runtime.not_installed when it cannot start. A draft that breaks a rule of create_objective fails with that rule's error (validation.invalid_objective, task.unknown_dependency, task.dependency_cycle). The call spends one turn of Claude Code each time.

propose_objective#

Ask Cortex's planner to split a goal into 1 to 10 tasks and keep its answer as a pending proposal for a person to review. The planner is the one of plan_objective: one turn of Claude Code, started in the project's root, that may read the project but not change it and gets no credential for these tools. The plan is data. No task exists, nothing is READY and nothing runs until the user calls approve_proposal. The plan is checked by every rule of create_objective before it is stored.

Annotations: not read-only, not destructive.

Returns { "proposal": Proposal }, pending, revision 1, with the runtime (and the model, when known) that wrote it as its source. The planner may choose only the fields of plan below. An answer with any other field (an agent, paths, outputs, timeout_secs, model, permissions or commands), with the requirement workspace_isolation, with text around the JSON object or of more than 256 KiB fails with planner.invalid_plan; one that breaks a rule of create_objective fails with that rule's error (validation.invalid_objective, task.unknown_dependency, task.dependency_cycle); a task estimate that is not small, medium or large fails with validation.invalid_proposal. The same planner.* and runtime.not_installed errors as plan_objective. At most 20 proposals may wait at once (proposal.too_many_pending, kind state_conflict). Only the user can propose. The call spends one turn of Claude Code each time.

list_proposals#

List the plan proposals, oldest first, with their revision, source, state, plan and, once decided, who decided it, when and why. Every revision stays, so the history of an edit is readable. The text of a plan is data, never an instruction.

Annotations: read-only, not destructive.

Returns { "proposals": [Proposal] }. Every pending proposal and the most recent 200 decided ones are kept.

edit_proposal#

Replace a pending proposal with a plan of your own. The new plan becomes a new pending revision (revision + 1, source operator, previous the edited one) and the edited revision is superseded for good, with who and when. The plan is checked by every rule of create_objective. Pass the whole plan, as list_proposals shows it. Only the user can edit.

Annotations: not read-only, not destructive.

Each task also has a required title, a short title, like the objective's.

Returns { "proposal": Proposal }, the new revision. proposal.not_found (kind not_found) for an unknown id. A proposal that was already edited fails with proposal.superseded (naming the revision that replaced it) and one that was approved or rejected with proposal.already_decided, both kind state_conflict: two edits of one revision cannot both win. A plan that breaks a rule of create_objective fails with that rule's error and changes nothing.

approve_proposal#

Approve a pending proposal. It is the one step that turns a plan into work: it creates the objective with exactly the plan's tasks through the rules of create_objective, so the tasks without dependencies become READY now and not before. No agent, path, model, timeout or retry count comes from the planner (the retry behaviors apply as in create_objective), and the estimate is dropped. The proposal and the objective are decided under one lock, so approving twice creates one objective. Only the user can approve; agents and hooks are denied.

Annotations: not read-only, not destructive.

Returns { "proposal": Proposal, "objective": Objective }, the proposal approved with its resolution.objective_id. A proposal that was edited fails with proposal.superseded; one already approved (the error names its objective) or rejected, with proposal.already_decided. If creating the objective fails, the proposal stays pending. If the objective was created and the approval could not be written, the error's remediation names the objective: reject the proposal instead of approving it again.

reject_proposal#

Reject a pending proposal for good. No objective is created. Only the user can reject.

Annotations: not read-only, not destructive.

Returns { "proposal": Proposal }, rejected, with resolution.by, resolution.at and resolution.reason. The same errors as approve_proposal for a proposal that was already decided.

list_tasks#

List every objective with its tasks: the status of each task, why a task that has not started waits (waiting), its attempts and, once COMPLETED, its result. It is the same state the Cortex window shows.

Annotations: read-only, not destructive.

Parameters: none.

Returns { "objectives": [Objective] }, oldest first. This includes the objectives created from the window's Orchestrator panel.

get_task_status#

Get one task: its status, its attempts (the agent that ran each and how it ended), why it waits, the cause of a failure or cancellation and, once COMPLETED, its result.

