···11+---
22+title: Advanced Core Embedding
33+description: "Integration runtime capabilities: config, registry, run engine, and channel runners."
44+---
55+66+# Advanced Core Embedding
77+88+This page only covers capabilities provided by the `integration` package.
99+1010+## What `integration` Provides
1111+1212+- `integration.DefaultConfig()` / `integration.Config.Set(...)`
1313+- `integration.New(cfg)`
1414+- `rt.NewRegistry()`
1515+- `rt.NewRunEngine(...)`
1616+- `rt.NewRunEngineWithRegistry(...)`
1717+- `rt.RunTask(...)`
1818+- `rt.RequestTimeout()`
1919+- `rt.NewTelegramBot(...)`
2020+- `rt.NewSlackBot(...)`
2121+2222+## Config Layer (Inside `integration.Config`)
2323+2424+- `Overrides` + `Set(key, value)`: override Viper keys.
2525+- `Features`: toggle built-in runtime wiring (`PlanTool`, `Guard`, `Skills`).
2626+- `BuiltinToolNames`: built-in tool whitelist (empty = all built-ins).
2727+- `Inspect`: prompt/request dump behavior.
2828+2929+```go
3030+cfg := integration.DefaultConfig()
3131+cfg.Set("llm.provider", "openai")
3232+cfg.Set("llm.model", "gpt-5.4")
3333+cfg.Set("llm.api_key", os.Getenv("OPENAI_API_KEY"))
3434+cfg.Features.Skills = true
3535+cfg.BuiltinToolNames = []string{"read_file", "url_fetch", "todo_update"}
3636+```
3737+3838+## Registry and Custom Tools
3939+4040+`integration` lets you extend runtime registry before engine creation.
4141+4242+### Runnable Example (Custom Tool + integration Runtime)
4343+4444+```go
4545+package main
4646+4747+import (
4848+ "context"
4949+ "encoding/json"
5050+ "fmt"
5151+ "os"
5252+ "strings"
5353+5454+ "github.com/quailyquaily/mistermorph/agent"
5555+ "github.com/quailyquaily/mistermorph/integration"
5656+)
5757+5858+type EchoTool struct{}
5959+6060+func (t *EchoTool) Name() string { return "echo_text" }
6161+6262+func (t *EchoTool) Description() string {
6363+ return "Echoes input text as JSON."
6464+}
6565+6666+func (t *EchoTool) ParameterSchema() string {
6767+ return `{
6868+ "type": "object",
6969+ "properties": {
7070+ "text": {"type": "string", "description": "Text to echo."}
7171+ },
7272+ "required": ["text"]
7373+}`
7474+}
7575+7676+func (t *EchoTool) Execute(_ context.Context, params map[string]any) (string, error) {
7777+ text, _ := params["text"].(string)
7878+ text = strings.TrimSpace(text)
7979+ if text == "" {
8080+ return "", fmt.Errorf("text is required")
8181+ }
8282+ b, _ := json.Marshal(map[string]any{"text": text})
8383+ return string(b), nil
8484+}
8585+8686+func main() {
8787+ cfg := integration.DefaultConfig()
8888+ cfg.Set("llm.provider", "openai")
8989+ cfg.Set("llm.model", "gpt-5.4")
9090+ cfg.Set("llm.api_key", os.Getenv("OPENAI_API_KEY"))
9191+9292+ rt := integration.New(cfg)
9393+ reg := rt.NewRegistry()
9494+ reg.Register(&EchoTool{})
9595+9696+ task := "Call tool echo_text with text 'hello from tool', then answer with that text."
