MCP Skills & Workflows
Curated agent playbooks and multi-step workflows on ToolYour MCP.
For TypeScript single-tool calls and per-tool example syntax, see the SDK Tool Map. For SDK vs MCP decision guide and workflow replication in Node, see SDK vs MCP workflows.
Skills (MCP resources)
Skills are markdown playbooks agents load once per session. Marketing use-cases: SEO agent, ship gate, security audit, marketing agent.
Payload first: pass workspace files / HTML / text. Ask for a live URL only when the user wants link analysis, or the job cannot run without a fetch.
| Skill ID | Use when |
|---|---|
seo-site-audit | SEO analysis of a URL |
technical-seo-audit | Mid-sprint technical SEO (SEO + links + speed) |
full-seo-optimization | Deep SEO (content + links + social + speed) |
keyword-opportunity-review | Keyword / content opportunity review |
page-performance | Page speed / performance (HTML proxies) |
content-refresh | Content update recommendations |
content-quality | Content depth / readability audit |
document-pipeline | Document conversion with download URLs |
frontend-webp | Convert page images to WebP and list img/srcset replacements |
fix-verify-frontend-webp | Re-check WebP conversion after host replacements |
social-preview | Open Graph / Twitter Card previews |
crawl-analysis | Link / crawl analysis |
seo-deploy-regression | Post-deploy bulk URL check |
seo-staging-diff | Bulk + staging vs production SEO Change Diff |
crawl-readiness | robots.txt + sitemap + redirect hygiene |
structured-data-audit | Schema + meta + social tags |
ai-overview-readiness | GEO / AI Overview extractability heuristics |
site-icons-audit | Favicon / apple-touch reachability |
campaign-tracking-setup | UTM + ads macros + parser |
paid-ads-copy-gate | Ads copy limits + RSA preview |
growth-unit-economics | ROAS / CPC / CTR / CPA / CAC |
email-campaign-qa | Email subject + spam heuristics |
landing-conversion-check | CTA / forms / marketing tags |
fix-verify-campaign-tracking-setup | Re-check UTM / ads tracking after fixes |
fix-verify-paid-ads-copy-gate | Re-check ads copy limits after fixes |
fix-verify-growth-unit-economics | Re-check ROAS/CPC/CTR/CPA/CAC after plan changes |
fix-verify-email-campaign-qa | Re-check email subject / spam heuristics after fixes |
fix-verify-landing-conversion-check | Re-check CTA / forms / tags after fixes |
fix-verify-crawl-readiness | Re-check crawl readiness after fixes |
fix-verify-structured-data | Re-check structured data after fixes |
fix-verify-ai-overview-readiness | Re-check AI Overview readiness after fixes |
fix-verify-site-icons | Re-check icons after fixes |
fix-verify-technical-seo | Re-check technical SEO after fixes |
fix-verify-seo-deploy-regression | Re-check bulk SEO after fixes |
web-security-audit | Practical security signals — headers, TLS, cookies, CORS, SRI, security.txt (not a pen test) |
frontend-supply-chain | SRI, mixed content, CORS |
fix-verify-frontend-supply-chain | Re-check supply-chain after fixes |
fix-verify-web-security-audit | Re-check full security audit after fixes |
secrets-and-auth-hygiene | Secret leak + JWT decode on pasted text |
auth-token-hygiene | JWT-first decode + leak scan |
dev-json-pipeline | Validate/format JSON → Zod/TS codegen |
dev-auth-debug | Test JWT mint + decode; headers/request builder via invoke |
dev-format-transform | YAML→JSON→XML format playbook; HTML/CSS/JS/SQL/minify/cron/color are one-shots |
developer-ship-checklist | Pre-deploy security + mixed content + status + speed proxy |
pr-code-gate | PR/local files first (secrets + format/validate; no live fetch) |
ship-gate | URL smoke ship gate (run_playbook) — not a pen test |
pr-preview-gate | Same gate for preview/PR URLs |
fix-verify-ship-gate | Re-check ship gate after fixes |
fix-verify-security-headers | Re-check headers after fixes |
fix-verify-social-preview | Re-check OG/Twitter after fixes |
fix-verify-core-web-vitals | Re-check CWV proxies after fixes |
fix-verify-seo-audit | Re-check SEO audit after fixes |
fix-verify-email-auth | Re-check SPF/DKIM/DMARC after fixes |
content-ship | Local HTML ship checklist (run_playbook, free unless enhance) |
dns-email-security | SPF/DKIM/DMARC, DNS lookup, security.txt |
plan_task(goal) → run_playbook("ship-gate", { url }) → verify_task(...)