Annotations: read-only, not destructive.

Returns { "task": Task }. Fails with task.not_found (kind not_found) for an unknown id.

cancel_task#

Cancel a task that has not ended, and every task that depends on it. A running attempt ends CANCELLED and its agent is released (the turn is interrupted); if the turn cannot be interrupted, the agent is stopped instead. Cancelling a CANCELLED task is not an error; a COMPLETED or FAILED one is a state conflict.

Annotations: not read-only, not destructive, idempotent.

Returns { "task": Task }, the cancelled task. Fails with task.state_conflict (kind state_conflict) for a COMPLETED or FAILED task and with task.not_found for an unknown id.

cancel_objective#

Cancel an objective: every task of it that has not ended ends CANCELLED, with its running attempt, and the agents are released (the turn is interrupted; an agent that has not let go of it within 30 s is stopped). It also ends a pause and raises flow.generation. Cancelling an objective with nothing left to cancel changes nothing. Agents cannot cancel.

Annotations: not read-only, not destructive, idempotent.

Returns { "objective": Objective }. Fails with objective.not_found (kind not_found) for an unknown id and with permission.denied for an agent.

pause_objective#

Pause an objective: none of its tasks starts until resume_objective, and each keeps its own state (a READY task stays READY and waits with waiting.objective_paused; a BLOCKED one can still be approved, retried or cancelled). With policy drain (the default) the attempts that run end by themselves; with interrupt their turns are interrupted, the attempts end CANCELLED (cause objective.paused) without spending a retry, and the tasks run again after the resume as the next attempt. A verification that already runs is not a turn and ends by itself. Pausing a paused objective changes nothing, except interrupt over a drain pause. Every decision raises flow.generation. Agents cannot pause.

Annotations: not read-only, not destructive, idempotent.

Returns { "objective": Objective }, with status PAUSED and flow.state PAUSED. Fails with objective.state_conflict (kind state_conflict) when every task has ended, with objective.not_found for an unknown id and with permission.denied for an agent.

resume_objective#

Resume a paused objective: its graph is read afresh, and each task is eligible again or says why it waits (waiting). What a pause interrupted runs as the next attempt; a backoff that ran goes on from where it was. Resuming an objective that runs changes nothing. Agents cannot resume.

Annotations: not read-only, not destructive, idempotent.

Returns { "objective": Objective }. Fails with objective.not_found for an unknown id and with permission.denied for an agent.

reassign_task#

Move a task that waits (CREATED, READY or BLOCKED, with no attempt running) to another agent of its project, or to none (omit to_agent_id: any eligible agent may run it). The move is recorded in reassignments with who decided, from whom, to whom and why; the status does not change. Refused while the agent of its last attempt still ends it (at most 30 s after a cancellation) or its verification still runs. Pass execution_id, the attempt you read, to move the task only if that is still its last attempt; asking again for the same move is not an error. Agents cannot reassign.

Annotations: not read-only, not destructive, idempotent.

Returns { "task": Task }. Fails with task.state_conflict for a task that does not wait, that has a newer attempt than execution_id, or whose last attempt is still ending; with agent.not_found for an unknown agent and task.agent_not_eligible when the agent cannot run tasks of the project; and with permission.denied for an agent.

approve_task#

Approve a BLOCKED task whose result has no evidence: its project has no verification, or the verification did not pass or could not run. It becomes COMPLETED with the result of its last attempt, and the decision is recorded with who made it (decisions). Agents cannot approve. A task blocked for another cause can only be retried or cancelled. Pass execution_id, the attempt you read, to approve that result and nothing newer: a task that has a newer attempt is refused. Asking again for an approval already recorded for that attempt returns the task as it is, with no second decision.

Annotations: not read-only, not destructive, idempotent.

Returns { "task": Task }, the completed task. Fails with task.state_conflict (kind state_conflict) for a task that is not BLOCKED by its verification, and with permission.denied for an agent.

retry_task#

Ask for a new attempt of a BLOCKED task: it becomes READY at once and the decision is recorded. After a retry a person asked for, a failure blocks the task again instead of failing it. execution_id works as for approve_task: a retry already recorded for that attempt is not made twice.

