Manage capabilities

Each capability page has Added and Available views for the organisation or a team. Teams inherit organisation definitions. Instructions, skills, agents, MCP servers, playbooks and environments support availability overrides and organisation locks. Apps and connections do not.

Added

Added contains what the agent can use in the selected scope. Skills, agents, MCP servers and environments have an In use switch. A disabled custom item stays visible, marked Not in use. The source column shows the plugin name, the username or the creating agent. Authorship comes from the authenticated identity and survives edits.

Removing items

Action	What it does
Remove from scope (plugin item)	Returns the item to Available without changing its source.
Delete (custom item)	Deletes an item created at that scope.
Remove from scope (inherited organisation item, from a team)	Turns it off for that team only. A team cannot delete an organisation item.
Remove plugin	Disconnects the repository and removes every definition, bundle and app copy it owns, in every scope.

Inherited connections cannot be unlinked from a team. Switch to the Organisation scope to remove them.

Locks

At the Organisation scope, Lock for every scope pins an item’s on or off state everywhere. The team switch and removal are disabled, and the console shows the item as managed by the organisation. A lock is inert for any nearer override: the resolver ignores it, not merely the UI. Where two locks exist, the one furthest along the chain wins, so a team cannot lock its way past the organisation.

Locks pin only the on or off decision. Nothing pins a definition or its settings.

Note

archived and off are separate. Archiving is a fact about the artifact everywhere and is its owner’s call. off is one scope’s decision about one key, and it survives a re-sync.

Re-sync

Connecting a plugin makes its items Available. It does not enable anything, and added items have no separate Update action. Re-sync is how changes arrive.

• It runs only when an administrator asks.
• It updates materialised definitions in every scope, including disabled ones, and preserves overrides.
• API connections keep their saved credentials and endpoint restrictions. Incompatible endpoint or authentication changes, and broader write access, need an administrator to save the new configuration. Tightening readOnly to true applies immediately.
• If an MCP endpoint changes, its saved token is discarded and the server is disabled until re-added.
• Invalid files or model settings reject the sync before anything changes. A store failure part-way can leave partial updates; the durable sync marker identifies this state and blocks additions until you retry.

Console API

All admin routes require an organisation administrator. Selecting a scope accepts the organisation or an existing team:<id>; agent tokens cannot target teams.

Route	Purpose
GET /v1/admin/plugins	Connection summaries and GitHub connection status
POST /v1/admin/plugins	Connect { url, ref?, path? }
POST /v1/admin/plugins/:id/resync	Fetch and apply repository changes
DELETE /v1/admin/plugins/:id	Disconnect and remove owned definitions
POST /v1/admin/marketplaces	Link { url, ref?, path? }
POST /v1/admin/marketplaces/:id/resync	Re-read the marketplace file and re-sync its plugins
GET /v1/admin/capability-library?kind=…&scopeId=…&view=added|available	List capabilities for a scope
POST /v1/admin/capability-library/:kind/:key	Add an item to a scope
DELETE /v1/admin/capability-library/:kind/:key?scopeId=…	Remove or delete according to provenance
POST /v1/admin/skills, PUT /v1/admin/skills/:id	Create or replace a custom skill
POST /v1/admin/agents, PUT /v1/admin/agents/:name	Create or replace an agent
PUT /v1/admin/mcp-servers/:id	Create or replace a custom MCP server

kind is one of skill, agent, mcp, environment, instruction, playbook or app. API connections have their own routes, POST and DELETE /v1/admin/capability-library/connection/:key.