Pi reads the top-level skills/ directly via a `pi` block in package.json, so
it needs no vendoring or sync step. The README documents the git install only:
@neondatabase/agent-skills is not on npm, so `pi install npm:` would fail. The
fields a publish needs (pi-package keyword, files, publishConfig.access) are in
place so that publishing later is a decision rather than a project.
* Add a Kimi Code plugin manifest and release 1.1.2
Kimi Code reads its own kimi.plugin.json rather than the portable
plugin.json, and it does not read mcp.json, so the manifest declares the
Neon MCP Server inline. It points at skills/ in place, so like the root
Agent Plugins package it needs no vendoring.
Wiring it into sync-versions.mjs keeps its version generated from
package.json like every other manifest, and adding it to the workflow's
path filter keeps a Kimi-only edit from skipping validate:versions. The
bump to 1.1.2 releases the accumulated skill changes along with it.
* Tell Kimi users to run /new, not /reload, after installing
Clients implementing the Agent Plugins v1 specification look for a
manifest at the plugin root, so today this repo is only installable
through the Claude and Cursor packaging under plugins/. Adding a root
plugin.json and mcp.json makes the repository itself a conforming
portable package that reads skills/ in place, with no vendoring.
The v1 manifest schema is closed, so the client fields the existing
manifests carry (skills, mcpServers, logo, displayName) cannot appear
at the top level and MCP configuration moves to its own file. The root
mcp.json therefore spells the transport "streamable-http" while
plugins/neon-postgres/mcp.json keeps Claude and Cursor's "http" for the
same endpoint; the two files are intentionally not copies.
Apart from the version bump below, the packaging under plugins/ is
untouched, so existing Claude and Cursor installs behave as before.
validate-agent-plugin.mjs gates the new files in CI, checking the closed
manifest field set, MCP transport and containment rules, and skill
discovery. It shares the frontmatter semantics skills-ref uses so the
two validators cannot disagree about the same SKILL.md. Containment is
checked all the way down a skill rather than only at its root, since a
nested symlink escaping the repo would otherwise ship to a v1 client.
A link that will not resolve is reported rather than passing as
contained on the strength of a failed realpath.
Releases this as 1.1.1, and makes package.json the single source of
truth for that number. The root manifest added a sixth place the
version is declared and nothing kept them in step, so a bump that
missed one could publish a catalog entry advertising a different
version than the plugin it installs. sync-versions.mjs generates all
six from package.json, the pre-commit hook runs it the way it already
runs sync-plugin-skills.mjs, and validate:versions is that same script
in --check mode so CI still catches a hand-edited manifest. A release
is now one edit: bump package.json and commit.
The rewrite is a surgical text replacement rather than a JSON
re-serialize, so every manifest keeps its formatting. Nothing is written
until every file re-parses to exactly the expected result.
package-lock.json declares the version twice as well, but it repeats
"version" for every dependency, which makes a text rewrite unsafe; npm
owns that file, so the script checks it and leaves it alone.
The check refuses to pass quietly on a file it did not understand: one
that exists but declares no version is an error, and so is one that
cannot be read, since reporting "in sync" for a file never opened would
defeat the point. Each failure carries its own remedy, and the
sync:versions hint is withheld from the two that command cannot repair.
The hook stages only the manifests sync-versions.mjs reports rewriting,
which it prints to stdout. Staging all six unconditionally would sweep
an in-progress edit to a description or keyword list into an unrelated
commit, since those files are hand-authored apart from the version
field. The vendored skills are still staged a directory at a time so a
deletion is staged too, which is safe because every file under
plugins/*/skills is generated. That loop skips a directory that does
not exist: an unmatched glob is passed through literally, and git add
would abort the commit with a pathspec error the first time a plugin
ships without one of the two client packaging formats.
Also adds the marketplace catalogs to the workflow path filters; editing
one previously skipped CI even though validate:plugins reads them.
"Neon and Lakebase Postgres" coordinates the brand with one of its own
components as a peer. The old copy had no such problem, because "Neon
Serverless Postgres" was a single product name — so the replacement for a
brand-scope string is "Neon" alone, not brand plus component.
