feat: load skills from a directory tree

crates/rmcp/Cargo.toml

@@ -72,6 +72,11 @@ base64 = { version = "0.23", optional = true }
 # SHA-256 for SEP-2640 skill digests and SEP-2322 requestState sealing
 sha2 = "0.11"
 
+# SKILL.md frontmatter for the `skills-fs` catalog
+yaml_serde = { version = "0.10", optional = true }
+# reads the `skills-fs` catalog through a root handle that cannot escape it
+cap-std = { version = "4", optional = true }
+
 # for SEP-2322 requestState integrity sealing (opt-in via the `request-state` feature)
 hmac = { version = "0.13", optional = true }
 zeroize = { version = "1", optional = true }
@@ -139,6 +144,7 @@ elicitation = ["dep:url"]
 
 # SEP-2322 requestState integrity helper (HMAC-SHA256 seal/open codec)
 request-state = ["dep:hmac", "dep:zeroize", "base64"]
+skills-fs = ["server", "base64", "dep:cap-std", "dep:yaml_serde"]
 
 # reqwest http client
 __reqwest = ["dep:reqwest"]
@@ -224,6 +230,7 @@ tracing-subscriber = { version = "0.3", features = [
 ] }
 async-trait = "0.1"
 rstest = "0.28.0"
+tempfile = "3"
 # Cargo unifies this feature into rmcp whenever any crate in a build enables it,
 # so the tests run with it on (see tests/test_deserialization.rs).
 serde_json = { version = "1.0", features = ["arbitrary_precision"] }

crates/rmcp/README.md

@@ -26,6 +26,7 @@ For **getting started**, **usage guides**, and **full MCP feature documentation*
 | `auth` | OAuth 2.0 authentication support | |
 | `auth-enterprise-managed` | EMA/XAA refresh-token and ID-JAG exchanges for registered public and confidential clients (includes `auth`) | |
 | `elicitation` | Elicitation support | |
+| `skills-fs` | Serve SEP-2640 skills from a directory tree (`SkillCatalog`) | |
 
 ### Transport features
 

crates/rmcp/src/handler/server.rs

@@ -15,6 +15,8 @@ pub mod common;
 pub mod prompt;
 mod resource;
 pub mod router;
+#[cfg(feature = "skills-fs")]
+pub mod skill_catalog;
 pub mod tool;
 pub mod tool_name_validation;
 pub mod wrapper;