Skills, tools, and plugins

Extend what Oktapod can do with skills, plugins, and MCP servers, and review them before you trust them.

Oktapod comes with built-in actions for your connected apps, memory, schedules, coding, and more. You can add to them in three ways. Each addition still goes through Oktapod's approval rules; none of them can grant itself permission.

Prefer a built-in connection when one exists. It has known behavior, a full record, and consistent approvals.

To see everything Oktapod can call right now, open Settings → Advanced → Tools. It shows where each tool comes from, whether it is available, whether it changes things, and whether it needs approval.

#Skills

Browse and install from a terminal:

oktapod skills list --verbose
oktapod skills catalog
oktapod skills install <catalog_id> --reason "Reviewed"
oktapod skills validate
oktapod skills provenance --verbose

A skill that runs a program starts out untrusted. Review its source and what it asks for, then choose a trust level:

oktapod skills trust <skill_id> --tier cautious --reason "Read the source"
oktapod skills untrust <skill_id> --reason "No longer needed"

Skills that run programs need a real sandbox on the machine: Docker, bubblewrap, or macOS sandbox-exec. oktapod skills backends shows what is available. Inside the sandbox, network is off unless allowed, only the workspace is mounted, and credentials, SSH keys, keychains, and secret environment variables are kept out.

A sandbox limits damage; it is not a guarantee. A skill allowed to write to a workspace can still damage files in it. Keep backups and give the least trust that works.

#MCP servers

Connect an MCP server by URL or by a local command:

oktapod connector add https://mcp.example.com
oktapod connector add local-tool --stdio --command /absolute/path/to/tool
oktapod connector auth <connector_id>
oktapod connector verify <connector_id> --tool <tool_name>

Remote MCP connections support Streamable HTTP, including session headers and JSON or streamed responses. Kiwi flight search is built in under Connections, so it does not require adding a custom MCP server.

Restart Oktapod after adding one so it is picked up. A tool runs on its own only when a trusted server declares it as a read; writes ask. A tool that is undeclared or has changed stays off until you classify it as read, write, or sensitive. Treat what a tool returns as untrusted content.

#Plugins

Plugins are for advanced users and extension authors.

oktapod plugins list --verbose
oktapod plugins show <plugin_id>
oktapod plugins install --manifest <path> --source-path <path> --reason "Reviewed"
oktapod plugins uninstall <plugin_id> --reason "No longer needed"

A plugin command that changes things or is high risk must require approval. Installing or updating a plugin always needs a person to approve it.

#Before you trust something new

• Know who published it, and pin the version or check its digest.
• Read what it asks for: network, files, credentials, environment.
• Be wary of anything that wants your home folder, SSH keys, keychain, Docker socket, or production cloud credentials.
• Start with the lowest trust, a test account, and a throwaway workspace.
• Remove trust or uninstall it when you are done.

#When something does not run