9797+9898+ prepared, err := rt.NewRunEngineWithRegistry(context.Background(), task, reg)
9999+ if err != nil {
100100+ panic(err)
101101+ }
102102+ defer prepared.Cleanup()
103103+104104+ final, _, err := prepared.Engine.Run(context.Background(), task, agent.RunOptions{Model: prepared.Model})
105105+ if err != nil {
106106+ panic(err)
107107+ }
108108+109109+ fmt.Println(final.Output)
110110+}
111111+```
112112+113113+## Run APIs
114114+115115+### Prepared Engine API
116116+117117+```go
118118+prepared, err := rt.NewRunEngine(context.Background(), task)
119119+if err != nil {
120120+ panic(err)
121121+}
122122+defer prepared.Cleanup()
123123+124124+final, _, err := prepared.Engine.Run(context.Background(), task, agent.RunOptions{
125125+ Model: prepared.Model,
126126+})
127127+```
128128+129129+#### Why Use Prepared Engine API
130130+131131+- Controlled lifecycle: you decide exactly when to call `Cleanup()`.
132132+- Reusability: reuse the same `prepared.Engine` for multiple runs.
133133+- Per-run flexibility: pass different `RunOptions` on each run.
134134+- Better orchestration: direct access to `prepared.Model` and `Engine` for your session/scheduler layer.
135135+136136+### Convenience API
137137+138138+```go
139139+final, runCtx, err := rt.RunTask(context.Background(), task, agent.RunOptions{})
140140+_ = final
141141+_ = runCtx
142142+_ = err
143143+```
144144+145145+## Inspect and Runtime Diagnostics
146146+147147+```go
148148+cfg.Inspect.Prompt = true
149149+cfg.Inspect.Request = true
150150+cfg.Inspect.DumpDir = "./dump"
151151+```
152152+153153+## Telegram Channel Integration (Advanced)
154154+155155+```go
156156+tg, _ := rt.NewTelegramBot(integration.TelegramOptions{BotToken: os.Getenv("MISTER_MORPH_TELEGRAM_BOT_TOKEN")})
157157+_ = tg
158158+```
159159+160160+## Slack Channel Integration (Optional)
161161+162162+```go
163163+sl, _ := rt.NewSlackBot(integration.SlackOptions{
164164+ BotToken: os.Getenv("MISTER_MORPH_SLACK_BOT_TOKEN"),
165165+ AppToken: os.Getenv("MISTER_MORPH_SLACK_APP_TOKEN"),
166166+})
167167+_ = sl
168168+```
169169+170170+## Out of Scope for This Page
171171+172172+Low-level engine customization is documented in [Agent-Level Customization](/guide/agent-level-customization).
+50
web/vitepress/docs/guide/docs-map.md
···11+---
22+title: Repository Docs Map
33+description: Where to find deeper design and runtime documents in the repo.
44+---
55+66+# Repository Docs Map
77+88+## This Site Structure
99+1010+- Getting Started
1111+ - [Overview](/guide/overview)
1212+ - [Quickstart (CLI)](/guide/quickstart-cli)
1313+ - [Install and Configure](/guide/install-and-config)
1414+- Developer (Embedding)
1515+ - [Build an Agent with Core](/guide/build-agent-with-core)
1616+ - [Advanced Core Embedding](/guide/core-advanced-embedding)
1717+ - [Agent-Level Customization](/guide/agent-level-customization)
1818+- Runtime
1919+ - [Runtime Modes](/guide/runtime-modes)
2020+ - [Prompt Architecture (Top-Down)](/guide/prompt-architecture)
2121+ - [Memory](/guide/memory)
2222+ - [Skills](/guide/skills)
2323+ - [Built-in Tools](/guide/built-in-tools)
2424+ - [MCP](/guide/mcp)
2525+- Operations
2626+ - [Security and Guard](/guide/security-and-guard)
2727+ - [Config Patterns](/guide/config-patterns)
2828+ - [Config Fields Reference](/guide/config-reference)
2929+ - [Environment Variables Reference](/guide/env-vars-reference)
3030+3131+## Core and Architecture
3232+3333+- [`docs/arch.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/arch.md)
3434+- [`docs/integration.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/integration.md)
3535+- [`docs/prompt.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/prompt.md)
3636+3737+## Runtime and Channels
3838+3939+- [`docs/console.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/console.md)
4040+- [`docs/slack.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/slack.md)
4141+- [`docs/line.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/line.md)
4242+- [`docs/lark.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/lark.md)
4343+4444+## Governance and State
4545+4646+- [`docs/security.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/security.md)
4747+- [`docs/tools.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/tools.md)
4848+- [`docs/skills.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/skills.md)
4949+- [`docs/memory.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/memory.md)
5050+- [`docs/bus.md`](https://github.com/quailyquaily/mistermorph/blob/master/docs/bus.md)
+83
web/vitepress/docs/guide/env-vars-reference.md
···11+---
22+title: Environment Variables Reference
33+description: Complete env var model, mapping rule, and compatibility variables.