Twelve strings: both marketplace manifests, package.json, the AGENTS.md
overview, the skills.sh Core group, and the seven parent-skill pointer lines.
Database-scope copy is unchanged and still says Lakebase Postgres.
Dropping "Postgres" from the two manifest descriptions and package.json costs
nothing for discovery: both already carry it in tags and keywords.
The database product is Lakebase Postgres, reached either through Neon or
through Databricks. Public copy in this repo still called it "Neon Serverless
Postgres" and "Neon Postgres", and called Neon itself "the Neon platform" — a
framing we cannot use, since Neon is not a platform separate from the Databricks
Platform.
Rewrites the prose in all eight skills, the README, both marketplace manifests,
skills.sh.json, and package.json. Adds a Terminology section to AGENTS.md so the
rules survive the next contributor, and records that skill and plugin ids are
identifiers rather than copy.
Skill ids, plugin ids, CLI flags, env var names, and code samples are unchanged.
Plugin copies under plugins/ regenerated with npm run sync:plugins.
Review feedback asked for exact version pins. Two things were unpinned:
`npm run fmt` resolved prettier at runtime via `npx`, and the eval package
declared `@types/bun: "latest"`. Both now pin exact versions, and `.npmrc`
sets `save-exact=true` so future installs can't reintroduce a range.
Also fixes package-lock.json resolving every tarball from an internal npm
mirror rather than registry.npmjs.org. That breaks `npm ci` for anyone
outside that network and is why Dependabot's weekly npm job has been
failing with private_source_timed_out since it was committed.
The neon-postgres plugin exposed its skills via symlinks pointing outside
the plugin root (../../../skills/*). Cursor and Claude silently drop
out-of-root symlinks when installing a plugin from git, so the plugin
shipped its MCP server but none of its skills.
Replace the symlinks with committed real copies of every skill, generated
from the top-level skills/ source of truth by a one-way sync script
(scripts/sync-plugin-skills.mjs, driven by an in-script PLUGIN_SKILLS map;
"*" vendors all skills). A pre-commit hook wired via the prepare script
runs the sync automatically, and validate:plugin-skills (in validate:ci)
plus the cursor/claude plugin validators fail on drift or any in-plugin
symlink so this cannot silently regress.
Every markdown reference file in a skill must be reachable from its SKILL.md by
following the link graph (SKILL.md → references, and references → each other).
Links may be relative paths, full neon.com URLs, or GitHub blob URLs into this
repo. Fails when a link points at a missing file, or when a markdown file is
never reached from SKILL.md (orphan). Non-markdown files (scripts, etc.) are
reported but not required to be linked. Wired into validate:ci.
Replace validate-plugins.yml with a single Validate workflow that runs
`npm run validate:ci` (validate:plugins && validate:skills), keeping this
repo's plugin-manifest checks. Add path filters and document the shared,
hardened CI shape plus the intentional per-repo differences with
neon-for-agent-platforms in AGENTS.md.
Add package-lock.json, pin skills-ref@0.1.5 as a devDependency, and switch
the Validate Plugins workflow from npm install to npm ci --ignore-scripts so
CI installs are integrity-checked. Add Dependabot for github-actions and npm.
Rework the neon-postgres skill index into an ordered, task-first guide with specific feature and integration entry points so agents can route faster from context. Add skills-ref validation to CI to prevent regressions in skill structure.
Co-authored-by: Cursor <cursoragent@cursor.com>
Restructure plugin packaging into per-plugin folders so Claude and Cursor manifests, MCP config, and branding are co-located while shared skills are symlinked from top-level skills. Add plugin-manager guidance and CI validation scripts/workflow to prevent marketplace and manifest path regressions as additional plugins are added.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add .claude-plugin/plugin.json manifest for Claude Code plugin
- Add .claude-plugin/marketplace.json for plugin discovery
- Add .mcp.json to bundle Neon MCP Server (OAuth-based remote server)
- Update package.json with version and metadata
- Update README.md with Claude Code plugin installation instructions
Users can now install via Claude Code:
/plugin marketplace add neondatabase/agent-skills
/plugin install neon@neon-plugins
This bundles both the using-neon skill and the Neon MCP Server for
natural language database management.
Tony Dang