# or browse playbooks:
list_skills() → load_skill("seo-site-audit") → invoke_tool(...)Prefer run_playbook(skillId) over inventing steps from markdown. Full catalog: MCP Playbooks.
Workflows
run_workflow(workflowId, input) runs multiple API calls server-side:
| Workflow ID | Steps |
|---|---|
full-seo-audit | SEO analyze + page-speed proxy (returns merged jobReport) |
core-web-vitals-job | Page-speed proxy + SEO + social preview (CWV-focused jobReport; not CrUX/Lighthouse) |
full-seo-optimization-job | SEO + content + speed + internal links + link extract + social (jobReport) |
internal-link-architecture-job | Internal link graph + seed link profile + hub SEO (jobReport) |
technical-seo-audit-job | Technical SEO + page links + speed (jobReport, lite) |
social-preview-audit-job | Open Graph + Twitter Card audit (jobReport) |
content-quality-audit-job | Content + keyword signals (jobReport) |
keyword-opportunity-review-job | Keyword gaps + content (jobReport) |
seo-deploy-regression-job | Bulk URL lite scorecard after deploy (jobReport) |
seo-deploy-regression-diff-job | Bulk scorecard + one SEO Change Diff (urlA/urlB) |
full-security-audit | Headers + TLS + cookies + CORS + SRI + security.txt (jobReport) |
security-headers-job | Security headers only (jobReport) |
frontend-supply-chain-job | SRI + mixed content + CORS (jobReport) |
developer-ship-checklist-job | Headers + TLS + mixed content + HTTP status + speed (jobReport) |
ship-gate-job | URL smoke ship gate (same steps as developer checklist; not a pen test) |
secrets-hygiene-job | Secret leak scanner + optional JWT decode on pasted text (jobReport) |
auth-token-hygiene-job | JWT decode + leak scan on pasted text (jobReport) |
dev-json-pipeline-job | JSON validate → format → Zod (jobReport) |
dev-auth-debug-job | JWT generate → decode claims (jobReport; decode ≠ verify) |
dev-format-transform-job | YAML→JSON → format JSON → XML pretty-print (jobReport) |
email-auth-security-job | SPF/DKIM/DMARC + DNS + security.txt (jobReport) |
crawl-readiness-job | robots.txt + sitemap + redirects (jobReport) |
structured-data-audit-job | Schema + meta + social (jobReport) |
ai-overview-readiness-job | AI Overview readiness heuristics (jobReport) |
site-icons-audit-job | Favicon / apple-touch probe (jobReport) |
campaign-tracking-setup-job | UTM + ads macros + parser (jobReport) |
paid-ads-copy-gate-job | Ads copy limits + RSA preview (jobReport) |
growth-unit-economics-job | ROAS/CPC/CTR/CPA/CAC (jobReport) |
email-campaign-qa-job | Subject + spam heuristics (jobReport) |
landing-conversion-check-job | CTA + forms + tags (jobReport) |
content-optimization | Content optimization API |
document-convert-pipeline | DOCX → PDF |
Workflow steps bill one request per underlying tool call, same as REST.
Completed workflows with a synthesizer return jobReport (toolyour.jobReport@1) with merged findings, scores, and prioritized actions. The legacy result field mirrors jobReport when present.
For core-web-vitals-job and full-seo-audit, jobReport may include asset optimizer priorities from page speed (workstreams.assets.assetOptimizer and prioritizedActions with workstream: "assets" — compress images, defer scripts, CLS dimensions). These are HTML/HEAD heuristics, not CrUX field data.
Partial failures return status: "partial" with completed steps and failedStep.
Example prompt
Plan then run a ship gate for https://example.com and list the top blockers.
Your agent should call plan_task, then run_playbook("ship-gate", { url }) or solve_task, then verify_task after fixes.