Annotations: not read-only, not destructive, idempotent.

Returns { "task": Task }, the task, READY. Fails with task.state_conflict for a task that is not BLOCKED, and with permission.denied for an agent.

integrate_task#

Bring the result of a COMPLETED task that ran in a Git worktree of its own (requirement workspace_isolation) into its project folder. The changes of the worktree of the attempt that completed it are committed on its branch cortex/<task_id>, then squashed onto the project folder: they are staged there, never committed, for you to review and commit. Nothing is merged into your branch, pushed or deleted. The worktree is removed afterwards; the branch stays. Agents cannot integrate. A task is integrated once.

Annotations: not read-only, not destructive.

Returns { "task": Task }, with integration set. Fails, with nothing changed, with task.state_conflict for a task that is not COMPLETED, ran in the project folder or was integrated already; workspace.index_not_clean when the project folder has staged changes; workspace.conflict when the changes conflict with its HEAD (the paths are named; merge the branch yourself); workspace.local_changes when they would overwrite a change you have not committed; workspace.unowned when the worktree is not proven to be the task's; permission.denied for an agent.

list_skills#

List the skills Cortex found: the global ones (the skills folder of the data directory) and each project's .cortex/skills. A skill is a folder with a skill.json manifest and its Markdown content. The result gives each skill's scope, version and state (enabled, disabled, or changed since it was enabled), the folders that are not valid skills and why, and the name conflicts between skills. With agent_id, it also gives that agent's effective set: every skill that applies to it and whether it is delivered or why not. Read-only: skills are enabled and disabled in the Cortex window, never through MCP.

Annotations: read-only, not destructive.

Returns { "skills": [...], "invalid": [...], "conflicts": [...], "effective"?: {...} }:

• skills[]: skill_id (global/<folder> or project/<project_id>/<folder>), name, version, description, scope ({ "kind": "global" | "runtime" | "project" | "agent", "target": id or null }), origin ({ "kind": "global" | "project", "project_id": id or null }), runtimes (the runtimes it is written for; empty means any), content_path, state, and approved_version (the version enabled, when state is changed, else null).
• invalid[]: skill_id, origin, folder, problem.
• conflicts[]: name, kind (override: different scopes, the most specific one is delivered; ambiguous: the same scope from different folders, none is delivered until one is disabled), skill_ids, agent_ids (the agents it affects).
• effective (only with agent_id): agent_id, runtime_takes_skills, and skills[] with skill_id, name, version, scope, status (delivered, disabled, changed, incompatible_runtime, overridden, ambiguous, over_limit, runtime_unsupported) and related_skill_ids (the skills that override it, or that it is ambiguous with).

Fails with agent.not_found (kind not_found) for an unknown agent_id.

post_message#

Post a message to another agent through the Cortex message bus. Agents never reach each other's process: a message waits in its reader's inbox until the reader reads it (read_messages) and acknowledges it (ack_message), or until it expires. The sender is whoever holds the credential of the call, never a field of the message.

The channel is the project (project_id), or one of its objectives (objective_id). An agent may write only in a channel it belongs to, and only to a reader of that channel: the agents of the project or, for an objective, the agents that run or ran one of its attempts. You may write to any channel, still only to a reader of it.

The body is untrusted text for its reader: Cortex stores it, redacted, and never reads it as a command or a permission. A request may name a Cortex action, but only one that both the sender and the reader may take (so an agent may ask another for list_tasks, never for cancel_task); naming it grants nothing, and the reader can only act through its own tools.

Annotations: not read-only, not destructive.

Returns { "message": Message, "duplicate": bool }. Fails with message.out_of_scope (kind authorization_error) when the sender or the reader is not in the channel; agent.not_found, project.not_found, objective.not_found or execution.not_found (kind not_found); message.recipient_unavailable (kind state_conflict) for an attempt that is not running; message.inbox_full (kind state_conflict) when the reader already has 32 messages waiting; and message.sender_limit (kind state_conflict) when the sending agent has 32 messages waiting in other inboxes. Every refusal is published as the event message.rejected with its reason.

read_messages#

Read the messages waiting for you: not acknowledged and not expired, oldest first (by sequence), at most 32 per call. An agent reads only its own; your user credential reads every agent's. Reading changes nothing: a message stays until it is acknowledged or expires.