44+---
55+66+# Environment Variables Reference
77+88+## Precedence
99+1010+Effective precedence is:
1111+1212+1. CLI flags
1313+2. `MISTER_MORPH_*` env vars
1414+3. `config.yaml`
1515+4. code defaults
1616+1717+## Complete Support Rule
1818+1919+All config keys are env-overridable through one rule:
2020+2121+- Prefix with `MISTER_MORPH_`
2222+- Convert to upper case
2323+- Replace `.` and `-` with `_`
2424+2525+Examples:
2626+2727+- `llm.api_key` -> `MISTER_MORPH_LLM_API_KEY`
2828+- `tools.bash.enabled` -> `MISTER_MORPH_TOOLS_BASH_ENABLED`
2929+- `mcp.servers` -> `MISTER_MORPH_MCP_SERVERS`
3030+3131+So all fields listed in [Config Fields Reference](/guide/config-reference) are supported as env vars.
3232+3333+## High-Frequency Variables
3434+3535+- `MISTER_MORPH_CONFIG`
3636+- `MISTER_MORPH_LLM_PROVIDER`
3737+- `MISTER_MORPH_LLM_ENDPOINT`
3838+- `MISTER_MORPH_LLM_MODEL`
3939+- `MISTER_MORPH_LLM_API_KEY`
4040+- `MISTER_MORPH_SERVER_AUTH_TOKEN`
4141+- `MISTER_MORPH_CONSOLE_PASSWORD`
4242+- `MISTER_MORPH_CONSOLE_PASSWORD_HASH`
4343+- `MISTER_MORPH_TELEGRAM_BOT_TOKEN`
4444+- `MISTER_MORPH_SLACK_BOT_TOKEN`
4545+- `MISTER_MORPH_SLACK_APP_TOKEN`
4646+- `MISTER_MORPH_LINE_CHANNEL_ACCESS_TOKEN`
4747+- `MISTER_MORPH_LINE_CHANNEL_SECRET`
4848+- `MISTER_MORPH_LARK_APP_ID`
4949+- `MISTER_MORPH_LARK_APP_SECRET`
5050+- `MISTER_MORPH_FILE_STATE_DIR`
5151+- `MISTER_MORPH_FILE_CACHE_DIR`
5252+5353+## `${ENV_VAR}` Expansion Inside Config
5454+5555+All string values in config support `${ENV_VAR}` expansion.
5656+5757+```yaml
5858+llm:
5959+ api_key: "${OPENAI_API_KEY}"
6060+mcp:
6161+ servers:
6262+ - name: remote
6363+ headers:
6464+ Authorization: "Bearer ${MCP_REMOTE_TOKEN}"
6565+```
6666+6767+Notes:
6868+6969+- only `${NAME}` form is expanded
7070+- bare `$NAME` is not expanded
7171+- missing vars become empty string with warning
7272+7373+## Compatibility / Special Env Vars
7474+7575+- `TELEGRAM_BOT_TOKEN`
7676+ - fallback for `mistermorph telegram send`
7777+ - preferred var is still `MISTER_MORPH_TELEGRAM_BOT_TOKEN`
7878+- `NO_COLOR` and `TERM=dumb`
7979+ - affect CLI color output behavior only
8080+8181+## Practical Pattern
8282+8383+For secrets, keep config value as `${ENV_VAR}` and set the secret in runtime environment.
+45
web/vitepress/docs/guide/install-and-config.md
···11+---
22+title: Install and Configure
33+description: Installation options and baseline configuration model.
44+---
55+66+# Install and Configure
77+88+## Install Options
99+1010+```bash
1111+# Release installer
1212+curl -fsSL -o /tmp/install-mistermorph.sh https://raw.githubusercontent.com/quailyquaily/mistermorph/refs/heads/master/scripts/install-release.sh
1313+sudo bash /tmp/install-mistermorph.sh
1414+```
1515+1616+```bash
1717+# Go install
1818+go install github.com/quailyquaily/mistermorph/cmd/mistermorph@latest
1919+```
2020+2121+## Initialize Files
2222+2323+```bash
2424+mistermorph install
2525+```
2626+2727+Default workspace is `~/.morph/`.
2828+2929+## Config Sources (precedence)
3030+3131+- CLI flags
3232+- Environment variables
3333+- `config.yaml`
3434+3535+## Minimal `config.yaml`
3636+3737+```yaml
3838+llm:
3939+ provider: openai
4040+ model: gpt-5.4
4141+ endpoint: https://api.openai.com
4242+ api_key: ${OPENAI_API_KEY}
4343+```
4444+4545+Use `assets/config/config.example.yaml` as the full key reference.
+68
web/vitepress/docs/guide/mcp.md
···11+---
22+title: MCP
33+description: Configure MCP servers and expose remote tools as local agent tools.
44+---
55+66+# MCP
77+88+Mister Morph can connect to MCP servers and expose their tools in the same tool-calling loop.
99+1010+## Tool Name Mapping
1111+1212+MCP tools are registered as:
1313+1414+- `mcp_<server_name>__<tool_name>`
1515+1616+Example:
1717+1818+- `mcp_filesystem__read_file`
1919+2020+## Supported Transports
2121+2222+- `stdio` (default)
2323+- `http`
2424+2525+## Config Shape
2626+2727+```yaml
2828+mcp:
2929+ servers:
3030+ - name: filesystem
3131+ type: stdio
3232+ command: npx
3333+ args: ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
3434+ allowed_tools: []
3535+3636+ - name: remote
3737+ type: http
3838+ url: "https://mcp.example.com/mcp"
3939+ headers:
4040+ Authorization: "Bearer ${MCP_REMOTE_TOKEN}"
4141+ allowed_tools: ["search"]
4242+```
4343+4444+Field behavior:
4545+4646+- `enable: false` disables a server entry
4747+- `allowed_tools: []` means all tools from that server
4848+- invalid server config is skipped with warning
4949+5050+## Lifecycle
5151+5252+1. Runtime reads `mcp.servers`.
5353+2. Connect to each enabled/valid server.
5454+3. List server tools.
5555+4. Adapt and register tools into local registry.
5656+5. On shutdown, close MCP sessions.
5757+5858+## Failure Model
5959+6060+- Per-server failures are isolated.
6161+- Other servers and built-in tools keep working.
6262+- If no server connects, runtime still runs without MCP tools.
6363+6464+## Security Notes
6565+6666+- Prefer `allowed_tools` to reduce blast radius.
6767+- Keep auth headers in env vars (`${ENV_VAR}`), not plain text.
6868+- Combine with guard/network policy for outbound controls.
+61
web/vitepress/docs/guide/memory.md
···11+---
22+title: Memory
33+description: WAL-based memory architecture, injection, and writeback behavior.
44+---
55+66+# Memory
77+88+Mister Morph memory is append-first and rebuildable.