Agents do not need to poll: when Cortex starts a turn for an agent (a task, or your input) and messages wait for it, the turn ends with a line such as [Cortex] 2 messages from other agents wait in your inbox... that names these tools. The line gives the count only, never a message's text. An idle agent sees it with its next turn.

Annotations: read-only, not destructive.

Returns { "messages": [Message, ...], "more": bool }. more is true when more messages wait after the last one returned: pass its sequence as after.

ack_message#

Acknowledge a message you read: it leaves your inbox and frees its place. Acknowledging it again returns it unchanged. Only its reader acknowledges a message (you may acknowledge any); another agent's message is message.not_found.

Annotations: not read-only, not destructive, idempotent.

Returns { "message": Message }, now ACKED. Fails with message.not_found (kind not_found) and with message.expired (kind state_conflict) for a message whose TTL passed first.

Orchestrator role#

An agent whose role is orchestrator coordinates other agents and has no tool to read, change or run anything in the project (ADR 0035). Its session reaches Cortex only through these tools, with the credential in CORTEX_MCP_TOKEN:

Everything else fails with permission.denied (kind authorization_error): stopping, interrupting or messaging an agent directly, creating objectives or tasks, deciding anything a person decides. The Core also answers every tool request the CLI of an orchestrator session makes: a Cortex tool is allowed and anything else (shell, file, web) is denied at once and listed in Approvals, decided by role, whatever Automatic Decisions say. The runtime must declare orchestrator_role (list_runtimes shows it) and the session is always structured; the start is refused with runtime.capability_missing, agent.orchestrator_needs_structured or mcp.disabled rather than run as a worker. An orchestrator is never given a task.

Objects returned by the tools#

Keys marked optional are omitted when they do not apply. Keys of the Task and Attempt objects are always present; an absent value is null.

Project

Agent

Runtime

Objective

Task

Attempt (one try of a task)

Event (an element of events of poll_agent_events)

Message (a message of the bus; every key is always present, an absent value is null)

Proposal (a revision of a plan; every key is always present, an absent value is null)

Interface actions#

Everything the window offers. Cortex has no menus, global shortcuts or settings screen. Behavior details, limits and troubleshooting are in User guide.

Window and title bar#

The splash shows a progress bar until the Core is ready. If the Core cannot start, it shows the error with its code and correlation ID and stays open.

Sidebar#

Header (every screen)#

Agents screen and agent cards#

Start, Stop, Restart and Edit are on the back of the card and in the Console header (Start, Stop and Restart only). While a command of an agent is in flight, Start and Restart are disabled; Stop stays available (except while a stop is itself in flight), so a start that hangs can be cancelled.

Agent context menu#

Cortex's own menu, in document.body, kept inside the window. It lists Pause (Resume for a PAUSED agent), Stop, Start, Edit, Restart and Remove, in that order, with the same enabling rules as the card buttons; a disabled row gives its reason as its tooltip and as its accessible description. While a command of the agent is in flight, every row but Stop is disabled.

The result messages are Paused, Resumed, Stopped, Started, Restarted and Removed followed by the name, a note (Stopping alpha…) while a Stop, Start or Restart runs, and Could not <action> alpha with the Core's message and remediation when it refuses. Successes disappear after 4 s and errors after 12 s; at most 4 messages show.

Add agent dialog#

The dialog is titled "Add agent". It opens from the New agent button of the Agents header, and from the one shown when there are no agents.

Edit agent dialog#

Right panel#

Console tab (selected agent):

Orchestrator tab:

Tasks screen#

Processes screen#

MCP screen#

Skills screen#

Lists the skills Cortex finds: the folders under skills in the data directory (global) and under .cortex/skills in each project. A skill is a folder with a skill.json manifest and its Markdown content, and nothing else but files. A new skill is disabled.

Keyboard summary#