99+1010+## Architecture
1111+1212+- Source of truth: `memory/log/*.jsonl` (WAL)
1313+- Read model: markdown projections
1414+ - `memory/index.md` (long-term)
1515+ - `memory/YYYY-MM-DD/*.md` (short-term)
1616+- Projection runs asynchronously; hot path writes only WAL.
1717+1818+## Runtime Flow
1919+2020+1. Before LLM call: runtime prepares memory snapshot and injects it into prompt blocks.
2121+2. After final reply: runtime records raw memory event to WAL.
2222+3. Projection worker replays WAL and updates markdown files.
2323+2424+## Injection Rules
2525+2626+Memory injection runs only when all conditions match:
2727+2828+- `memory.enabled = true`
2929+- `memory.injection.enabled = true`
3030+- runtime provides a valid `subject_id`
3131+- snapshot content is not empty
3232+3333+`memory.injection.max_items` limits injected summary items.
3434+3535+## Writeback Rules
3636+3737+Writeback runs only when:
3838+3939+- final reply is actually published
4040+- memory orchestrator exists
4141+- `subject_id` exists
4242+4343+If final output is empty/lightweight, writeback may be skipped.
4444+4545+## Config Keys
4646+4747+```yaml
4848+memory:
4949+ enabled: true
5050+ dir_name: "memory"
5151+ short_term_days: 7
5252+ injection:
5353+ enabled: true
5454+ max_items: 50
5555+```
5656+5757+## Operational Notes
5858+5959+- If markdown projections are damaged, rebuild from WAL.
6060+- Treat `memory/log/*.jsonl` as durable data.
6161+- Keep `file_state_dir` on persistent storage in production.
+27
web/vitepress/docs/guide/overview.md
···11+---
22+title: Overview
33+description: What Mister Morph is, and the fastest path through these docs.
44+---
55+66+# Overview
77+88+Mister Morph is a unified agent project with two primary usage patterns:
99+1010+- CLI-first workflow (`mistermorph run`, `telegram`, `slack`, `console serve`)
1111+- Embedded Go core (`integration` package)
1212+1313+## Choose Your Path
1414+1515+- Building automation quickly: start with [Quickstart (CLI)](/guide/quickstart-cli)
1616+- Embedding in your Go project: go to [Build an Agent with Core](/guide/build-agent-with-core)
1717+- Running long-lived channels: read [Runtime Modes](/guide/runtime-modes)
1818+- Production hardening: read [Security and Guard](/guide/security-and-guard)
1919+2020+## Repository Structure Snapshot
2121+2222+- CLI entry: `cmd/mistermorph/`
2323+- Agent engine: `agent/`
2424+- Embedding core: `integration/`
2525+- Built-in tools: `tools/`
2626+- Provider backends: `providers/`
2727+- Detailed docs: `docs/`
+119
web/vitepress/docs/guide/prompt-architecture.md
···11+---
22+title: Prompt Architecture (Top-Down)
33+description: How system prompt content is assembled from identity to runtime blocks.
44+---
55+66+# Prompt Architecture (Top-Down)
77+88+This is the runtime order used in current code.
99+1010+## Top-Down Flow Diagram
1111+1212+```text
1313+PromptSpecWithSkills(...)
1414+ |
1515+ v
1616+ApplyPersonaIdentity(...)
1717+ |
1818+ v
1919+AppendLocalToolNotesBlock(...)
2020+ |
2121+ v
2222+AppendPlanCreateGuidanceBlock(...)
2323+ |
2424+ v
2525+AppendTodoWorkflowBlock(...)
2626+ |
2727+ v
2828+Channel PromptAugment(...)
2929+ |
3030+ v
3131+AppendMemorySummariesBlock(...)
3232+ |
3333+ v
3434+BuildSystemPrompt(...) -> system prompt text
3535+```
3636+3737+## 1) Identity Layer
3838+3939+Base identity comes from `agent.DefaultPromptSpec()`.
4040+4141+Then runtime may replace it via local persona files:
4242+4343+- `file_state_dir/IDENTITY.md`
4444+- `file_state_dir/SOUL.md`
4545+4646+Applied by `promptprofile.ApplyPersonaIdentity(...)`.
4747+4848+## 2) Skills Layer
4949+5050+`skillsutil.PromptSpecWithSkills(...)` discovers selected skills and injects only metadata into the system prompt:
5151+5252+- skill name
5353+- `SKILL.md` path
5454+- short description
5555+- required `auth_profiles` (if provided)
5656+5757+The model reads the actual skill file through `read_file` when needed.
5858+5959+## 3) Core Policy Blocks
6060+6161+Common blocks are appended in task runtime order:
6262+6363+1. local tool notes (`SCRIPTS.md`) via `AppendLocalToolNotesBlock`
6464+2. `plan_create` guidance via `AppendPlanCreateGuidanceBlock`
6565+3. TODO workflow policy via `AppendTodoWorkflowBlock`
6666+6767+## 4) Channel Blocks
6868+6969+Channel runtime then appends channel-specific blocks.
7070+7171+Examples:
7272+7373+- Telegram: `AppendTelegramRuntimeBlocks(...)`
7474+- Slack: `AppendSlackRuntimeBlocks(...)`
7575+- LINE: `AppendLineRuntimeBlocks(...)`
7676+- Lark: `AppendLarkRuntimeBlocks(...)`
7777+7878+## 5) Memory Injection Block
7979+8080+If enabled, memory snapshot text is appended as another block through `AppendMemorySummariesBlock(...)`.
8181+8282+## 6) System Prompt Rendering
8383+8484+`agent.BuildSystemPrompt(...)` renders `agent/prompts/system.md` with:
8585+8686+- identity
8787+- skills metadata
8888+- appended blocks
8989+- tool summary from registry
9090+- rules list
9191+9292+## 7) Message Stack Sent to LLM
9393+9494+In `engine.Run(...)`, message order is:
9595+9696+```text
9797+[system] rendered system prompt
9898+ ->
9999+[user] mister_morph_meta (optional)
100100+ ->
101101+[history] non-system messages
102102+ ->
103103+[user] current message or raw task
104104+```
105105+106106+1. system prompt
107107+2. injected runtime metadata message (`mister_morph_meta`, if present)
108108+3. history messages (non-system)
109109+4. current message (if provided) or raw task text
110110+111111+## Practical Rule
112112+113113+If you need to customize prompt behavior, prefer these extension points in order:
114114+115115+1. `IDENTITY.md` / `SOUL.md`
116116+2. `SKILL.md` + `skills.load`
117117+3. `SCRIPTS.md`
118118+4. runtime-specific prompt augment
119119+5. low-level `agent.WithPromptBuilder(...)` (only for full custom wiring)
+40
web/vitepress/docs/guide/quickstart-cli.md
···11+---
22+title: Quickstart (CLI)
33+description: Get a runnable CLI setup in a few minutes.
44+---
55+66+# Quickstart (CLI)
77+88+## 1. Install
99+1010+```bash
1111+go install github.com/quailyquaily/mistermorph/cmd/mistermorph@latest
1212+```
1313+1414+## 2. Initialize workspace
1515+1616+```bash
1717+mistermorph install
1818+```
1919+2020+## 3. Set model credentials
2121+2222+```bash
2323+export MISTER_MORPH_LLM_PROVIDER="openai"
2424+export MISTER_MORPH_LLM_MODEL="gpt-5.4"
2525+export MISTER_MORPH_LLM_API_KEY="YOUR_API_KEY"
2626+```
2727+2828+## 4. Run first task
2929+3030+```bash
3131+mistermorph run --task "Summarize this repository"
3232+```
3333+3434+## 5. Useful debug switches
3535+3636+```bash
3737+mistermorph run --inspect-prompt --inspect-request --task "hello"
3838+```
3939+4040+For full config keys, see [Config Patterns](/guide/config-patterns) and `assets/config/config.example.yaml`.
+43
web/vitepress/docs/guide/runtime-modes.md
···11+---
22+title: Runtime Modes
33+description: Which runtime to use for CLI, bots, or web console.
44+---
55+66+# Runtime Modes
77+88+## One-shot task
99+1010+```bash
1111+mistermorph run --task "..."
1212+```
1313+1414+## Telegram bot
1515+1616+```bash
1717+mistermorph telegram --log-level info
1818+```
1919+2020+## Slack bot
2121+2222+```bash
2323+mistermorph slack --log-level info
2424+```
2525+2626+## Console backend
2727+2828+```bash
2929+mistermorph console serve
3030+```
3131+3232+## Legacy daemon (if needed)
3333+3434+```bash
3535+mistermorph serve --server-listen 127.0.0.1:8787
3636+```
3737+3838+Detailed setup docs:
3939+4040+- `docs/console.md`
4141+- `docs/slack.md`
4242+- `docs/line.md`
4343+- `docs/lark.md`
+29
web/vitepress/docs/guide/security-and-guard.md
···11+---
22+title: Security and Guard
33+description: Practical baseline for safe deployment.
44+---
55+66+# Security and Guard
77+88+## Recommended Baseline
99+1010+- Keep API keys in env vars, not committed config
1111+- Restrict outbound domains with `guard.network.url_fetch.allowed_url_prefixes`
1212+- Keep redaction enabled (`guard.redaction.enabled: true`)
1313+- Enable approvals for risky actions in long-running modes
1414+1515+## Minimal Guard Snippet
1616+1717+```yaml
1818+guard:
1919+ enabled: true
2020+ network:
2121+ url_fetch:
2222+ allowed_url_prefixes: ["https://"]
2323+ deny_private_ips: true
2424+ follow_redirects: false
2525+ redaction:
2626+ enabled: true
2727+```
2828+2929+For production details, read `docs/security.md`.
+63
web/vitepress/docs/guide/skills.md
···11+---
22+title: Skills
33+description: Skill discovery, loading strategy, and runtime behavior.
44+---
55+66+# Skills
77+88+Skills are local instruction packs centered on `SKILL.md`.
99+1010+## What a Skill Is
1111+1212+A skill is prompt context, not a tool.
1313+1414+- Skills tell the model how to solve a type of task.
1515+- Tools execute actions (`read_file`, `url_fetch`, `bash`, ...).
1616+1717+## Discovery
1818+1919+Default discovery root:
2020+2121+- `file_state_dir/skills` (usually `~/.morph/skills`)
2222+2323+Runtime scans for `SKILL.md` recursively.
2424+2525+## Loading Controls
2626+2727+```yaml
2828+skills:
2929+ enabled: true
3030+ dir_name: "skills"
3131+ load: []
3232+```
3333+3434+- `enabled: false` => no skill loading
3535+- `load: []` => load all discovered skills
3636+- `load: ["a", "b"]` => load selected skills
3737+- unknown entries are ignored
3838+3939+Task text can also trigger by `$skill-name` or `$skill-id`.
4040+4141+## Runtime Injection Model
4242+4343+Loaded skill metadata is injected into system prompt:
4444+4545+- `name`
4646+- `file_path`
4747+- `description`
4848+- `auth_profiles` (optional)
4949+5050+Actual `SKILL.md` content is loaded only when the model calls `read_file`.
5151+5252+## CLI Commands
5353+5454+```bash
5555+mistermorph skills list
5656+mistermorph skills install
5757+mistermorph skills install "https://example.com/SKILL.md"
5858+```
5959+6060+## Safety Notes
6161+6262+- Remote skill install reviews content before writing.
6363+- Files are downloaded and written only; not executed during install.